Ask Slashdot: Best Connect Scheme For a 2-ISP Household?

c_petras writes "I just had DSL installed (a 19,000 ft run — Woo Hoo!) to act as a backup to my regional WiFi connection. How should I configure my home network so I don't have to swap the cable from one ISP's router to the other to maintain a good connection? Is it as simple as getting another router and plugging the two ISPs in? Is there a more elegant solution that would not require the use of three separate boxes and associated wall warts?"

Comments

What I did.

[grub]

I did this a couple of years ago with DSL and cable. My choice was to use OpenBSD's Equal-Cost Multipath Routing. I've seen other hardware devices that accept two broadband connections but the OpenBSD option was much more elegant and allowed some good granularity in traffic control (ie.: traffic to my cable ISP's billing page may as well go through the cable connection)

I had a couple of lines in pf.conf as so:

table <route_cable> persist file "/etc/route_cable"
table <route_dsl> persist file "/etc/route_dsl"

then would force the network ranges/IPs contained through the appropriate interface.

I dumped the DSL about a year ago but this worked very well for me. YMMV. Mail me if you'd like more info/tips.

Re:What I did.

[grub]

Oh I should note that this was pretty basic load sharing (I won't grace it with the term "load balancing") not failover.
A script would ping out through each interface and if one went down all traffic was rerouted out the other so failure of one link didn't botch things up.

Re:What I did.

[Bastardchyld]

I recommend pfSense 2.0 RC3 to be specific. It has a new ability to use Multiple WANs, you can even weight them based on which has a better connectivity and balance traffic over both. Giving you load balancing and failover between both connections.

Re:What I did.

[grub]

Ohh that sounds sweet (just did teh googlez on it) I don't think it had those features when I looked back when.

Re:What I did.

[grub]

No problem asking: they were both business accounts. I was trying to keep a lot of the stuff in-house as I'm an admitted control-freak but decided to drop the DSL and do more on remote *nix boxes. The price is about the same and I get a full 100/100 Mbits on the remote ends.

Re:What I did.

[pz]

I'm not the highly informative poster above, but can readily speculate justifications nevertheless: (1) reliability, reliability, reliability, (2) cost differential between the two services during different times of the day or days of the week, (3) to maximize available bandwidth if one or the other connection bogs down from one's neighbor, (4) to be able to tell one or the other service to frell off on a moment's notice, (5) to be able to load down one ISP's connection, say with a large file transfer, and have the local network still remain responsive by automatically switching everything else to the other ISP, etc.

I've implemented a related, but certainly not identical, system in my home with two wireless APs running two independent networks feeding a single cable connection. Robustness was the primary motivation.

Re:What I did.

[v1]

I'm kind of honestly baffled that somebody would need more than one ISP at home

I run a variety of small services at my home, have done so for 15 yrs. Mail and web for example. I have DSL and cable. My DSL just recently upgraded to 1up/7down from 1up/1.5down (umm thanks for the DOWNstream bump... not), and the cable is now at 2up/25down. Obviously cable is the better performer, but it's also less reliable/consistent and doesn't offer static IP addresses. And my cable speeds can really dip badly during prime time when everyone is netflix'ing. DSL is fairly stable any time of the day.

Qwest's DSL in my area (read STATE) was down for over two entire weeks because the clowns built both of their regional NOCs 100ft from the same river. MediaCrap just goes down whenever a fly in Kenya farts, but it's always back up again in an hour or less. (usually happens early in the AM, guessing that's when they move their patch cables around? *shrug*) Neither of them are in any hurry to provide me with better upstream speeds or more reliable service, such is my fate in an area that lacks choices/competition.

Re:What I did.

[msauve]

What if someone works at home, and needs a reliable connection to the corporate network? I'll let the boss know I'll be watching TV whenever the net goes down.

Re:What I did.

[Vegemeister]

you...have to watch TV instead

A terrible fate indeed.

Re:What I did.

[msauve]

Actually, what you said was:

The question is, why would someone need that level of availability at home? At a business, if you have downtime, you lose money. At home, if you have downtime, you...have to watch TV instead?

Re:What I did.

[Eunuchswear]

I bet you don't understand why some people might want more than 640k either.

Re:What I did.

[wolrahnaes]

Echoing this. I started with pfSense because I wanted a multi-WAN router, but still use it to this day even on single-WAN environments because it's trivial to get going on any spare PC hardware, can be easily built in to an "appliance" with a number of available embedded x86 boards, and does pretty much everything. Of course it's not as fast as hardware built for the purpose, but if you have hardware encryption available I haven't yet seen a reason to choose a PIX/ASA over it on performance grounds. Obviously support and corporate love for Cisco are other factors which may come in to play for some applications.

Re:What I did.

[msauve]

"If one were to be working from home, then that would qualify as "at a business.""

Not to the IRS, and there's a reason it's called "work at home," not "work at business" when you work from home. Duh.

Re:What I did.

[wolrahnaes]

Shitty service.

A few years ago I lived in a town called Wellington, Ohio. The LEC in the area was Verizon (now Frontier) who offered a DSL service that was officially supposed to be around 3m/768k but usually barely beat 2m/512k and would go entirely down (signal loss at the modem or no PPPoE response) for hours at a time multiple times per month. My roommate and I tried multiple modems including the Verizon-provided Westell, a Cisco 675, a few Motorolas, and an Edgemarc 200AW with no change, nor did installing a direct 35 foot Cat5e link from the telco demarc to the modem, entirely disconnecting the in-house wiring (we were cell-only and worked at a VoIP company so we had no interest in POTS).

So go to cable, you may say. Enter GLW Broadband. Basically, these guys were a local cable TV provider who did the minimum necessary to keep people mostly happy with their TV in these semi-rural areas. At some point they added broadband internet services, but it's clear that they do not take it seriously. As far as I could tell during my time as a customer of theirs as well as while working with customers of mine who had their internet services, they had a single upstream connection to Time Warner. They were somehow worse than Verizon. The modem would lose sync regularly, when it was up the speed was rarely even the 1.5/768 that it was supposed to be, and more than once static IPs just stopped working altogether and would have to be changed. One of my customers I shared with them was literally a stone's throw down the street from the GLW main office, yet they had an outage which lasted a week which they couldn't figure out. I could have run a standard ethernet cable across the lawn between the offices and it would have been entirely within spec.

There was also a local WiFi ISP, but they wouldn't even offer a non-NATed address so they were right out.

When faced with these options, the only option if you want anything approaching reliability is to get as many as you can afford and hope they're not all sucking at the same time.

Re:What I did.

[next_ghost]

You must have experience in tech support. That's a typical answer to a request, "why do you need that?"

Your lack of imagination doesn't equal someone else's lack of need.

The main problem of tech support is that what people try to do and what they really need tends to be two very different things. When you do tech support or software design, asking "why do you need that?" right in the beginning can save you a lot of pain later caused by lack of imagination and basic knowledge on the client's side.

Re:What I did.

[I)_MaLaClYpSe_(I]

For example, I enjoy playing poker tournaments. One of the tournaments I play on a regular basis starts at 00:00. At around 2 a.m. my ISP seems to choose his preferred downtime windows as this is out of his support window. I can't even call my ISP and complain at that time.

I currently circumvent these downtimes that might occur once every month or so by switching to my iPhone hotspot. But on the one hand side this means loosing at least two or three hands. This is especially cruel if I happen to have great cards and have just bet a significant amount of chips and then my line goes #carrier lost. On the other hand side this compromises my VPN solution that I implemented to circumvent the human rights violating data retention laws in my county.

I am sure there are other sane reasons for private redundant internet lines if not for the disturbing moment where your lolcats video starts to hang or where your wanking is suddenly interrup#carrier lost

Re:What I did.

[I)_MaLaClYpSe_(I]

And one time, at downtime, I wrote this really long enlightening commentary on Slashdot and when I hit the submit but#carrier lost

Re:What I did.

[WolphFang]

Indeed. pfSense is a seriously useful bit of software! set up a college's main firewall with auto failover between two firewalls.... it can even replicate states and configs automatically. It can also run from CD-ROM with a floppy to store the config on if you have an older box.... And can use just one NIC you have the ability to sep things out by VLAN, etc.

Re:What I did.

[gnapster]

My boss just implemented PJ-Thursdays, so we can "work at home" in our downtown office building, you insensitive clod!

Re:What I did.

[m50d]

I've implemented a related, but certainly not identical, system in my home with two wireless APs running two independent networks feeding a single cable connection.

Huh? Surely that's backwards from the useful way to do it - all your client machines would need to be able to connect to two wireless networks simultaneously and sensibly failover between them.

Re:What I did.

[pz]

Yes, except that I implemented two separate networks to partition clients into two separate pools. Thus the "related, but certainly not identical" part of my comment. The intent is related in that each pool of clients is made more robust to what the other pool is doing.

PFsense

[Anonymous Coward]

1. Setup a pfSense router/firewall
2. Configure Failover
3. ??
4. PROFIT!

Re:PFsense

[yakatz]

I was about to write pfSense when I saw the parent post, so I will just second it.
I use it at home and at several of my clients, and one of those has dual WANs.

(Full disclosure: I have contributed (code, not money) to pfSense.)

Re:PFsense

[That's What She Said]

You said "Code takes Time".

So, Code contains or is made of Time. If Time is Money, Code contains or is made of Money.

When people just write more code to try to squash a bug, they're just "throwing money at it", right?

Re:What router/firewall?

[Anonymous Coward]

http://lmgtfy.com/?q=dual+wan+router

PFSense is a great place to start

[Anonymous Coward]

PFsense (www.pfsense.org) is a great open source multi-wan router. I currently run 3 separate incoming connections to my network with it flawlessly. Combine this with great VPN,load balancing, round robin connection, traffic shaping, and bandwidth monitoring and it is a fantastic easy to use tool.

Re:PFSense is a great place to start

[TheRaven64]

Note that with this setup you still have to manually reconnect persistent connections if one ISP goes down. If you need transparent fail-over, then things get a lot more complicated (and expensive!) because you'll need the same IP address (range) from both ISPs.

Re:PFSense is a great place to start

[bunny.rabbit.3]

I second this choice. I used pfSense in a multi-WAN corporate solution. I had fast & cheap cable for common users which failed over to a 3xT1, which was normally reserved for server traffic. Before the cable, we had DSL that was about the same speed as the T1 and toyed with round robin load balancing. Eventually, I convinced my brother to switch to this solution for his home network. He manually switched between 2 providers that both had 5 GB limits each month. This worked flawlessly until he upgraded to a better provider 2 years later.

Re:What router/firewall?

[blair1q]

He's not going to find that on his typical home router, which comes with one upstream port and one downstream subnet.

Albeit some have hidden capabilities: mine has the hardwired downstream subnet, the hardwired upstream port, and one wireless subnet that can mimic two (the secure wireless and the guest wireless). This is probably pretty typical for wireless routers right now.

But still, the second WAN port is not going to be there unless you shop around. Ala kazam:

http://www.google.com/search?q=google+shopping&q=router+dual+wan

Home Server

[muyla]

You can set up an old computer as a home server doing the balancing of the two connections, and you can even add some more functions to it (file server, vpn, etc).

A good distro for it is Zentyal, which is based on ubuntu and will let you config the whole thing over a web browser, just like one of those d-link routers.

pfSense

[gellenburg]

My recommendation: pfSense.

Or ClearOS.

pfSense is FreeBSD based. ClearOS is linux-based.

dd-wrt

[mmmmbeer]

If your router supports dd-wrt, it has this option built in. You may need more than one router for this. I've never tried it, but there's info about it here: http://www.dd-wrt.com/wiki/index.php/Mesh_Networking_with_OLSR

Re:dd-wrt

[Anonymous Coward]

DD-WRT was my first thought for something that could do this with out costing a fortune but Mesh Networking isn't even close to what the OP is asking about.

http://www.dd-wrt.com/wiki/index.php/Dual-WAN_for_simple_round-robin_load_equalization

or

http://www.dd-wrt.com/wiki/index.php/Dual_WAN_with_one_as_standby_backup

Re:dd-wrt

[skids]

Most WRT-capable boxes will have one upstream port an a LAN port connected to a built-in switch. It should be possible to VLAN the switch in such a way as to peel off a single port to act as a second WAN port. However, a good amount of this hardware will boot up with the switch running open, and will not apply the VLANs until the bootloader initializes the switch. So it's not suitable if that moment of open bridging causes problems with the provider or you have high security

Also that would mean you'd be sharing the bandwidth of the built-in switch''s uplink port between LAN traffic going in and out of the hard ports, WAN traffic to the second ISP, and traffic between the LAN and WiFi. If you do not have any hardwired LAN, however, none of the above problems apply. You just have to tough it out to get past all the defaults trying to set the LAN port up as a LAN.

If you pick a unit with GE ports, sharing the bandwidth should not be a problem, but do take care to install anti-bufferbloat policing.

Re:dd-wrt

[skids]

OpenWRT can act as a client, though support for this can be a bit dicey. You CAN get the web interface to cooperate and define interfaces/zones as you want, it's just not intuitive. I don't remember seeing anyone talking about making the radio simultaneously act as a client and an AP...

But then, if one is a wireless service, does that service even need a router, wouldn't the clients join directly? So why the need for two ports?

Expensive But Available

[erilane]

There are companies that make routers with 2 WAN links. Health checks are run periodically (pinging a public DNS server or some other reliable IP through the link), and traffic is routed across your preferred link if it is up, or the backup if the preferred link is down. The one I'm familiar with is made by FortiNet and costs $500+ http://www.fortinet.com/products/fortiwifi/50B.html

Re:Expensive But Available

[TheRaven64]

Wow, that's expensive. Something like a PC-Engines ALIX board with three LAN ports running pfSense provides the same functionality (complete with pointy-clicky web interface) at a quarter of the price. Installing pfSense is just a matter of writing the .img file to a CF card, so there's not even the argument that there's a cost saving in terms of time - it takes a lot longer to configure either system than it will take to install.

Re:Expensive But Available

[ryanov]

Linksys RV082 is a cheaper alternative. I'm not 100% sure how the routing works, but it seems to me it accounted for downed links.

google: dual-wan router

[CityZen]

What you might consider is a dual-wan router. It can replace your regular router and provide more connectivity options.
Unfortunately, for the low-end ones that I looked at, the options were limited:
1) fail-over mode. Normally use WAN-A until it dies, then use WAN-B.
2) dual-WAN mode. Client 1 goes to WAN-A, client 2 goes to WAN-B, client 3 goes to WAN-A, etc.

What you probably really want is a truly load-balanced mode, which requires either going higher-end, or rolling something yourself with a PC.

There are some hacks for dd-wrt and such to make a router dual-WAN, but that looked to be more bother than I wanted to go in for.

Ultimately, for me, I made one WAN connection pretty solid such that I didn't have to bother with all this.

Re:What router/firewall?

[blair1q]

wtf. that link as posted does not behave as it did when i pasted it in my browser.

try this one:

http://www.google.com/search?q=router+dual+wan&tbm=shop

yeh. mosh bedda.

RV042

[Isarian]

The "Cisco" RV042 (http://www.newegg.com/Product/Product.aspx?Item=N82E16833124160&Tpk=RV042) supports this, by having two WAN Ethernet ports. Plug them both in and go. Relatively inexpensive at $180, sometimes you can find deals online for them. I say "Cisco" because I think the hardware is just rebranded "Linksys" gear from before the merger.

Re:RV042

[Overzeetop]

Yeah, but he's only 4 miles from his TELCO. By the time IPv6 is rolled out, he'll have FTTH. ;-)

Re:RV042

[Mr.Ziggy]

I thought the RV042 was going to be the godsend product: relatively cheap for dual-wan support in small offices. Turns out it just sucks.

My *personal* suspicion is it is part of the constant Cisco screwups of everything Linksys, but that's a different conversation.

RV042's run HOT, break, don't auto-switch or auto-detect a network outage like they are supposed to. Installed a bunch in some offices and had to replace all of them.

DO NOT buy the RV042.

Peplink makes a good but expensive dual-wan router which does everything you want and more. It is a larger, more robust office size product with pricing to match. But very good.

Otherwise you are looking at a BSD/Linux roll your own solution. I haven't seen anything good and small with 3 ethernet ports embedded in.

Re:RV042

[kevin_j_morse]

I would second this. Although the hardware is rebranded Linksys the firmware is completely redesigned by Cisco. I'm using two of these to run a bunch of web and mail servers and they're performing quite well.

Re:RV042

[kevin_j_morse]

Follow up to that. I'm using RV082 v3 which actually do support IPv6. SmallNetBuilder has a good review of them here http://www.smallnetbuilder.com/lanwan/lanwan-reviews/31525-cisco-rv082-and-rv016-v3-vpn-routers-reviewed

Re:RV042

[kevin_j_morse]

What hardware revision is it? When Cisco first bought Linksys they still sold the Linksys version for a while as a Cisco product. Now they have completely redone the product with a new processor, more memory, and new firmware. Like I mentioned in my previous post I used two of these at a company that I did some setup work for and have had no problems so far handling around 100,000 front page views a month on three servers.

I admit I was hesitant about the Linksys nature of the product but they are so cheap if you're really concerned just buy two.

Re:RV042

[wilson_c]

I installed a few of these for clients and they really failed to perform in a number of ways. Failover/Load balancing was unreliable when it worked at all. If you can swing it, go Sonicwall or proper Cisco appliance, if not consider DD-WRT or other open-source solutions, all of which have left me much happier than the RV042.

Re:easy as...rocket science.

[grub]

Convince your home ISPs to play BGP with you... Good luck! :)

Re:What router/firewall?

[ryanov]

The one that my church uses has a 2 WAN option:

http://www.cisco.com/en/US/products/ps9926/index.html

Not a home class one, but only $260.

Re:What router/firewall?

[Kenja]

Well its not a typical requirement. I use a Netscreen 25 which has four ports, each configurable as its own security zone (so you can have any mix of trusted and untrusted ports). Can get one for under 100 dollars via ebay.

The point was, we dont know what hardware he's running. If he's looking for hardware recommendations, that would be one thing. But its hard to tell from the article.

Multi wan router

[prichardson]

When I google 'multi wan router' (I assume you didn't get that far), Peplink is the first result. They seem pretty legit, but I don't have any of their products. They even have one that can connect to wifi networks and ethernet for internet connectivity, which seems right up your alley.

As far as I know, just linking to routers together will not work. Your computer can only have 1 gateway (where it looks for the real internet). Maybe there's custom firmware that allows load-balancing with another router, but I doubt it.

Re:Multi wan router

[HKcastaway]

I've used PEPlink and they are good.... Recommend them, service was good, though they did bring me one which had a hardware problem.

They have some pretty good load balancing policies, but there was some wacky idea I had which it wouldn't do.

  If someone is looking for clever inbound traffic balancing without BGP google that in week or so... actually it is something similar to my DNS racing... (sorry my blog is currently down).

Re:Multi wan router

[HKcastaway]

sorry I accidental paste. Google DNS racing... i will get my blog up,

Comment removed

[account_deleted]

Comment removed based on user account deletion

Netgear Dual-Wan

[malachid69]

I used a Netgear Dual-WAN for years. It allows you to specify (via the web-interface) which traffic goes over which network.

Small office firewalls

[HikingStick]

Some inexpensive small office firewall appliances support multiple external network connections, and can automatically move traffic to the secondary connection if the primary goes bye-bye. I believe one such device was a Multi-Tech SOHO firewall. There are like a lot of them out there.

pfsense

[juggler314]

If you can spare/build/whatever a machcine (and really it could probably be anything from the last decade), download pfsense, the installer pretty much works, the how-to's are very detailed. It's a mature stable product. It'll let you load balance your outbound connections as well as do everything a modern firewall does (you might, for instance, find being able to setup VPN on the box highly useful).

If you don't know anything about networking it might be a bit daunting, but probably still within the realm of possibility given it's all gui based and the docs are detailed.

Use Linux

[Vrtigo1]

While there are products that do this (dual WAN firewalls, etc) none of them are particularly great. If it were me, I'd repurpose an old PC, or a dedicated board such as a Soekris 4501 (http://soekris.com/net4501.html) and roll your own. It should be pretty simple to do it with iptables and a few bash scripts. Off the top of my head, I'd do something like ping a device a few hops upstream on each providers network every 60 seconds or so, if the device isn't responding, then failover and use another script to failback when the device is reachable again.

Using linux would allow.you to incorporate traffic monitoring, QoS, etc and even a file/web/dns server if you want to. In short, the linux route keeps you from getting locked in to a proprietary system that may not meet all your needs. There's load of documentation on doing stuff like this available online, so you don't even really need any prior linux experience as long as you have a will to learn.

Re:Use Linux

[hawguy]

While there are products that do this (dual WAN firewalls, etc) none of them are particularly great. If it were me, I'd repurpose an old PC, or a dedicated board such as a Soekris 4501

Before you repurpose a PC for something that can be done by a lightweight appliance, keep in mind the power costs.

A PC that uses 100 watts will cost around $130/year in power (in California @ $.15/KWh). Use that Soekris board (at 10W w/o disk) and you save $117/year, so it will pay for itself in less than 2 years.

Vyatta

[Ortle]

Check out Vyatta.. they have an appliance or it can be run on a computer/VM. They have a commercial version and a community version.

HSRP

[barfcat]

It seems like what you are looking for is HSRP. You have routing set up to where if the primary service goes down, the route dies and fails over to a secondary connection. I used to set this up all the time at the NSP I worked for and it was very simple. VRRP is even easier but it is Cisco proprietary and probably wouldn't fit your needs.

Re:HSRP

[dlb]

You got that backwards.

Re:HSRP

[barfcat]

Ah yes, right. Whoops. Been a few years since I've implemented either. Good call.

Re:Untangle

[jijacob]

In order to get multiple wan balancing/failover you end up having to pay a subscription fee. No thanks.

Since you have money to blow

[dlb]

Use what the grown-ups use.

Go buy yourself a Juniper SSG 20 with the optional xDSL module, and let the firewall take care of the failover for you.

~dlb

Untangle

[HockeyPUcX]

Untangle (http://www.untangle.com) may be a good option. It is relatively inexpensive and has WAN failover and load balancing capabilities with an easy to use UI if you don't want to go the 'roll your own' route.

Re:What router/firewall?

[blair1q]

He's got two bridges (one DSL and one for his regional WiFi) and some computers. The bridges presumably each have an ethernet port on his side of the box. He doesn't know how to connect the computers to the bridges so the thing just routes. Any dual-wan router will fit in that hole in his system. It's not so complicated that we need to know more.

Re:Connect routers with a string of bitcoins

[blair1q]

I knew bitcoins really came from china. It explains the hole in the middle where the string goes.

Sonicwall

[Custard]

Since you are asking on slashdot, I am going to assume that you are geeky, but not a network person.

If you were a network person, as I am, then building a little box to route would be easy. That is what I would do. If you have more time than money, then I heartily recommend that option. There is plenty of software that will work.

Assuming that you are not a BSD/linux routing jockey, then you should look at a SonicWall or similar firewall. There are TZ100s used on eBay for less than $150. The configuration is through a simple web interface and has wizards. There are other brands, and SonicWall is quite mediocre, but I have the most familiarity with them.

VRRP (Virtual Router Redundancy Protocol)

[microcentillion]

VRRP was created for exactly this.

Ubuntu based dual-wan routing

[ka9dgx]

I found myself in this same position a number of years ago, I've settled on using ubuntu linux, iproute2, and iptables, it's not easy to get working right, especially when you have DSL instead of a nice normal IP based connection (I will forever hate PPPoE)

The mental gymnastics of tracking ip connections across two separate routing tables in the same box will give you a few headaches, especially when a packet which comes in through the DSL heads back out the WiFi interface for no apparent reason... it's definitely not easy to get working. PPPoE imposed by our new DSL vendor added a new level of hell once we moved.

If you can find a piece of hardware which works well for less than a weeks worth of your time and effort, that has good reviews, and supports PPPoE, buy it, and don't look back.

Comment removed

[account_deleted]

Comment removed based on user account deletion

Linksys RV042

[applematt84]

I have a Linksys (now called Cisco) RV042 that has a dual WAN option and even offers load balancing with the newest firmware. Great product! I believe you can even install dd-wrt on it and make it do more than it was intended for. ;)

Duolinks SW24

[droidsURlooking4]

Dual WAN Load Balancer from SYSWAN. This thing is great. Tech support out of Oregon. $175 at newegg.

Re:Router with 2 WAN ports

[the eric conspiracy]

My SonicWALL has this feature.

myself: load-shared routing in linux, mixed result

[boss_hog]

You might want to look into load-balanced routing. I had a linux box with 3 NIC's, one NIC per ISP and one NIC to the rest of the house. I set it up for load-shared routing via the LARTC HOWTO, and for web traffic it worked ok.

I didn't stay with it because it wasn't stable for VPN connections. The decision about which upstream link to use was somehow governed by the local/remote host pairing, plus some unknown-to-me modifier. So I could establish a VPN connection, but it wouldn't keep the connection through 1 of the two links consistently. As soon as it tried to switch the VPN connection to route through the other uplink, pow, there went my VPN session. I don't recall the exact time before failure but it was less than 2 hours in most cases. made it basically unusable for me, at that time, for working from home. Perhaps that's solved(or can be configured around) by now.

I don't know/remember how it works for p2p either, though, since it was so long ago and the decision about which upstream path for any outbound traffic to take is controlled by the kernel on that routing box.

here's the relevant section of the LARTC HOWTO, in case you want to read more or try it out:
http://lartc.org/howto/lartc.rpdb.multiple-links.html#AEN298

Re:What router/firewall?

[Lumpy]

http://www.cisco.com/en/US/prod/collateral/routers/ps9923/ps9925/data_sheet_c78-501225.html

Home router with dual wan...

Won't be easy .. or simple.

[n5vb]

I see people trying this all the time, and there's one unavoidable bump in that road: connecting from two totally different public IP's in two totally different IP blocks that are native to two totally different DNS domains. DNS can be worked around to some extent by going to a common DNS server that's outside, and visible from, both domains, like Google or OpenDNS, but that runs into issues resolving in-network hostnames because a lot of ISP's provide different IP's for in-network vs out-of-network services, which can impact email and some streaming services to third party set-top devices pretty heavily. And the in-network services you're connecting to may not know how to handle you if you connect to an externally resolved IP from an in-network address block.

It's *possible* you could hack a home server/router combo to provide split DNS that will resolve properly to in-network services on both connections properly, but that configuration (and routing appropriately to separate WAN's on separate networks) is *very* non-trivial and will be squirrelly as hell if it's not tuned just right, and possibly just squirrelly as hell, period.

Honestly, I'd set up your local router/WAP for a network that's separate from your neighborhood wifi's SSID and just switch networks as needed..

Re:Won't be easy .. or simple.

[bsquizzato]

DNS doesn't have to be an issue, if the router can forward DNS requests. Most of the time in a simple home network the router serves as the name server for all the hosts inside the private network. It gets the real DNS IPs from the WAN, but all your hosts point to the inside router IP and it forwards DNS requests along.

It sounds like he wants to use the DSL as a *backup* for his Wifi, not run them both at the same time with complete split routing. But even still, you might be able to statically configure the router DNS and enter in both ISP's name servers. That way it'll do a lookup to both ISPs for a given hostname.

There are a few dual-WAN routers

[BenEnglishAtHome]

At home, I have both cable and DSL. I use a Vigor2930N from DrayTek.

Works like a charm.

There have been other mentions of a Cisco/Linksys product (the 104, I believe) but I went with the Draytek because I wanted integrated wireless, too.

Re:There are a few dual-WAN routers

[BenEnglishAtHome]

Correction - The Cisco/Linksys model that was mentioned by another poster was the RV042. I owned and had less-than-good experiences with the RV082.

Use a cable modem and DSL at the same time.

[John Sokol]

I did a blog post on this very topic last year.

http://johnsokol.blogspot.com/2010/11/increasing-internet-reliablity-dual-wan.html

Use a cable modem and DSL at the same time.
Xincom XC-DPG502
TP-Link TL-R480T+

I agree, wholeheartedly, from experience

[BenEnglishAtHome]

I had the Cisco/Linksys and experienced endless frustration. I wound up replacing it with a Draytek Vigor 2930N. The 2930 works great and provides integrated wireless, to boot. Love it.

More info.

Re:I agree, wholeheartedly, from experience

[BenEnglishAtHome]

Correction - I had the RV082. It was still a bad experience.

Re:Multi-WAN

[zugmeister]

I've used the Cisco/Linksys RV042 to good effect. You can tell it what speed your connections are and let it do a weighted round robin load balance type thing or just set one connection as failover if the primary goes down. Small, quiet and will run you about $150.

Re:Connect routers with a string of bitcoins

[msauve]

Only half the bitcoins are like that. The other half look like sticks.

If you like DIY try this approach or a similar one

[ghomem]

Here is something that may help you. Note that this will get you the public IPs directly to the WAN interfaces and requires bridged mode on the CPE: http://blog.angulosolido.pt/2008/03/intelligent-linux-gateway-multihoming_04.html There is also a (warning) very bad video about it: http://blog.angulosolido.pt/2008/03/intelligent-linux-gateway-bad-video.html

Comment removed

[account_deleted]

Comment removed based on user account deletion

DDWRT or Tomato-compatible router

[guruevi]

Those Linux-based routers do very well. I have an Asus RT-N16 and this should be able to route both WiFi and up to 5 Ethernet links (each port is separately addressable). There are also specific dual-wan routers but the hardware and software is identical, the configuration changes. There is an example on the DD-WRT wiki on how to set up iptables so any Linux distro would work just as well. If you run out of resources on those ARM devices (Linksys hardware is particularly underpowered for anything beyond 10Mbps) you can get a cheap VIA system with a couple of decent PCI wireless and wired cards.

Mikrotik Routerboard

[DeadboltX]

http://routerboard.com/RB750

Small, cheap, highly configurable.
It has 5 ports that you can configure as wans or link them together as lans. There is also a gigabit version available.

You can do everything on this as you would on a homebrewed freebsd solution, but with a nice gui or an optimized cli.

Link Balancer

[claytongulick]

I did a website for a client who sells and configure devices like this for schools and libraries under the federal e-rate program. I don't have personal experience with the device, but he says it works quite well. Here's a link (disclaimer: like I mentioned, I developed the web site for this, but I'm not affiliated with the product) http://e-rateforschools.com/services/e-rate-internet-availability-link-balancers/

-Clay

You won't get what you think....

[EriktheGreen]

If what you're looking for is A) Fail-over, so if one ISP or line is down you use the other or B) The ability to reach selected IP addresses via one ISP or the other, a dual WAN setup will work for you using one of the dual WAN setups people have mentioned. They're basically hacks that masquerade your desktop behind a public IP address from whichever provider you happen to be using at any moment. They don't allow asymmetric traffic (can't send packets out one ISP and receive via the other ISP) and they'll possibly screw up any security protocol or site that expects to see packets coming from a single IP and port address. This is handy, but only slightly more convenient than moving the cable yourself and re-issuing a DHCP request. Forget about aggregating bandwidth, you won't get that.

If you're thinking that hooking up both ISPs to a router will let you use whichever one is faster for any site when you click on it, you can't do that without a ton of work (and for the most part without being an ISP). The problem is that although a routing protocol exists on the global internet that would let your router figure out which path is best to each network prefix, to use it you have to have your own routing block (an aggregate of multiple network addresses) to announce to the world (which you can't get) and you have to have a router capable of holding and processing the global BGP table in real time... you don't have this.

If only all our home routers could speak a multi path routing protocol with low overhead, every single packet we sent would take the best path to its destination, all our computers would automatically fail over to other connections, we could add bandwidth by plugging in another wire, we could add and remove bandwidth in real time as needed, and we could migrate between internet providers without re-numbering our IP addresses. Things like mobile apps would be much easier to write.. no need to use a central server to pass data to a mobile, just send the packets to its IP and the routing protocol would send them on to wherever it's connected in the net.

I look forward to the day when the Internets evolve to permit multiple pathing for data in real time. Too bad technological development of Internet protocols seems to have slowed and become heavily political.

Erik

Re:You won't get what you think....

[zbobet2012]

Way to be... wrong. While he won't be able to do "intelligent" routing since almost no ISP advertises the routing information that deep into the network.

Set up a linux box with dual NIC's and iptables and load something like this:

http://tetro.net/misc/multilink.html

Or This:

http://blog.khax.net/2009/12/01/multi-gateway-balancing-with-iptables/

Or This:

http://lartc.org/howto/lartc.rpdb.multiple-links.html/p Yeah...

Re:You won't get what you think....

[EriktheGreen]

From my original post: "B) The ability to reach selected IP addresses via one ISP or the other"

That's all those are. All you can do is configure them statically, using tables. So as I said, you won't automatically get the best path to any given site, which is what you would have with BGP or a similar routing protocol that would work on home sized connections.

Don't get me wrong, mapping traffic to interfaces statically is handy, but it's a hack compared to a real multi-homing system.

Erik

PS: Slashdot, for the love of God step into the last decade and install a post editor with formatting. Manual HTML sucks.

Re:What router/firewall?

[WidgetGuy]

Online prices for that Cisco router (RV042 Dual WAN VPN) are from $150 - 160USD + shipping (and, in some cases, sales tax). Slightly more than my $40 home (single WAN/ 4 port) Wifi router. Probably best categorized as a SMB budget router.

Comment removed

[account_deleted]

Comment removed based on user account deletion

Comment removed

[account_deleted]

Comment removed based on user account deletion

Re:Router with 2 WAN ports

[Em Adespoton]

What I used to use for this was an ancient PC running OpenBSD off of a 1GB HDD and 256 MB RAM -- the trick was it had 5 NICs installed. Not as energy efficient as a firmware based router, but pretty easy to setup and maintain. Load balancing's not too difficult, but isn't all that advanced either. It's "good enough" for most purposes, and you can always install your own daemons to suit custom balancing requirements if you have the time+skill+requirement.

The extra 2 NICs were for my DMZ and a honeynet.

Re:Excuse my extreme ignorance

[Em Adespoton]

By why is this an 'Ask Slashdot'. This seems like a very straight-forward question that doesn't require opinion to answer. I am not even sure if there are multiple answers. This is one that truly can be answered with a simple Google search. Am I missing something?

The only thing missing is that on Slashdot, you'll not only get people providing google search results, but also feedback from people who have used the various solutions, including feedback on what really works, what's easy/hard to get configured well, etc.

As you can see from the responses around yours, there are MANY answers beyond "ask google".

Then again, your comment is generic enough that it could go in ANY Ask Slashdot thread.

Of course, I googled your comment to verify you're at least not form trolling.

Syswan Octolinks

[NewWorldDan]

I've been using a Syswan Octolinks for years with no problems, because at one point I had 3 connections to manage.

I also have a Barracuda Link Balancer that I'm rather underwhelmed with. The DHCP server on the unit seems to crash every few months, and Barracuda support was no help, so the solution was simply to use something else to provide DHCP services.

Mushroom Networks

[haulbag]

I once saw a presentation about the products from Mushroom Networks. As I recall, they basically are running a small Linux box and are aggregating bandwidth at the link level of the OSI model. Based on the product, you can plug in multiple (5 to 6) Ethernet connections or even USB connections to wireless cellular data cards. This is probably more of a small to mid-sized office product.

I'm not sure on the pricing. Here's a blurb from their site on one of their products:

"The Porcini BBNA (Broadband Bonding Network Appliance), is a one-sided Internet bonding appliance that provides aggregated Internet connectivity to home offices who wish to aggregate multiple Internet access lines for increased performance and reliability in a cost-effective way. With the Porcini BBNA, multiple DSL, cable modem or T1 services can be combined to provide higher speed and more reliable Internet access.

"The Porcini BBNA combines multiple Internet access lines, each on a 10/100baseT Ethernet interface, into a single aggregated Internet access line for HTTP downlink traffic, again on a 10/100baseT Ethernet interface. The aggregation over the Internet access lines is done even for a single download session, providing the full aggregate speed. Additionally, session based intelligent load-balancing is provided for both non-http downlink and uplink traffic as well as inbound load-balancing. The Porcini BBNA4422 supports aggregation of up to 4 Internet access lines plus one USB based cellular data card as the 5th WAN. Each Internet access line may be through a DSL modem, cable modem, T1, satellite modem, fractional DS3, DS3, fiber, cellular or any other broadband connection. For uplink bonding capabilities, please see our TRUFFLE product line."

Re:What router/firewall?

[Amouth]

i didn't think cisco made anything that cheaply priced - hell copper gbic's cost more than 260$

Re:What router/firewall?

[TooMuchToDo]

Get a CradlePoint router. I manage 20+ of them remotely, and they'll load balance/failover to any number of connections based on how many ethernet ports the device has. We're using the MBR1400, which has 5 USB ports for multiple cellular/wimax adapters, but also has 5 ethernet ports, which can be configured in any number of lan/wan interfaces. It also does ping tests across the devices you're using so you really know when the connection is down (instead of relying on local link status). Failover, load balancing of WAN links, all for $320.

http://www.cradlepoint.com/products/mbr1400-mission-critical-broadband-router

Disclaimer: Just a very satisfied customer, no other relation.

Re:Router with 2 WAN ports

[arbulus]

Seconded. A SonicWall TZ-100 (and higher models as well) can be configured for dual WAN setups.

Re:Curiosity

[micheas]

If you are using voip you might find that a second internet connection might be nice./

For a lot of things it is much easier to deal with your ISP (especially trouble tickets) if you have internet access.

If you have comcast/xfinity or some other ISP that disconnects users for TOS violations without enough warning to get another service, a hot spare might be useful.

I am sure there are other reasons.

It's far better than you expect

[swb]

It's probably cost prohibitive for some SOHO setup, but I think some of the mid-tier firewall and link balancer products will support sticky connections and/or policy routing specific IPs and URLs.

I've installed a half-dozen or so Ecessa PowerLinks and have not had any problems with users being unable to get to or work with specific sites, even though it works as you generally suggest (although they use a dummy LAN between the PowerLink and your internal firewall).

The same is true for Watchguard Firebox firewalls with the Fireware Pro software level and multi-wan.

IMHO, the bigger issue is failover that doesn't leave something to be desired. Most products I've worked with tend to want to use ping or, slightly better, TCP connects to static IPs on a per-interface basis to test to see if there's a network there. It's all well and good, but false positives/negatives are tough to avoid.

A big chunk of the problem is that you want to test something on the internet and not served, co-hosted or part of your ISPs network -- you want to make sure you can get past the ISP.

Ping is nearly useless across the public internet as a rule, unless you have a host you can ping and expect a packet back. TCP connect is a lot smarter, but the whole static IP thing is a huge problem unless you frequently check and validate IPs regularly or are using known statics. It'd be far more helpful to use DNS names that were cached and refreshed periodically, but I haven't seen any devices designed for this.

Re:easy as...rocket science.

[Barret7SC]

Cradlepoint is going to allow you to have multiple WAN ports on devices with multiple ethernet ports on their newer products in a future firmware update. I'd recommend the MBR95. That should allow the OP to do what he wants to do.

Check Out this Internet Connection Mgmt Product

[Anonymous Coward]

Check out this product called OASIS.

http://onlight.com/oasis.php

It is described as follows:

"Our engineers have perfected a line of devices that intelligently manage two or more Internet connections to keep businesses connected. We call these devices OASIS."

Sweet

arno iptables

[Sxooter]

I setup a dual homed network system in about 5 minutes with arno iptables in ubuntu. Super simple and very reliable and easy to setup.

Re:What router/firewall?

[Tacvek]

On the other hand, the average Linksys box actually uses a switch that supports multiple VLANs. The Wan port is actually on the same switch as the 4 LAN ports, but just on a separate VLAN. 6th port (to the router proper) is the only one configured by default to be in multiple VLANs and to see tagged frames.

As you might be able to guess, it is relatively straightforward to merge all ports onto a single VLAN, or to sacrifice one of the LAN ports to create a second WAN port. Obviously the default firmware for the routers don't supply this option, but custom firmware can do this.

Re:What router/firewall?

[LodCrappo]

wish i had mod points, this is the correct answer to the question.

OS X: Sustworks IPNRX

[cmholm]

Sustworks IPNRX (IP Network Router X) will also do this on a Mac, even over multiple USB NICs on a Mini: http://www.sustworks.com/site/prod_ipnrx_help/html/AlternateRouteHelp.html

Re:easy as...rocket science.

[Nethead]

Have you seen the price on an ASN these days? It would almost pay for a T1.

Or save yourself some money if you know networking

[syousef]

Buy a router and put DDWRT on it (lots of advantages, certain routers well supported) then use one of the LAN ports as your WAN port
http://www.dd-wrt.com/wiki/index.php/Dual_WAN
http://webcache.googleusercontent.com/search?q=cache:gIv7HeSGSCcJ:www.sbhacker.net/forum/index.php/topic/5903-dual-wan-guide-for-dd-wrt-routers/+tomato+dual+lan&cd=7&hl=en&ct=clnk&client=firefox-a&source=www.google.com

1 computer, 2 nic's

[holophrastic]

Many decent motherboards these days have dual network chips. But you can take any old computer and shove three network cards into it. I presume your favourite operating system can share it's internet access.

So that's what I'd do -- in part because I'm not a networking kind of guy, and in part because I know it'll work. One computer, in the basement, with both ISPs going into the computer, running windows -- vista or 7. One network cable out of that computer to my home router. That's it.

It's also really easy to debug. That computer either has internet access or it doesn't; and you've got all of windows to help you ensure that it always does. Everything else can just feed off of it.

And if you're anything like me, you undoubtedly have an old computer lying around, and at least five old network cards. So you can prototype it in an hour. Then just get some good quality network cards.

Dual wan Router

[Syirrus]

I recently a dual wan router (Cisco RV042 Dual WAN VPN Router) to connect two DSL lines and it works great. I purchased mine at Microcenter.

Re:What router/firewall?

[Kompressor]

That's likely because the RV series came out of their Linksys purchase - I've deployed Linksys RV042 routers in the past; they were reasonably priced and didn't give me any maintenance issues.

They were rather lackluster from a configuration and firmware perspective - they were capable of basic VPNs and had 2 WAN ports, but that's about all for features over a home class router.

Re:Dual wan Router

[masonc]

I use a three interface linux box with Shorewall http://www.shorewall.net/MultiISP.html
as the firewall software. Shorewall allows you to do Multi-ISP routing but does not do dynamic routing so you have to restart the software to change the routing. Dynamic routing based on link quality of very hard to do properly.

Re:easy as...rocket science.

[Kompressor]

A guy can dream, right?

Re:What router/firewall?

[JayAEU]

I've been using and deploying these Linksys/Cisco RV0xx models for quite a few years now. Good feature set, great reliability, no problems. I hope they never stop making them!

Re:What router/firewall?

[Amouth]

when you say "firmware" you are leading me to believe they are not IOS supported devices.. and if that is so then they are from the linksys side and not what i consider actual "cisco" hardware.

while i like/liked linksys and i like cisco - and i'm fine with the buyout.. some of their decisions have muddied the waters and made it a little more difficult to find the right solution.

multiple wan solution for linux

[six]

Mpath-tools is a set of programs for linux 2.6+ that aim to facilitate load balancing and failover over multiple and heterogeneous ISP connections.

Elegant solutions

[Khyber]

Simple, build a routing computer, use it to switch when wireless connectivity isn't meeting your demands.

Anyone else suggesting anything else is just shilling for some company or another.

Frontier?

[calidoscope]

Sounds like you are in what used to be Northern Ohio Telephone Co territory. NOTC was bought by GTE in 1968, the phone portion of GTE merged with Bell Atlantic to form Verizon in 1999, then Verizon spinning off a bunch of their business the last few years.

Re:Frontier?

[wolrahnaes]

I think you're on the nose. I knew the area as "GTE North" and yea, they sold it off to Frontier a few years ago after teasing us with a test-market of FiOS in a few small towns. I'm glad to have moved to a larger town where the LEC is still Frontier, but the cable options aren't shit (50/5 truly unlimited with no complaints from the ISP when I use 2TB in a month for $129) so their offerings are pretty much irrelevant. The cable company has a nice cheap tier, so no one gets DSL unless they don't know any better.

Don't ignore the benefit of redundant set-ups

[cachorro]

A while back our house had both dsl and cable, one dedicated to my wife's business, and one for my convenience. Both were run into dedicated old boxes running openbsd firewalls. Each box used the same intranet prefix (192.168.5.x), but one box was two and the other ten on our intranet. Under normal circumstances my network and my wife's were not wired together. Benefits were:

.
1) My major uploads/downloads would not slow down her business and vice versa.

2) My investigation of NSFW websites would never be traced back to her business (although I know there a better ways around that).

3) If her network was down, I could run a cat-5 to her switch from mine and change her gateway machine setting temporarily and she was back up, and vice-versa.

4) If (slim chance) either of the firewall machines were to be hacked, presumably the other would remain un-hacked, and available.

Anyway, it worked for us.

Re:What router/firewall?

[Kompressor]

when you say "firmware" you are leading me to believe they are not IOS supported devices.. and if that is so then they are from the linksys side and not what i consider actual "cisco" hardware.

Yes, they're definitely of Linksys origin - pre-Cisco buyout by quite some time. They're significantly more reliable than the standard Linksys home router, but I suspect the fact that I always made sure to supply them with a nice clean 60 Hz sine wave at 120V had a lot to do with it.

while i like/liked linksys and i like cisco - and i'm fine with the buyout.. some of their decisions have muddied the waters and made it a little more difficult to find the right solution.

I agree - Cisco putting their name on Linksys hardware in the consumer sector is easy to see past, but knowing whether you're looking at something that descended from Linksys or IOS heritage is difficult at the bottom end of the business line.

I generally don't deploy these for my clients any more, as I'm working with businesses that are willing to invest a bit in more feature-full hardware than I was before. I've had good luck recently with Fortigate, and their focus on security is, IMHO, worth the slight premium for the hardware and the yearly support contracts.

Moster beats by Dr.Dre solo hd

[shenzhen12345]

Hi ,this is shenzhenelectronic. Our website is http:/// www.shenzhenwholesale.com we have some electronics ,for example Microsoft Xbox360 Live card 10000 US PointsMoster beats by Dr.Dre solo hdMoster beats Dr.Dre pro and so on. Welcome to visit our website Moster beats by Dr.Dre solo hd http://www.shenzhenwholesale.com/monster-beats-by-dr-dre-solo-hd-headphones-black-red-white-hot-sell_p53915.html Moster beats Dr.Dre pro http://www.shenzhenwholesale.com/brand-new-monster-beats-by-dre-pro-headphones-in-white-black-5pcslot-hot-selling_p53932.html

Simples

[persevero]

Look at Sharedband: http://www.sharedband.com/.

OSM

[drago]

Time to put that nice collection of data into Openstreetmap. Volunteers?

may be ...ASG?

[vikarti]

may be cheap atom box + ASG(Astaro Security Gateway,www.astaro.com(forums at astaro.org)) with free Home Edition license Potential Issues: - it probable will use more power than regular router after all - max 50 IPs behind it(but it's for home after all) - if want to you use ASG's extended funcionality(web filtering, advanced IPS(snort-based),etc) you will need to choose CPU carefully - you will have root password from ASG(it's really very specilized Linux) but it is assumed that you will use web-based control tools I use old athlon machine with 1.5 Gb RAM and some old hdd(and 3 network cards) as my ASG router

Re:Or save yourself some money if you know network

[qpqp]

Do yourself a favor and choose openWRT instead, which is truly open source. www.openwrt.org

Re:What router/firewall?

[jc42]

wish i had mod points, this is the correct answer to the question.

Nah; probably not. First, the question wasn't "How do I use my dual WAN router?" The question was "I have two (independent) WAN connections; how do I best use them?"

And "Get a dual-WAN router" isn't a very good answer, especially when the person said explicitly that part of their motivation for the second collection was as a backup to the first. This implies that they want two independent routers, so if one dies, they can still use the other while the dead one gets fixed or replaced. If you have just one dual-WAN router, and it dies, both of your WAN connections are now useless, shooting down your intention to have a backup route.

There are good uses for a dual-WAN router. Answering this person's question isn't one of them, since it simply moves the single-point-of-failure problem from the ISP to the router. If you're trying to avoid single points of failure, you probably don't want to do it by introducing a new one. ;-)

(Actually, I do have mod points. But I decided it was better to reply here. I can probably find another discussion to do some mods in. Lessee ... There's the one about ad networks not honoring do-not-track. Sure wish there was a "Well, duh!" moderations. ;-)

Re:What router/firewall?

[LodCrappo]

I think you are being intentionally thick when you suggest he is worried about the router as a single point of failure. He obviously is trying to failover the internet connections, not the router. This is a home network. He doesn't need five 9s, he needs 1 or 2, which a cheap dual wan router provides with great ease. A few minutes setup time and he is no longer down if one internet connection fails. Done. No need to make it more complicated than that.

Re:Get a dual-wan router

[gpuk]

I second Draytek - they are awesome

Re:What router/firewall?

[shenzhen12345]

Hi ,this is shenzhenelectronic. Our website is http:/// www.shenzhenwholesale.com we have some electronics ,for example Microsoft Xbox360 Live card 10000 US PointsMoster beats by Dr.Dre solo hdMoster beats Dr.Dre pro and so on. Welcome to visit our website Moster beats by Dr.Dre solo hd http://www.shenzhenwholesale.com/monster-beats-by-dr-dre-solo-hd-headphones-black-red-white-hot-sell_p53915.html Moster beats Dr.Dre pro http://www.shenzhenwholesale.com/brand-new-monster-beats-by-dre-pro-headphones-in-white-black-5pcslot-hot-selling_p53932.html