6

I have one web server and two WAN connections (1 cable, 1 DSL). DNS is run offsite, and points to the IP address assigned by one of the ISPs. How can I have the second connection take over when the primary one fails?

I have seen that it is possible to have two A records, each pointing to a different IP, but it has several problems. What's the real solution to this? I imagine this is a very common issue.

Additional information:

The server is actually an electronic medical record server, and has to be on-site at the office. Their website and DNS is hosted at a large managed hosting facility.

I think the plan on the office side is something like the Peplink Balance previously mentioned or Cradlepoint MBR-1200.

The Peplink with switching DNS sounds like a solution, but I'm not sure how comfortable I am having the DNS in their office instead of the datacenter. I will look further into this for sure.

After talking to our hosting facility, they recommended we look into a third party service like Dynamic DNS. I believe it's basically a monitoring service which switches when one IP goes down.

Speed really isn't an issue; they're more concerned with high availability.

6 Answers 6

7

I imagine this is a very common issue.

Actually no. Most even smaller websites run with hosters who handle that. The hoster has multiple uplinks, his own address space and announces his routing via BGP to the peers.

This is also a lot more bandwidth efficient as basically... the uplink speed of a typical end user connection is horrible.

I would say that most people "unprofessional" enough to try running a website from behind a cable / DSL link.... also do not have two connections.

3

I think the most 'real' way to do it is to get a block of IPs and then announce them to the Internet yourself to both ISPs with BGP. This would be with more of a 'real' connection that cable and dsl. For those levels of connections I think using DNS failover is probably on par with your setup.

I normal next stage would be to move to collocation and get a stable connection from an ISP offered at the collocation facility or the datacenter itself. They can give you two drops that use HSRP probably and they can go right into a switch or switches. This won't be perfect full redundancy but a large step forward.

2
  • Oh and a second webserver is probably a big jump in uptime (or often more importantly, recovery time which is an important factor in uptime) if you don't have that already. Aug 11, 2010 at 21:39
  • 1
    Kyle's answer is correct. If you do not have your own block of IP addresses (which is not the same as borrowing a block of IPs from an ISP), you are not really going to be able to accomplish your objective. There are so many reasons why true redundancy is ordinarily rented and not bought.
    – Skyhawk
    Aug 12, 2010 at 5:02
1

Updating the DNS is the lynchpin here. Round Robin DNS (multiple A records) doesn't do any health check by itself. What type of multi-wan router are you using? I know the PepLink Balance series include a DNS server on the router that will change the records when its links go down. If your router can't do this itself, you're probably going to need to write a script or find a service that externally health checks/polls both connections and updates the DNS server periodically.

Also, for those suggesting coloc - while this is an ideal answer for a production sever, chances are that this is a staging/development server that might be mounting or acting as the office file server, where the access speed from the LAN is more important than the uplink speed and stability.

1
  • actually, the OP's original problem is more one of asynchronous routing than the DNS response. While I've never actually asked, I'd have to imagine that most cable/DSL providers will balk at sending out BGP advertisements for a home connection. Aug 13, 2010 at 13:07
1

you can balance incoming traffic to your web server on both wan lines with an inbound load balancer. There are load balancer with a DNS server inside them (www.alvaco.com) the load balancer will connect to both WAN lines and the lan side of the load balancer can connect to your firewall or directly into your lan. The domain for your web site needs to be hosted in the lb, thus making the lb the SOA or parent dns server for that domain. This is accomplished by going to your domain name registrar and having them change the Parent DNS for your domain to the ips that terminate in the load balancer. From that point on, any query regarding any A or other record will come to the load balancer to be resolved. Since the load balancer has also 2 wan lines connected to it, it will offer the IP of the line that is best for him. The load balance will inbound load balancing and failover (if one line is down, it will not offer that IP).

1

Having two A records does not provide failover - basically half of your users will try to connect to one IP, another half will connect to another, regardless if those IPs are available or not.

You can use dynamic DNS for such a failover. Subscribe to any dynamic DNS service and setup a dynamic DNS client on your server machine. It'll check your (accessible) external IP periodically and whenever it changes, update the A record.

If you DNS provider does not support dynamic DNS, you can either - move your DNS to another provider, or subscribe for a dynamic DNS with some 3-rd level domain and create a CNAME record on your main domain which will point to the dynamic hostname. (The latter will work for www., but not for zone apex).

1
  • Hmm, not noticed that it's very old question. Not sure why I've seen it on the top.
    – Sandman4
    Oct 25, 2012 at 12:43
0

One possible solution is to find a single ISP that will service the DSL and cable connections while also providing failover. This is not ideal, but is about the best you'll be able to do without your own /24 network and bgp capable routers. There's a few drawbacks to this. The number one drawback is that you have a single ISP. If they have issues, you have issues. It's really meant to provide redundant physical connections to the ISP. 99 times out of a hundred, your DSL and cable issues are between the CO and the MPOE though, so this does help out a lot.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .