0

How can I accomplish VPN across Dual Wan connections in a optimal way?

plan_for_network_desing_v2

Idea is to make:

  • Site to site VPN.
  • Make single connection inside the VPN to use full bandwidth of both wan connections using (Split TCP, Multipath TCP, Bonding or technique x?).
  • Make it possible for a Road Warrior to have VPN connection to both sites and have traffic use the optimal speed/route.

Note

  • The order for "split/bonding" and VPN might not be in optimal/working order in the plan_for_network_desing picture.
  • The wan2 and Road-warriors connections are 4G so they are behind ISP-NAT. So they can "only do" outbound IPv4 connections. Public IPv6-address might be possible.
  • The DSL connections have public IPv4 addresses and take incoming connections.

I am interested to know how can I accomplish this?

  • What techniques you recommend and how should they be implemented?
Improve this question
2
  • Removed the off-topic recommendation request.
    – Ron Maupin ♦
    Commented Jul 24, 2019 at 12:51
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can post and accept your own answer.
    – Ron Maupin ♦
    Commented Dec 21, 2020 at 17:38

1 Answer 1

Reset to default
1

You can "load balance" between the DSL and 4G links between the sites simply by adjusting the routing metric so that both paths have equal cost. The routers will divide connections between the two paths. Note that a single connection will always use one link, so no single connection can use more than one link's bandwidth.

"Bonding" the links together sounds like a great idea on paper, but in practice it doesn't work very well. If you try to split a single connection between two links, you will get out of order packets, especially on two different networks, This will significantly lower your throughput. You'd be better off using only one link.

VPN software for remote users isn't sophisticated enough to make two VPN connections and then make routing decisions to use the best path. I'm unaware of any such product. You would probably have to create something custom, but I doubt it would be worth the effort.

Improve this answer
6
  • I have implement solutions in the past using Split TCP and VPN tunnel bonding in layer 2. I managed to get full throughput on two wan links for a single TCP-session. Now we also have Multipath TCP (MPTCP), but I don't have experience on it yet. Solutions I have found so far seems to be OpenMPTCProuter and Zeroshell, but would like to hear more expertise on the matter.
    – shore
    Commented Jul 24, 2019 at 12:24
  • If your paths are the same, then bonding can be a good solution. But in this case, you have two different links, so the likelihood of out-of-order packets is rather high.
    – Ron Trunk
    Commented Jul 24, 2019 at 12:28
  • At any rate, MPTCP is an OS-level feature, so it would be off-topic here. You could try asking on Server Fault for more information.
    – Ron Trunk
    Commented Jul 24, 2019 at 12:30
  • Tinc VPN is something that seems to be promising solution related to the Roadwarriors VPN problem, but this another things I would like to hear more expertise on the matter. Major problem is to find the final solution that can have all these technologies solutions nicely bundled and supported.
    – shore
    Commented Jul 24, 2019 at 12:35
  • You will probably find more familiarity with these technologies on Server Fault.
    – Ron Trunk
    Commented Jul 24, 2019 at 12:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.