0

I have a Debian based machine with 2 completely different network interfaces from 2 different ISPs acting as a backup for my server connection. These have two different IPs (Let's say IP1 and IP2backup)

I have configured the same exact port forwarding rules on both routers (Checkpoints) so both networks always point to the same host when accessing them using a specific port.

I want to make sure that when someone from the outside tries to connect to my server using my DNS, he will always be routed using IP1, unless it fails, in which case he should be directed to IP2backup.

This way I will have a back up network that can also route the required ports.

What would be the best approach to achieve this? a smart DNS? a setting in the Checkpoint router?

I have no idea and couldn't find a clear answer online.

Improve this question
2
  • 1
    You need to run BGP with your ISPs, and failure of one link will cause that ISP to stop advertising the route. On the backup ISP, you prepend your own AS multiple times so it is the less preferred route.
    – Ron Maupin ♦
    Commented May 20, 2020 at 20:10
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can post and accept your own answer.
    – Ron Maupin ♦
    Commented Dec 17, 2020 at 17:42

2 Answers 2

Reset to default
1

You can use AWS Route 53 health checks to achieve the kind of redundancy you're after -- with a fail-over time of several minutes.

See this guide for a starting point: https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/dns-failover.html

I've been consulting for BGP network of varying size for a long time. I find most folks in your position -- looking for redundancy for a web property -- do not need BGP. As Zac mentioned, you may be better off hosting your servers at a trustworthy company who has already invested in the level of network redundancy you require.

If you think you may want BGP, this general to-do list might help you decide whether to further investigate this option:

  • Contact your ISPs and ask if they offer BGP, and if so, will it necessarily increase your cost?
  • Verify your routing equipment supports BGP.
  • Determine whether you can justify having at least one /24 of IPv4 space routed to your network (maybe you already have this.)
  • Get an Autonomous System Number (ASN) from your RIR (such as ARIN or RIPE)
  • Provision BGP sessions with your ISP(s)
  • Configure your equipment
Improve this answer
1

I want to make sure that when someone from the outside tries to connect to my server using my DNS, he will always be routed using IP1, unless it fails, in which case he should be directed to IP2backup.

The only way that is happening is when you update the DNS record on failure detection. DNS records are cached, so you need to set a very short TTL to avoid clients using the outdated, cached record. You might have a hard time getting your ISP to host such a short-TTL record, although there are specialized providers. Despite the short TTL, the record might get cached for a longer time since many ISPs use a sane minimum TTL in their cache.

The time it takes to cover failure -> detection -> DNS update -> cache expiration is your minimum failure window. You can't get it to less than a few minutes, maybe down to one. Also, changing the server's IP kills all live sessions.

Rerouting your network prefix from one ISP to another using BGP (see Ron's comment) can work a lot faster. However, advertising your prefix over BGP across ISPs requires that you own the subnet and that it's at least /24 in size.

Another option is to use an external proxy as redirector. Of course, it'd require high availability and use a detection scheme to connect to the working address. It's probably easier and maybe even cheaper to move your server to HA hosting though.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.