Split access on a Windows Server?

Question

Situation: Two ISP's, need to provide failover redundancy.

It seems like the prevailing wisdom when it comes to Windows servers is "don't multi-home". And whenever anyone asks how to do it properly, you get people asking "why do you need to"? Other suggestions are "use a load balancing router".

Unfortunately, I've tried to use load balancing routers (consumer level, I can't afford high end Cisco's) and they just don't work reliably, and they don't really offer source based routing (or any kind of real policy based routing) to allow specific traffic to use specific internet connections.

The best overall solution in my case is to simply feed both internet connections into my server via seperate NIC's. The problem is that Windows doesn't seem to have a way to do what's called "split-access" routing. Split-access allows multiple interfaces to have their own default gateways so that when a packet comes in from the internet, the response packets can be routed back over the same gateway (instead of the system default gateway).

For more info on split-access read this:

http://lartc.org/howto/lartc.rpdb.multiple-links.html

This solution works great for Linux, using iproute2, i can setup split-access and things work great. But in Windows, it always tries to respond to packets that originate from outside the LAN via the system default gateway rather than the gateway of the second net connection. You can't simply add a second default gateway, as this causes all kinds of weird results.

Is there any way in Windows to do something similar to split-access with iproute2 in Linux?

The idea here is that I have two NIC's in the server. I bind my web server to both NIC's with different IP addresses, then I use failover DNS system that will monitor my network connection and switch to the secondary IP (on the second ISP) if the first goes down. Not the best solution, but I can pull it off for a lot less money than alternative solutions.

For DNS failover, i'm considering a solution such as this:

http://www.dnsmadeeasy.com/s0306/prod/dnsfosm.html

Please don't lecture me about not needing to multi-home, because I cannot afford the equipment to do load balancing properly and consumer level equipment doesn't function reliably for my needs.

Answer 1

I would suggest setting up a linux based router to perform the dual-homing. Then configure source based routing to achieve the equivalent of iproute2. It seems to me that split-access routing is a special form of source based routing.

Alternate suggestion: move the server to a linux platform and use iproute2 if that is the routing solution that meets all of your needs.

Alternate suggestion: virtualize the Windows server, run on a linux server, and let the linuxe server running iproute2 do your routing.

It sounds like you will be accepting limited non-connectivity periods, so you will not need to worry too much about the Layer 3 routing issues that plague VRRP or clustering architectures. One thing to keep in mind, however, is that many applications and intermediate packet inspection points will expect consistent routing of a given connection, i.e., "Persistent Connections". Maintaining persistent routing of connections has been a pain in the sides of network and security architects for some time.

If you can't afford a commerical product, have you investigated:

• LEAF
• Freesco
• Astaro security gateway (install on a whitebox) or similar
• Really, any of the offspring of the Linux Router Project

Answer 2

If I understand your requirements correctly, a Draytek 2910 router will do exactly what you want, and unless your time is free it will be a lot cheaper than rolling your own.

We use Draytek 2910s all over the place, typically with one WAN port connected to an ADSL (NoNAT) router and the other to a leased line or similar connection. The router will detect a link failure on the WAN ports using a ping to an address you specify, and disables a failed port in about ten seconds. From inside traffic flows out through whichever WAN port is less loaded. You can also specify load balancing rules to direct outbound traffic through a specific WAN port based on source and/or destination ip address and/or port.

From outside you use port mapping rules separately on each WAN port, and if, for example, you port map 80 to an internal server on both WAN ports the router accepts connections on either WAN port and directs it to the server.

JR

Answer 3

Try PfSense firewall/router. I've used it in similar situations.

Vyatta may also be an option. I haven't used it in awhile and have read their latest is much easier to set up.

Answer 4

Not sure if this will work for you since I haven't had your issue, but this might be an option.

The Linksys RV042 router might do the trick for you (BTW, this is now Cisco Small Business), the router was about $200 last time I checked.

It has Dual WAN ports so you can have 2 seperate ISP's and each WAN gets its own IP. That I have done and it worked great.

Here is what I didn't do because I didn't need to but you can try this.

Setup port forwarding like this WAN1 forwards port 80 to your internal server WAN2 forwards port 80 to your same internal server

You should be able to forward both WAN's to the same internal IP & Port. I'm guessing here the reply packets will go out over the port they came in on in the router.

Then when your DNS fails over to your second IP it should work.

I'd say buy one of these routers from a place you can return it if it doesn't work and give it a try.

Also I've been using 8 of these for the last 3 years with not one issue with them.