1. Home
  2. Networking Firewalls
  3. Supporting 2 Internet Connections

Supporting 2 Internet Connections

I'm having trouble figuring out how to support 2 Internet connections and still retain control over the way different hosts route to the Internet.

Of the 2 Internet connections, connection A is more suited to handling traffic for our web servers and connection B is more suited to failover and web browsing by users.

We have 2 firewalls already.

Without a DMZ, I could try one firewall per Internet connection:

Internet Connection A Firewall A LAN Internet Connection B Firewall B LAN

The web servers are on the LAN with firewall A as their default gateway and the PCs on the LAN use Firewall B as their default gateway. Both firewalls can port forward to the web servers. The problem is, if one of the connections goes down, I can't see how I can dynamically change the routing for the web servers or PCs.

Adding a DMZ to this topology further complicates things:

Internet Connection A Firewall A LAN | |-- DMZ | Internet Connection B Firewall B LAN

It's a routing issue once more. How can hosts on the DMZ have their default gateway changed from Firewall A to Firewall B? Same routing problem as per the first scenario with hosts on the LAN.

If I use a dual wan router (or firewall that supports failover Internet connections) I could do something like this:

Internet Connection A | | |-- Router Firewall LAN | | | |-- DMZ Internet Connection B

All hosts have the same default gateway. The drawback is that I lose the ability to route LAN traffic via Connection B and web server traffic via Connection A. In this scenario, Connection B as the lower bandwidth connection becomes the failover connection.

Can anyone see how this trade off between automatic failover and routing can be resolved?

Reply to
Paul Welsh
Loading thread data ...

Thanks for that, Walter. It has convinced me to think again and I think I've come up with something easier. All comments welcome.

Internet Connection A Dual WAN router A Firewall A LAN Internet Connection B Dual WAN router B Firewall B LAN

Router A has its default gateway set to Connection A and its failover to B. Router B is configured in reverse. Firewall A has WAN Router A as its default gateway and Firewall B has Router B as the default. The web servers on the LAN have Firewall A as their default gateway and the user PCs have Firewall B as their default. No DMZ.

Reply to
Paul Welsh

In article , Paul Welsh wrote: :I'm having trouble figuring out how to support 2 Internet connections :and still retain control over the way different hosts route to the :Internet.

:Of the 2 Internet connections, connection A is more suited to handling :traffic for our web servers and connection B is more suited to failover :and web browsing by users.

:We have 2 firewalls already.

Whether you can do this kind of work or not depends on the router model, software rev, and firewall model (and software rev).

I suggest you look at the white papers on Vincent C. Jones' web site, as he has much useful information on this topic. There's enough to say about it that someone could write a book about it. (Oh wait... Vincent already did that ;-) )

Reply to
Walter Roberson

Cabling-Design.com Forums website is not affiliated with any of the manufacturers or service providers discussed here. All logos and trade names are the property of their respective owners.