3 ms·
Good move on having not just two WANs, but two technologies. I've seen setups before where people have had two wans, from two different ISPs, but both cables ra
by isostatic 8y ago
Good move on having not just two WANs, but two technologies. I've seen setups before where people have had two wans, from two different ISPs, but both cables ran down the same duct in the road. Single digger took them both out. It would be a pretty severe problem if fibre and wireless goes at the same time!
I assume you're not running a full BGP handoff to each ISP, so any existing sessions will die should your WAN die (as your lan get natted behind a different IP address). Presumably your nat state will move over in the case of router failure as it's a floating VM of some sort, so what's the failover time for each component? How does it compare to using say VRRP?
How are you detecting ISP failures -- are you pinging beyond the next hop, or are you assuming if you can ping/arp the upstream router, it's working? I've had failure scenarios with ISPs where the next hop works, but nothing past that.
What benefits are there of tcpproxy over something like nginx (for http/s) or dst-nat (for other connections)?
It looks like all your traffic defaults to WAN1, and only uses WAN2 in certain cases. Do you have the ability to send traffic for a given client to WAN2 by default?
What type of queuing are you using -- can 1 client hog all the bandwidth?
And finally, what keyboard layout is 6 above N?
- mbrameld 8y agoLook at a QWERTY keyboard. Start with your finger on the N key. Move it up to the key above, H. Move it up again to the Y key. Now once more, move it up to the 6. "Above" here is kind of incorrect, it's actually "beyond". Colloquially we say the keys are above and below each other.
- jlgaddis 8y agoI just assumed he was referring to a (USA-specific?) telephone keypad (where "N" corresponds to "6").
- halbritt 8y agoIIRC, the Unifi stuff as well as Meraki will do multiple ISPs. They do outbound NAT, and have a liveness check which is just a ping sent to the next hop. Ping fails, or the interface goes down and the device simply sends the traffic the other direction. Any established TCP sessions simply fail, but any new traffic will failover just fine. I'm using this setup in my office. Easier than finding a last-mile type ISP that supports BGP.
- isostatic 8y agoIf you use the same ISP you can probably get a routing working. But you're not going to get your own AS for a home network, even if you find an appropate ISP to provide you transit. Next hop checking isn't always good enough. I had a 7 minute outage on one line last week, next hop was fine, but outside the ISP network it all fell apart.
- jlgaddis 8y ago> But you're not going to get your own AS for a home network, even if you find an appropate ISP to provide you transit. ARIN, at least, will happily assign you an ASN assuming you 1) meet the multi-homing requirements and 2) pay the bill for it.
- isostatic 8y agoPresumably the requirement includes having a couple of ISPs advertising your IP space, which I assume means having a /24. Can you still get those easily from ARIN?
- namibj 8y agoThe European version of ARIN allows IPv6-only networks. /24 cost you about 3-6k$ each, depending on if you can spare a month to get a good price or need it announced tomorrow morning for your AS.
- halbritt 8y agoThen set the liveness check for something further upstream of the ISP. Getting an AS is easy. Getting portable IPv4 address space or an LOA to readvertise is more tricky.
- lmm 8y agoHere in the UK I found you couldn't get an AS number without a VAT number (i.e. being a company). (Of course, you can start your own company for something like 13 quid/year. Now that I have one maybe I should revisit that.)