OpenVPN Load Balancing

From ImageStream Router Documentation

Jump to: navigation, search

Contents

Introduction

In this example, multiple OpenVPN tunnels are load balanced across ADSL links using equal-cost multipath routing and OSPF.

Requirements

This configuration requires ImageStream Linux 4.4.0-96 or later, multiple ADSL links with statically or dynamically assigned IP addresses and a block of publicly routable IP addresses for the tunnel endpoints.

Head end configuration

This ImageStream router is the aggregator. A block of publicly routable IP addresses will be assigned to the Loopback0 interface for use as static tunnel endpoints. These addresses allow the remote router a way to guarante tunnel traffic will be transmitted on the proper ADSL connection. One IP address is needed per tunnel. We also disable encryption and compression to minimize overhead. The head end will be originating a default route in OSPF. Since the tunnels all have the same cost OSPF will use ECM (equal-cost multipath) and create a per-flow load balanced route on the remote. Any routes that the remote router announces will also have an ECM route added from the head end.
interface Loopback0
 ip address 205.159.243.130 255.255.255.255
 ip address 205.159.243.131 255.255.255.255
!
interface Ethernet0
 ip address 205.159.243.1 255.255.255.0
!
interface Tunnel0
 description DSL1 from Remote1
 bandwidth 2512000
 tunnel mode openvpn
 tunnel options --passtos --cipher none
 no tunnel compression
 tunnel source 205.159.243.130 4450
 tunnel destination 0.0.0.0 4450
 tunnel key df0590f214a2eaf9a638f43838132f67
 ip address 192.168.24.1 255.255.255.252
 pointopoint address 192.168.24.2
!
interface Tunnel1
 description DSL2 from Remote2
 bandwidth 2512000
 tunnel mode openvpn
 tunnel options --passtos --cipher none
 no tunnel compression
 tunnel source 205.159.243.131 4451
 tunnel destination 0.0.0.0 4451
 tunnel key df0590f214a2eaf9a638f43838132f67
 ip address 192.168.24.5 255.255.255.252
 pointopoint address 192.168.24.6
!

OSPF Configuration:

router ospf
 network 192.168.24.0/24 area 0.0.0.0
 default-information originate always
!

Remote configuration

This ImageStream router uses an Ethernet DHCP assigned interface as one ADSL link and a PPPoE interface as the second ADSL link. We bind each tunnel to its ADSL link using the public IP addresses we allocated on the head end router. Since we are receiving our default route via ospf we must not install a default route via DHCP or PPPoE. Also if we want to be able to communicate with other machines in the ADSL provider's DHCP network we must change the netmask on the DHCP interface to a /32 which forces the use of the default route. We also add blackhole routes with a high metric to prevent tunnels from using the default route to establish communications to the head end. We also must be careful and filter our OSPF announcements to avoid announcing our DHCP and PPPoE assigned IP addresses over the tunnels which will result in a very bad loop.
interface Ethernet0
 # Specify a /32 netmask to force all traffic out the tunnels
 ip address dhcp ignore-default netmask 255.255.255.255
!
interface Ethernet1
 ip address 172.16.0.1 255.255.255.0
!
interface ADSL0
 protocol pppoe
 adsl device Ethernet0
 ppp pap sent-username dsl-username password dsl-password
 ip address negotiated
!
interface Tunnel0
 description DSL Tunnel0
 bandwidth 2512000
 tunnel mode openvpn
 tunnel options --passtos --cipher none
 no tunnel compression
 tunnel destination 205.159.243.130 4450
 tunnel source 0.0.0.0 4450
 tunnel key df0590f214a2eaf9a638f43838132f67
 ip address 192.168.24.2 255.255.255.252
 pointopoint address 192.168.24.1
!
interface Tunnel1
 description DSL Tunnel1
 bandwidth 2512000
 tunnel mode openvpn
 tunnel options --passtos --cipher none
 no tunnel compression
 tunnel destination 205.159.243.131 4451
 tunnel source 0.0.0.0 4451
 tunnel key df0590f214a2eaf9a638f43838132f67
 ip address 192.168.24.6 255.255.255.252
 pointopoint address 192.168.24.5
!
# The next 4 routes ensure Tunnel0 traffic uses the ADSL0 connection
# and Tunnel1 uses the Ethernet0 connection
ip route add blackhole 205.159.243.130 metric 15
ip route add blackhole 205.159.243.131 metric 15
ip route 205.159.243.130 255.255.255.255 ADSL0
ip route 205.159.243.131 255.255.255.255 Ethernet0
!

OSPF configuration:

Be sure you don't redistribute the connected interface routes for your ADSL interfaces.
router ospf
 network 192.168.24.0/24 area 0.0.0.0
 redistribute connected
 distribute-list 10 out connected
!
access-list 10 permit 172.16.0.0 0.0.0.255
access-list 10 deny any
Personal tools
Router software releases