2

This question in not about how to do it, but about what should be done.

The situation is as follows:

  • A small/medium sized company site
  • Multiple DSL and Cable internet connections (nothing better available except for 10x the price)
  • Multiple internal networks
  • The need for the traditional network features: DHCP, VPN, nat, firewall, etc.
  • The desire for more advanced features: DPI, filtering of malicious sites, traffic analysis

What is a good way, hardware and software wise, to connect everything together? (I won't elaborate on the current "solution" because it is horrible)

  • I want to have gigabit speed inter-lan routing, at least between three of the LANs.
  • The total download speed of all internet connections is nearly 500 MBit/s.
  • The VPNs are not heavily used; total VPN throughput is in the 50 MBit/s range, but the latency should be kept low.
  • The networks (LAN-LAN and WAN-LAN) should be firewalled.
  • QoS/Traffic Shaping on the (load balanced) WANs is desireable since the devices have very different load patterns. It ranges from 24/7 video streams with low priority to business applications with low bandwidth consumption who desire a low latency.
  • HA would be desirable but is probably not feasible for the PPPOE-based DSL lines with a single IP. But is there something else which would keep the downtime to a minimum in case of failure?

I have considered solutions:

A) Use one big router

This would mean to connect all WANs and all LAN/VLANs to a single router which would do everything. But is it feasible?

Using a software firewall like pfSense or sophos would offer a lot of features. BUT it would require a server with at least 8 gigabit ports and it might be to slow. From all that I could find, using multiple routes at gigabit speed uses quite a lot of CPU power which then becomes the bottleneck.

B) combining two routers

One router could handle the WAN side, do the load balancing, WAN firewalling, Traffic Shaping, etc. Could a software solution like pfSense handle this on a not-so pricey hardware?

Another router would then handy the inner LANs. Maybe something like an 8-Port Edgerouter could handle this. It has a firewall which is complex enough for the inter-lan part (but too simple for the WAN part) and can do hardware offloading.

Would this work?

How about the VPN connections? How should the other functions (DNS, DHCP) be divided between the routers? Would NAT work? (Since the clients and pfSense would be in different networks)

Are there other, better, solutions?

  • Can you be specific? "Multiple DSL and Cable internet connections" - How many, and what bandwidths? – ewwhite Jan 10 '18 at 2:11
  • @dmourati thanks, I know how to setup the load balancing part, thats pretty easy. I am more worried about having the inter-lan routing on the same machine. But solution C seems to be able to cope with this problem. – masgo Jan 10 '18 at 14:17
  • @masgo No answer to my question? – ewwhite Jan 11 '18 at 2:10
  • @ewwhite we have a total of 7 lines (sic!) with speeds ranging from 150MBit/10MBit to 16Mbit/2MBit. Some of them are already scheduled for an upgrade. Load balancing as such seems not to be the problem. I can connect all of them to a Managed switch and connect them with a tagged VLAN trunk to a single gigabit port of the router/firewall. Since their bandwidth sum is way below gigabit, this should work niceley. – masgo Jan 11 '18 at 14:13
1

Solution C:

Two big router/firewall in HA with pfsense. Now in my data center I use 2 virtual pfsense to mange all:

  • 16VLAN tagged
  • 180 virtual servers + 19 physical servers
  • 16 public IPs + 254 public IPs
  • IPS+IDS
  • 8 IPSec VPN
  • 21 OpenVPN for remote clinet
  • NAT, traffic shaping
  • Load balancer and failover (for public web site) ecc ecc...

10Gbit/500Mbit internet feed and 10G/10G LAN speed.

  • Hi, this sounds pretty good. What hardware are you using? - For the HA: unfortunatley we do not have a good internet connection. Therefore the multiple DSL Lines. They are all PPPOE connection with only ONE static public IP each. From what I got, I need three IPs for HA, right? – masgo Jan 10 '18 at 14:15
  • I created two virtual servers with 4CPU and 8Gb of RAM and 8Gb og HDD and many network interfaces. Regarding PPPOE is not a problem (for me) close PPPOE with DSL modem and forward all traffic to VirutalIP of pfsense cluster. In this case you have only one critical point the: the DSL modems – Alessandro Secchi Jan 10 '18 at 14:28
  • The question is: does the packet processing drain the Virtual CPU or is it somehow masked from the VM? It it does, and if 4 Cores are enough to saturate a 10 GBit link, then I would use a very similar solution. Probably with bare-metal pfSense. – masgo Jan 10 '18 at 17:23
  • I think your count is wrong. The performance of the vCPUs you decide, you decide the priority of the virtual thread. What hypervisor do you use? Try this link firewallhardware.it/en/pfsense_selection_and_sizing.html – Alessandro Secchi Jan 10 '18 at 18:11
1

How much is your time worth? I would simplify.

  • Use the two fastest, most stable and diverse connections; e.g. coaxial cable and the best DSL.
  • Purchase a reasonable new-generation firewall. A Cisco Meraki MX64 or MX84 are good candidates.
  • A Meraki MX64 is $1200 with all of the content filtering and IDS features. A standby unit is $400.

Configure your WAN uplinks. PPPoE is supported.

Configure the Meraki for the appropriate VLANs and ACLs.

enter image description here

Set your WAN speeds...

enter image description here

Set a load balancing policy...

enter image description here

Build traffic shaping rules...

enter image description here

Client VPN is built in. Site-to-Site VPN is available. You didn't clarify what you needed.

You didn't explain if you have inbound services to support. Load balancing is transparent for outbound connections. Inbound would need some form of DNS load balancing (I use AWS Route53, 30 second TTL and health checks).

  • The Meraki boxes look really nice. The Limitation to 2 WANs is bad because the fastest two lines are definetley not enough. But everything else looks quite nice. I have contacted them, maybe it can use more WANs bundled via VLANs. Since our WANs would all fit easily into one gigabit trunk port. ... I also need to check the privacy policy of the cloud management thing. If data would leave the EU, then it would be a complete show stopper (due to new laws effective May 2018) – masgo Jan 12 '18 at 17:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.