Vyatta 3-way WAN Load-Balancing (VC 6.2)

Few months back I was tasked to accomplish Load-balancing on WAN interfaces. The client had three interfaces two of which were PPPoE-DHCP and one was static ethernet.

On internal side were a DMZ and multiple VLANs on one interface.

The actual requirement was WAN link failover which we achieved using the Vyatta LoadBalancer.

Here is a network diagram:

[DMZ] <=======> \

\ /|- Link-3

FireWall <==> Vyatta LB <==>|--- Link-2

/ \|---- Link-1 Fast

[LAN] <========>/

So LAN internet is primarily going to Link-1, in-case of L1 failure goto Link-2, in-case of L2 failure move to Link-3

But the DMZ should only be accessible via Link-3.

Problem:

the problem which they faced is that they achieved Link-Failover/LB but when they request internet from DMZ their Public IP still shows PPPoE link-1. Also if anyone accesses DMZ server from Internet the Vyatta Load-Balancer (Incoming from Link-3) , Vyatta Load-Balances the return reply from DMZ-Server to Link-1 which fails the communication.

Solution:

Use "enable-source-based-routing" in wan load-balancer. i.e

# configure

# set load-balancing wan rule 5 enable-source-based-routing

# commit

This way any request Initiated from Internet cloud will be routed back from the same interface. Only the newer requests from inside will get balanced.

That saved my day and everything worked as expected.

Here is the snippet of the code for WAN-Failover:

load-balancing {

wan {

flush-connections

interface-health eth2 {

failure-count 2

nexthop 56.XX.176.XXX

success-count 1

test 10 {

resp-time 5

target 8.8.8.8

ttl-limit 1

type ping

}

}

interface-health pppoe1 {

failure-count 2

nexthop dhcp

success-count 1

test 10 {

resp-time 5

target 8.8.4.4

ttl-limit 1

type ping

}

}

interface-health pppoe2 {

failure-count 2

nexthop dhcp

success-count 1

test 10 {

resp-time 5

target 180.XX.98.XX

ttl-limit 1

type ping

}

}

rule 5 {

inbound-interface eth1

enable-source-based-routing

interface eth2 {

weight 1

}

protocol all

source {

address 172.23.1.80/28

}

}

rule 10 {

inbound-interface eth0

interface pppoe1 {

weight 50

}

interface pppoe2 {

weight 50

}

protocol all

source {

address !172.23.1.80/28

}

}

rule 20 {

inbound-interface eth+

interface eth1 {

weight 1

}

protocol all

}

}