Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Situation: Two ISP's, need to provide failover redundancy.

It seems like the prevailing wisdom when it comes to Windows servers is "don't multi-home". And whenever anyone asks how to do it properly, you get people asking "why do you need to"? Other suggestions are "use a load balancing router".

Unfortunately, I've tried to use load balancing routers (consumer level, I can't afford high end Cisco's) and they just don't work reliably, and they don't really offer source based routing (or any kind of real policy based routing) to allow specific traffic to use specific internet connections.

The best overall solution in my case is to simply feed both internet connections into my server via seperate NIC's. The problem is that Windows doesn't seem to have a way to do what's called "split-access" routing. Split-access allows multiple interfaces to have their own default gateways so that when a packet comes in from the internet, the response packets can be routed back over the same gateway (instead of the system default gateway).

For more info on split-access read this:

http://lartc.org/howto/lartc.rpdb.multiple-links.html

This solution works great for Linux, using iproute2, i can setup split-access and things work great. But in Windows, it always tries to respond to packets that originate from outside the LAN via the system default gateway rather than the gateway of the second net connection. You can't simply add a second default gateway, as this causes all kinds of weird results.

Is there any way in Windows to do something similar to split-access with iproute2 in Linux?

The idea here is that I have two NIC's in the server. I bind my web server to both NIC's with different IP addresses, then I use failover DNS system that will monitor my network connection and switch to the secondary IP (on the second ISP) if the first goes down. Not the best solution, but I can pull it off for a lot less money than alternative solutions.

For DNS failover, i'm considering a solution such as this:

http://www.dnsmadeeasy.com/s0306/prod/dnsfosm.html

Please don't lecture me about not needing to multi-home, because I cannot afford the equipment to do load balancing properly and consumer level equipment doesn't function reliably for my needs.

share|improve this question

4 Answers 4

up vote 0 down vote accepted

I would suggest setting up a linux based router to perform the dual-homing. Then configure source based routing to achieve the equivalent of iproute2. It seems to me that split-access routing is a special form of source based routing.

Alternate suggestion: move the server to a linux platform and use iproute2 if that is the routing solution that meets all of your needs.

Alternate suggestion: virtualize the Windows server, run on a linux server, and let the linuxe server running iproute2 do your routing.

It sounds like you will be accepting limited non-connectivity periods, so you will not need to worry too much about the Layer 3 routing issues that plague VRRP or clustering architectures. One thing to keep in mind, however, is that many applications and intermediate packet inspection points will expect consistent routing of a given connection, i.e., "Persistent Connections". Maintaining persistent routing of connections has been a pain in the sides of network and security architects for some time.

If you can't afford a commerical product, have you investigated:

share|improve this answer
    
I really don't care about the Layer 3 issues. I'm not looking for seamless transition. Basically, I just want to reroute people via failover DNS to a different IP if my primary internet connection goes down, and I want that alternative IP to be on a different interface on a different subnet of a different ISP. If they lose their session, that's fine.. so long as they can reach the server (there is likely to be a 5 minute downtime window in DNS monitoring anyways and DNS TTL issues). I'm not looking for a professional solution here, just one that basically works. –  Erik Funkenbusch Jun 3 '09 at 8:01
    
There is a lot of complexity involved in "just rerouting people via failover DNS". How does your server or its upstream router know that the primary ISP connection is down? The traditional answer is dynamic routing protocols, and the kludge answer is scripting routing table changes based on ICMP echo/request traffic. –  pcapademic Jun 3 '09 at 8:14
    
Regarding the Linux solutions, I've looked at all the products you mention, but none of them really work well in a dual-wan configuration where you want both reliable failover and need to do policy based routing (for instance to route VOIP traffic on one ISP and Web traffic on another). Linux in general gets very complicated very quickly when you try to do all this (and more), and frankly i've just run into way too many bugs that require restarts or resetting the routing configuraitons after a period of time. This is why I eventually just went to a split-access solution for my Linux servers. –  Erik Funkenbusch Jun 3 '09 at 8:15
    
I provided a link in my question that gives a DNS failover solution. They monitor your server, and if they detect it has gone down, they update the DNS to point to a secondary "hot spare" which happens to be the same server with a different IP address on a different ISP. Yes, it's a kludge, but I can't using BGP or other solutions because I live in a 3rd world country with very poor internet capability and essentially residential service. And yes, I have to run these servers locally and not host them somewhere for security reasons. –  Erik Funkenbusch Jun 3 '09 at 8:18
    
I certainly understand your frustration with the available lower-cost options. The industry has been struggling with the multi-homed problem for a long time. It is a tough problem, because IP was not designed to work the way you desire. In the end, you will need to accept some trade-offs. RFC 1925 (faqs.org/rfcs/rfc1925.html), # 7a "Good, Fast, Cheap: Pick any two (you can't have all three)." –  pcapademic Jun 3 '09 at 8:28

If I understand your requirements correctly, a Draytek 2910 router will do exactly what you want, and unless your time is free it will be a lot cheaper than rolling your own.

We use Draytek 2910s all over the place, typically with one WAN port connected to an ADSL (NoNAT) router and the other to a leased line or similar connection. The router will detect a link failure on the WAN ports using a ping to an address you specify, and disables a failed port in about ten seconds. From inside traffic flows out through whichever WAN port is less loaded. You can also specify load balancing rules to direct outbound traffic through a specific WAN port based on source and/or destination ip address and/or port.

From outside you use port mapping rules separately on each WAN port, and if, for example, you port map 80 to an internal server on both WAN ports the router accepts connections on either WAN port and directs it to the server.

JR

share|improve this answer
1  
I've already bought half a dozen different "dual wan" routers. All of them have various problems. I own an AboCom MH350, a Linksys RV42, a M0n0wall based router, etc.. they all have problems. They're either buggy, don't have the features i need (policy based routing mostly), etc.. I don't want to buy another device only to find out it doesn't do what it claims to, or doesn't do what I need. –  Erik Funkenbusch Jun 3 '09 at 17:22
    
So let me ask you a question about your Draytek. Can you configure it to not load balance, but do policy based routing (both IP and port based?) but use failover? I want outgoing traffic from 10.0.0.10 to use ISP1 and traffic from 10.0.0.20 to use ISP2, but if ISP1 fails then 10.0.0.10 has to be moved to ISP2. That's usually a problem because the source based routing has been manually configured. Also it needs to be able handle routing inbound traffic from both interfaces. I have a Sonicwall that did all this, except it would lock up every 3 days and need rebooting. –  Erik Funkenbusch Jun 3 '09 at 17:29
    
Another thing it has to do is fail WAN2 to WAN1 when WAN2 fails, which is also typically a problem with these devices. So if i'm policy routing my voip via WAN2, if WAN2 fails then it has to go out WAN1. In playing around with the online demo of the Draytek, it doesn't look like it can do this. –  Erik Funkenbusch Jun 3 '09 at 17:37
    
Good news first: the 2910 does accept incoming connections on both ports and our 2910s at least don't lock up and need rebooting. It also copes fine with failure of either WAN1 or WAN2 and uses whichever port is working. Bad news: if you have a policy to force e.g. connections to port 80 via WAN2 then if WAN2 fails it will not dynamically modify the policy to use WAN1 instead. You would have to manually disable or change the policy. –  John Rennie Jun 4 '09 at 10:01
    
You can use the 2910 in failover mode rather than load balancing, i.e. have only WAN1 active and bring up WAN2 only if WAN1 has a link failure. However if you use the router this way you can't handle incoming connections on both WAN ports because obviously only one WAN port is active at a time. –  John Rennie Jun 4 '09 at 10:03

Try PfSense firewall/router. I've used it in similar situations.

Vyatta may also be an option. I haven't used it in awhile and have read their latest is much easier to set up.

share|improve this answer
    
I've already tried to use PfSense, but the load balancing is designed primarily around VRRP. I don't really need load balancing anyways, I need failover, and pfSense doesn't seem to understand why you wouldn't want load balancing. I do use Vyatta, and their load-balancing and failover is also buggy and i've been waiting for them to patch the behavior of failover properly for over a year. –  Erik Funkenbusch Jun 3 '09 at 15:45
1  
Are you against using load balancing on PfSense? I have a unit running both load-balancing and failover and it seems to work fine with failover. –  Keith Stokes Jun 4 '09 at 14:03

Not sure if this will work for you since I haven't had your issue, but this might be an option.

The Linksys RV042 router might do the trick for you (BTW, this is now Cisco Small Business), the router was about $200 last time I checked.

It has Dual WAN ports so you can have 2 seperate ISP's and each WAN gets its own IP. That I have done and it worked great.

Here is what I didn't do because I didn't need to but you can try this.

Setup port forwarding like this WAN1 forwards port 80 to your internal server WAN2 forwards port 80 to your same internal server

You should be able to forward both WAN's to the same internal IP & Port. I'm guessing here the reply packets will go out over the port they came in on in the router.

Then when your DNS fails over to your second IP it should work.

I'd say buy one of these routers from a place you can return it if it doesn't work and give it a try.

Also I've been using 8 of these for the last 3 years with not one issue with them.

share|improve this answer
    
I already own an RV042, and unfortunately it just doesn't work with anything but the most basic configuration. Source based routing is supposed to work, but it stops routing when you try.. and frankly, Cisco's support on the product is non-existant and they act dumb when you call them about it. –  Erik Funkenbusch Jun 3 '09 at 15:43

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.