I have a small branch office, which has two internet connections from two different ISPs, each providing us with a /29 (eight IPs).

I currently have an extranet server there (basically a web server in the DMZ that has a limited connection to one of our internal database servers - so I really need to keep it on-site). It's presently using one of the IPs from one ISP.

I'd like to set it up to listen on the other ISP too as a failover mechanism. I appreciate that I will need to be pretty clever with DNS to make this work, but I have access to an Active Failover option on DNS (courtesy of Dynect) so that shouldn't in itself be impossible.

However, I can't work out how to get the routing to work.

The server is in a DMZ, which contains a router and two firewalls. If I set the default gateway to the router, then all outbound traffic goes through the primary ISP while it's up and gets rerouted to the secondary when the primary is down (we use object tracking on a Cisco router). If I point the default gateway to one of the firewalls, then all traffic goes to that ISP.

What I'd like to do is set up two IP addresses on my server - either both on the same NIC, or on separate ones; I do have a second NIC if that helps - and reply to traffic that comes in to one IP through one firewall and to traffic on the other IP to the other firewall.

I tried putting the two different NICs on different IPs with different default gateways, but that doesn't work - the routing table in Windows doesn't determine routes by the source address of the traffic.

There are things I can do with routers - though that probably means getting something more powerful than what I have - but I was wondering if anyone knew a Windows way of making TCP responses go to different default gateways depending on which IP address they originate from on a multi-homed server, ie routing based on the source address rather than purely the destination?

I know that Linux can do this with iproute2 but can Windows, perhaps using RRAS?

  • Gadsen, could you add some ASCII art that describes the topology of the routers / firewalls... that's still kindof unclear at the moment – Mike Pennington Apr 21 '11 at 17:36
  • One problem with this type of concept is not going to be changing the DNS records to point to the new IP of the failover, but in the delay of propagation before connection is restored to the primary and the DNS has to be changed yet again. – MaQleod Apr 22 '11 at 5:46

Unfortunately, the easiest (and I do mean easiest) way to do this is going to be to get a /24 of your own and run BGP with both your upstreams and let routing do the magic instead of windows routes. Your situation is begging for a dynamic routing protocol and doing it other ways is going to get complex. Note that you do not need a big huge router to run BGP if you're just taking default from each provider (essentially what you're doing now).

| improve this answer | |
  • That's what I do at our (much larger) main office, but have you tried getting a /24 these days? It was hard enough in an office where I could actually justify needing over 20 IPs; in an office where I really don't need more than three it will be impossible. I'll just have to buy a router that will let me do source based routing. – Richard Gadsden Oct 7 '11 at 23:04
  • Per ARIN policy 2001-2 arin.net/policy/proposals/2001_2.html multihoming can serve as justification for a /24 – Aaron Oct 8 '11 at 3:23
  • I'm in RIPE. And yes, there is a similar policy here too. But we're a heck of a lot closer to exhaustion, and RIPE NCC will probably say "no" based on experience. – Richard Gadsden Oct 13 '11 at 10:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.