I am currently installing a firewall in my company (using OPNsense) but I was asked to use the same system as "Internet Breakout" as well. Does anyone know how to accomplish this? I understand that Internet Breakout is activated when the service is down by the ISP, but I don't know how a firewall can solve this, is that a special feature or something? Thank you in advance for your answers.
Usually, Internet Breakout refers to providing a means to access the Internet directly from a branch location without backhauling traffic back to a central location like a head office or datacenter. This could be done either as a nominal mode, or as a backup to the central Internet (though really if you have usable Internet on-site, there's no good reason to use it only for backup, you might as well use it as primary).
In such scenarios, the firewall has a couple things to deal with:
- Protecting your network from any attacks through the local Internet line, i.e. firewalling
- Dealing with routing towards this local Internet, particularly if you have both local and centralized Internet access available within your network.
Typically, I would use a setup where there is a default route pointing to the local Internet, but subject to an IP-SLA type test where the device pings something that gives a good indication of the state of the local Internet (say the ISP gateway, at least) and drops that route in favor of one pointing to the centralized Internet if ever the test fails. Your mileage may vary as to how easy this is to setup depending on the brand of firewall or router you use on site.