Multipathrouting

Set up multipath routing on the UTM

Last adaptation to the version: 12.7.0

New:

Auswahl der Default-Route, wenn DNS Server vom Provider genutzt wird.

notempty

This article refers to a Resellerpreview

12.6 08.2023 11.7

Preliminary note

General

This HowTo explains what multipath routing is and how it can be set up on a Securepoint UTM. It also describes how traffic from specific services/end devices can be routed over a specific line.

What is multipath routing?

The combination of several Internet lines into one logical "Internet" is called multipath routing. Here, two or more default routes exist on the firewall and the packets are distributed accordingly. In addition to multipath routing, the Securepoint UTM also handles the distribution of data traffic (load balancing). In load balancing, a desired weighting can be entered for the individual routes. The Securepoint UTM can thus, for example, load two or more lines with a respective bandwidth of e.g. 16 MBit/s and 100 MBit/s equally.

Set-up

This manual explains two typical set-up options. One is multipath routing with two directly connected DSL lines (Scenario I) and the other is with one DSL line and one router connection (Scenario 2).

Example scenario 1

UTM Mutlipathrouting Beispielszenario1.png

Visualisierung Beispielszenario 1

Two DSL lines are connected to the Securepoint UTM (wan0 and wan1). Line 1 (wan0) has a bandwidth of 500 MBit/s and line 2 (wan1) has a bandwidth of 250 MBit/s.

Zones

Scenario 1, Step 1 - Zones

The PPP interfaces are configured so that both have unique zones. In this example, we create the zones "external-2" and "firewall-external-2" and assign them to the interface wan1. The wan0 has the zones "external" and "firewall-external". The zones are necessary so that corresponding network objects and rules can be created later.

UTM v12.6 Mutlipathrouting Szenario1 Schritt 1-en.png

Scenario 1, network interfaces

Routes

Scenario 1, Step 2 - Routes

A default route is required for each line so that data traffic can be sent over both lines. This can be created under Network Network configuration Area Routing. Since the lines have different bandwidths (500 MBit/s and 250 MBit/s respectively), an even load on the lines can be achieved using the Weighting option.

notempty

New as of v12.7

Wenn die Funktion "DNS Server vom Provider"

unter Area Allgemein

aktiviert ist, kann dieser per CLI mit folgendem Befehl gesetzt werden: extc runtimevar set { variable PROVIDER_DNS value "192.168.5.2" }.

Eine Abfrage des Wertes geschieht wie folgt:

extc runtimevar get { variable PROVIDER_DNS }
variable    |value
------------+-----
PROVIDER_DNS|192.168.5.1

UTM v12.6 Mutlipathrouting Szenario1 Schritt 2-en.png

Scenario 1, Routing

Create network objects

Scenario 1, Step 3 - Create network objects

Rules are created in Securepoint UTM using network objects under Firewall Network objects Button Add object. Since there is no network object for a second line by default, it must now be created. On the one hand we need the network object for the network (Internet-2) and on the other hand the network object for the interface of the firewall in this zone (external-interface-2).
The network objects should look like the following:

Name:

Internet-2

Choose a name

UTM v12.6 Mutlipathrouting Szenario1 Schritt 3 Internet-en.png

Internet-2-Object

Type:

Select types in the drop-down menu

Address:

0.0.0.0/0

Network IP for the entire internet

Zone:

Select created zone

Groups:

Name:

external-interface-2

Choose a name

UTM v12.6 Mutlipathrouting Szenario1 Schritt 3 Interface-en.png

external-interface-2-Object

Type:

Select types in the drop-down menu

Address:

Select Wan1 as interface

Zone:

Select created zone

Groups:

Create rules

Scenario 1, Step 4 - Create rules

Now the rules are created. In this example, "default-internet" must be released to the Internet.

Here it must be ensured that the Internet object matches the selected HideNAT object as a rule!
The rules will then look like this:

UTM v12.6 Mutlipathrouting Szenario1 Schritt 4-en.png

Rules in the packet filter

#	Source	Destination	Service	NAT	Action	Active
	internal-network	internet	default-internet	HN	Accept	On
	internal-network	internet-2	default-internet	HN	Accept	On

Example scenario 2

UTM Mutlipathrouting Beispielszenario2-en.png

Visualisierung Beispielszenario 2

A modem is connected to LAN0 of the firewall, with the Securepoint UTM taking over dialing in. A Fritzbox, which acts as a router, is connected to LAN2. Line 1 (wan0) has a bandwidth of 500 MBit/s and line 2 (LAN2) has a bandwidth of 250 MBit/s.

Zones

Scenario 2, Step 1 - Zones

The external interfaces (wan0 and LAN2) are configured so that both have unique zones. In this example, the zones "external-2" and "firewall-external-2" are also created and assigned to LAN2. The wan0 has the zones "external" and "firewall-external". The zones are necessary so that corresponding network objects and rules can be created later.

Routes

Scenario 2, Step 2 - Routes

In order for the data traffic to be send over both lines, a default route is required for each line. In this scenario, however, there is a special feature due to the router in front of the LAN2:
For routes to specify LAN2 as the gateway interface, it is necessary to tell the firewall the gateway for this interface. This works via the Route-Hint IPv4 option in the eth2 settings. The gateway 192.168.178.1 is specified here. Now the LAN2 can be specified as the default gateway.

MTU:

1500

Default

UTM v12.6 Mutlipathrouting Szenario2 Schritt 2 Schnittstelle-en.png

Route-Hint-Settings LAN2

Autonegotion:

On

Must be activated

Route Hint IPv4:

192.168.178.1/---

Specify the IPv4 address here

Route Hint IPv6:

/---

If available, enter the IPv6 address here

Now the two default routes must be created. Since the lines have different bandwidths (500 MBit/s and 250 MBit/s respectively), the Weighting option can be used to achieve an even load on the lines.

notempty

New as of v12.7

Wenn die Funktion "DNS Server vom Provider"

unter Area Allgemein

aktiviert ist, kann dieser per CLI mit folgendem Befehl gesetzt werden: extc runtimevar set { variable PROVIDER_DNS value "192.168.5.2" }.

Eine Abfrage des Wertes geschieht wie folgt:

extc runtimevar get { variable PROVIDER_DNS }
variable    |value
------------+-----
PROVIDER_DNS|192.168.5.1

UTM v12.6 Mutlipathrouting Szenario2 Schritt 2 Routing-en.png

Created default routes

Create network objects

Scenario 2, Step 3 - Create network objects

Rules are created in Securepoint UTM using network objects under Button Add object. Since there is no network object for a second line by default, it must now be created. On the one hand we need the network object for the network (Internet-2) and on the other hand the network object for the interface of the firewall in this zone (external-interface-2).

The network objects should look like the following:

Name:

Internet-2

Choose a name

Internet-2-Object

Type:

Select types in the drop-down menu

Address:

0.0.0.0/0

Network IP for the entire internet

Zone:

Select created zone

Groups:

Name:

external-interface-2

Choose a name

external-interface-2-Object

Type:

Select types in the drop-down menu

Interface:

Select Wan1 as interface

Zone:

Select created zone

Groups:

Create rule

Scenario 2, Step 4 - Create rules

Now the rules are created. In this example, "default-internet" must be released to the Internet.

Here it must be ensured that the Internet object matches the selected HideNAT object as a rule!
The rules will then look like this:

Rules in the packet filter

#	Source	Destination	Service	NAT	Action	Active
	internal-network	internet	default-internet	HN	Accept	On
	internal-network	internet-2	default-internet	HN	Accept	On

Routing for specific end devices and services

Since data traffic always "jumps" from line to line in multipath routing, this can lead to errors in certain scenarios. For example, an external server must always be addressed via the same source IP. To implement this, the "rule routing" function is used. As an example, the SBS with the IP 203.0.113.203 should always be sent via the line wan0.

Network object for the server

Step 1 - Network object for the server

First, a network object is created for the server so that it can be specified later in the rule.
In this example, the network object looks like this:

Name:

Server

Choose a name

UTM v12.6 Mutlipathrouting Routing Schritt 1-en.png

SBS-Netzwerk object

Type:

Select the type host

Address:

203.0.113.203/---

Specify IP address

Zone:

Select "internal" as zone

Gruppen:

Create rule

Step 2 - Create rule

Now a rule can be defined with the network object. In the rule, the rule routing must then be specified and set to wan0 so that the server always communicates to the outside via this interface. notempty

It is imperative that the destination network object (Internet) matches the HideNAT object (external-interface) and the rule routing interface (wan0)! Otherwise the rule routing will not work.

Active:

On

The rule must be active

UTM v12.6 Mutlipathrouting Routing Schritt 2-en.png

Rule-Routing-Rules

Source:

Server

Select server

Destination:

Internet

Specify the "Internet" as the destination

Service:

default-internet

choose "default-internet"

Action:

Choose "Accept"

Groups:

Choose "Rule-Routing"

NAT

Type:

Must select

Network object (Node):

external-interface

Choose "external-interface"

Service:

Extras

Rule Routing:

wan0

Specify interface

QOS:

Time profile:

Click here to add a rule

Rule positioning

Step 3 - Rule positioning

Since the ruleset in the Securepoint UTM is processed from top to bottom, it is essential that the rule routing rule comes before the "global" rule. To be on the safe side, it is best to create a new rule group that is positioned at the top of the port filter. All rule routing rules are then created in this rule group and thus take effect first.

#	Source	Destination	Service	NAT	Action	Active
	Server	internet	default-internet	HN	Accept	On
	internal-network	internet	default-internet	HN	Accept	On
	internal-network	internet-2	default-internet	HN	Accept	On

Rule routing can of course also "route" individual services, such as HTTP, over a specific line. The rule must then be adapted accordingly.