Transcription
In this video, I'm going to show you how to set up the multi-WAN features in OpenSense so we can achieve failover and load balancing. Let's jump straight into the lab.
[Music]
[Music]
So, we're going to be continuing with our virtual lab building series, and we're going to be setting up OpenSense to utilize its multi-WAN features. So, for those of you that don't know what multi-WAN is, it's basically used for redundancy purposes. So, if we look at the diagram that I've set up here, we have in this scenario two ISPs, WAN one and WAN two, that it's connected to our OpenSense firewall. And then we have our usual LAN gateway connected to this virtual switch and then to our Kali test machine.
So, in this scenario, we're going to look at two ways that we can utilize multi-WAN. The first one is going to be for failover. So, when WAN one, for whatever reason, goes down, say the ISP has a fault, or there's general packet loss, or anything along those lines, then WAN two will essentially pick up the load. And then the second scenario, we're going to look at is load balancing, how we can share these two WAN interfaces to increase the amount of bandwidth that we can offer to our clients on our LAN.
I'll WAN one, for the sake of this lab, will be on the 10.0.2.0 network, and our WAN two interface will be on the 10.0.3.0 network. So, to simulate this in VirtualBox, if you've been following my lab already, you should have a working OpenSense firewall already set up with the basic configurations. For this lab, we're going to need to do some minor changes to the the interfaces. So, firstly, we need to go to Tools and to Preferences, and then to Network, and then inside Network, we need to set up two NAT networks: the one for the ISP1 and the second one for the ISP2. It's simple to do this. You just click on this "Add New Network," and it'll create them. I'll just show you the ones that I've created already.
For ISP1, as per the diagram I showed you earlier, it's connected to 10.0.2.0, and we want to support DHCP, then, so the system can automatically give our firewall an IP address on that interface. And we'll click OK. And then the same applies for the virtual ISP, or the simulated ISP, for the second interface that will be connected on 10.0.3.0. And once again, we want to allow DHCP on that particular network. We'll click OK.
Then, once you've done that, before we start up the firewall, you need to come across to the settings of the actual firewall, and you need to go to Network. And you'll see over here, you've got your various adapters: one, two, three, and four. So, in my case, adapter one, I've configured as one of those NAT networks, or one of those WAN interfaces. So, you'll select "NAT Network," and then you choose the name of the NAT network that we just set up. So, in this case, it'll be "ISPSim1."
Then, for adapter two, I've connected this to my LAN, or my internal network. I've showed you in previous videos how this works. And then for my adapter three, I've set that up also as a NAT network, and I've assigned it to the "ISPSim2" network. So, this will be our second WAN interface. Once you've done all that, you'll click OK, and you can start up your firewall.
So, once your firewall is started up, we're going to open up our browser, and we are going to log into the firewall. I'm just going to use the default passwords that are and usernames that are set up in the previous labs, and we're going to log into the firewall. So, the first steps here are going to be the interface assignments that we need to do. So, you'll come across to Interfaces and then to Assignments. And then this will look slightly different when you set it up the first time around. Your WAN two interface will have a different name. I'll put up a screenshot just to show you how that looks. But basically, you'll have a new interface, and you'll see it'll be for the "em2" interface. You will then click the little plus button on the extreme right-hand side, and then this will add the interface assignment for you. And then, once you've done that, you'll see it'll be called "OPT1" or "OPT1." What you'll do then is you'll just save this.
And then we'll go across to OPT1, and we will then rename OPT1 to WAN two. And from there, we will then enable the interface and block the private networks and the bogon networks. And we will configure it that we have it forward set up for DHCP for IPv4. And once you've done that, you'll click Save, and you will Apply the changes.
So, the next step is we're going to be having to set up what they call Gateway Monitoring. So, in order to do this, we're going to go to System, and then we're going to go to Gateways and to Single. Then, for each of the gateways that we set up, you'll see we'll have a WAN DHCP, which is our our first WAN interface, WAN one. And then we'll also have a WAN two interface setup. When you do this initially, you won't see any of these monitoring IPs. So, what we'll need to do is we need to set this up. So, you'll click on the little edit button, and inside, yeah, you'll make sure that you have selected the interface correctly, which would be WAN. It will be your IPv4 address family, and the IP address is dynamic.
And then the most important settings here is to make sure that you uncheck this "Disable Gateway Monitoring" checkbox. This basically will turn on the monitoring. If this checkbox is enabled, then the firewall will always consider this interface to be in an up state, which we don't want in this case, especially when we are using it for failover purposes. Then, this "Monitor IP Address" that you see over here, this 8.8.4.4, this is the IP address that the firewall is going to be periodically pinging to determine if the WAN connection is up or not. And then the final step for our main gateway on WAN one, we just want to make sure that our priority is set to 1. The lower the priority, the more preference the gateway is going to have. Once you've done that, you can click Save.
And then we're going to repeat the same steps for the second WAN interface. In this case, we're going to be once again unchecking the "Disable Gateway Monitoring" checkbox, and we're going to use a monitoring IP in this case of 8.8.8.8. It has to be different to the to the the first WAN interface that we set up. And then we're going to give this one a priority of 254, which is higher. So, this would then become a less preferred gateway for our scenario, and that would be our backup gateway, essentially. You'll click Save, and you'll move on from there.
So, once we've configured our gateway monitoring, we need to then set up what they call a Gateway Group. So, to do this, we need to then go to Gateways again, and then just below where we were, we need to select "Group." And then inside the the group, this is where we can set up set up our failover group. So, initially, it won't look like this. There will be nothing here. I already set this up, but let me show you how you do that. So, if we just go to edit, we're going to give it, we're going to give our group name, in this case, I just called mine "gw_group." And then we're going to set up our gateway priority for each one of our WAN interfaces. These tiers that you see here, Tier 1 and Tier 2, just allows the system to know which one of those gateways is going to be the main priority. So, in this case, my WAN_DHCP, which is my WAN one interface, I've given that a Tier 1 classification, which means it's my primary gateway. And then with WAN two, I've given it a Tier 2, which means it's my secondary or my backup.
The trigger level, you have various options to pick here. So, you could have it as a member down, or packet loss, or high latency, or packet loss, or high latency. In this case, I've just set mine up to be packet loss. So, as soon as packets are lost and they meet a certain threshold on my WAN one interface, then will automatically fail over to WAN two. And then just below that, we just give it a description. I call this my "failover group." Just a side note with this, if you were trying to set this firewall up as a load balancer, or to do load balancing across your two WAN interfaces, what you would do instead of having your tiers set up as one and then two for the failover, you would then give the tiers identical values here. So, if we wanted to load balance between WAN one and WAN two, we would simply just set up WAN two to be Tier 1 as well, and then it will equally load balance between those two connections.
So, once you've done this, you'll click Save, and we're ready to move to the next step.
So, for the failover to work correctly, we have to configure and make some changes to the DNS settings of our firewall. In order to do this, we're going to go through to our System again, and we're going to go to Settings and to General. And if you come down to this middle bit over here, where it mentions the DNS servers, we then would want to match up our DNS servers for each interface, like we set up prior. So, for WAN one, when you were using 8.8.4.4, we'd set that as a DNS server, and from this little drop-down box over here, we'll assign it to the WAN one interface. The same applies for WAN two, where we set up at 8.8.8.8, and that will apply for WAN two. And then, once you've done that, we're gonna scroll down right to the bottom.
And this is an important bit over here. You need to make sure that the "Gateway Switching" checkbox over here has been checked. So, this allows default gateway switching, and basically, this turns on the ability that if one of the gateways go down, our main gateway goes down, that it will automatically fail over to the second gateway, which is exactly what we're trying to achieve with the failover. Once you've done this, you'll click Save, and we'll move on to the next step.
The next step is we need to make some changes to the firewall rules for this to work correctly. So, we're going to be adding a firewall rule. So, we'll come down to Firewall and we're going to go to Rules and then to LAN. And then the rule, the first step that we need to to modify is this "Default LAN to Any" rule. So, we'll come through to the little edit button over here, and to the piece that we need to edit here is the Gateway. So, we'll come down to Gateway, and on the drop-down box, you'll select your gateway group that we created earlier, and you'll simply click Save on that one.
Then, what we need to do is we need to create a new rule. In this case, I've already created one, but I'll show you what we need to do. You'll click on your "Add Rule," and we need to set up a "Pass" rule for the interface LAN coming into it on IPv4. We need to make sure that the protocol is both TCP and UDP. And if we scroll down, the source needs to be "Any." And then this destination section, we need to select a "Single Host Network," and we need to allow this connection to our firewall's local LAN address, so 10.200.200.254, which is the case of this one. And we will set the subnet to 32, or to a slash 32. Then the destination port range needs to be from DNS to DNS. And we'll just give it a basic rule, a basic description. We'll call it "Local Root DNS."
And once you've set all that up, we'll click Save. And then you'll notice that when that rule is created, it will fall below these two IPv4 and IPv6 rules. You'll simply click on it, and in this case, you'll then use this little arrow button over here when you've selected it, which it will then move the rule before the one that you've just selected, like in this case, you can see I have it above all of my other rules. And then, once you've done that, you will click Apply, and it will apply those firewall rules for you.
So, we've now completed all the steps for failover to work correctly. However, there are a couple of advanced options which we can still look at if we need to tweak this. So, in order to access the advanced options, you're going to go through to System and then to Gateways and Single again. And then, let's just say we want to modify some of the advanced rules for our WAN one gateway. We'll simply click on edit. And if you come to the bottom here, there's a button that says "Advanced," and you can click on this. And then you'll see under this advanced menu, we've got some weighting options where we can, we can give our our particular gateway a certain weight. And then there's also things like latency thresholds, packet loss thresholds, probe intervals, etc. We can then fine-tune these variables here in order to make our failover perform potentially better or modified for our particular scenario.
So, one scenario that comes to mind is, let's just say you have a WAN connection, one that's running on say 10 Mbps, and the other one's double that, it's running on 20 Mbps. But in that scenario, we don't want to give each of those gateways equal amounts of weight. So, what we will do in this case is we can come through to our weighting option over here. And basically, this gives us one to five. On our 10-meg connection, we could give it a weight of one. And on our 20-meg connection, obviously having more bandwidth, we can give it a weight of two. And what this means is that there will be twice as much traffic that will go through the 20-meg connection as what they would on your 10-megabit per second internet connection. So, in this case, we can get better utilization out of our higher bandwidth connection.
So, to show you how this works, we're going to test the connections by using traceroute, then. So, I can show you when we disable or simulate one of the connections going down, how the firewall automatically will then route out of the backup WAN interface. So, if we look at the dashboard, we can see over here that our gateways are both active at the moment, and the monitoring setup, and they both are showing zero percent packet loss, and they're both online.
So, we're going to do is we're going to open up a terminal, and we're going to type in "traceroute" and then "-i" because we want to tell traceroute to use ICMP in this case to do the trace for us. And we're just going to be tracing through to the 4.2.2.2 DNS server. And we'll hit enter. And we'll provide, okay, with the password, and it'll complete its traceroute. And you'll see in this case, the first hop that it went through was through the firewall, which was 10.200.200.254. And then it exited through the 10.2.1 network, which is the gateway on the ISP's network on WAN number one. And then it continued its path through to its final destination.
So, to simulate the WAN one connection going down, you'll come back to VirtualBox, like you can see on the screen, and we're gonna go to Settings. And inside Settings, you're going to come through to Network and Advanced. And you're going to then on adapter one, which in my case is the WAN one interface, we're going to then unplug the cable. And we're gonna click OK. Now, the cable is unplugged. If we go back to our firewall dashboard again, you can see at the bottom over here, we now only have WAN two available. If you go into System and into Gateways into Single, you can see over here that WAN number one is offline, and there's a hundred percent packet loss. So, we've confirmed that that interface is down.
Then, we're going to come back to our terminal, and we're going to run the same command we did earlier for traceroute to the same IP address, and we're going to hit enter. And then, if we examine the traceroute results, we'll see once again that it left through our firewall, which is that 10.200 or 200.254. However, in this case, it's now traversed the 10.0.3.0 network, which is our WAN two's network, and it left through the 3.1 gateway, which was the gateway on the second WAN interface, second ISP, which we set up. And then it continued through to its path. So, through this test, we've successfully seen that the failover is in fact working correctly, and that the firewall has now failed over onto the second WAN interface as intended.
So, to wrap this video up, we've successfully configured the WAN failover on our OpenSense firewall by first of all assigning a second WAN interface, setting up gateway monitoring on both the interfaces, then, so the interfaces could be aware if they were functional or if they were offline. We created a gateway group combining those two interfaces into this failover group, and we've made some changes to the DNS settings and the general firewall rules in order to make this function correctly. We also looked at some advanced settings of how we can use load balancing and also demonstrated a traceroute to show that the failover mechanism is working as intended. If you guys enjoyed this video, please don't forget to subscribe and to give me a thumbs up. It would be greatly appreciated. And as always, if you have any comments or any questions, please do drop them in the comments box below. Thanks for watching, and I'll see you guys soon. Cheers for now.
[Music]