Firewall failover Project

[RavenLunatic]

Hello all!

I had to backup and update my OPNsense firewall the other day due to all this PHP H4xor situation.

Ultimately I was without wired Internet for a couple of hours.

I have two internet connections from EE (Openreach FTTP) and Virgin (DOCSIS).

The weakest link is only having one Firewall/Router

How would I go about setting up a backup firewall?

Having both firewalls to have the same IP addresses and rules for all my connected devices is a would be useful.

I don’t need instantaneous failover, although that would be interesting if possible, just something I could switch over if needed with minimal manual intervention.

My vision would be the 2nd firewall would be permanently switched off, only to be turned on when the primary firewall is unavailable.

I guess the simplest way to do this would be to build a 2nd firewall with the same hardware as the 1st, but I built it from a renewed DEL Office SFF PC which may not be available now.

I am not currently using my EE router for anything, could that be used?

Another option I think would be interesting would be to virtualise both firewalls on a single machine, although that does not help if there is a hardware issue.

What about running dual NAT with Virgin Media HUB in router mode direct to my network switch?

So many options...

What do you think?

 

[RavenLunatic]

Well buying identical hardware is out of the question as my renewed 16GB DELL SFF PC that cost me £80 now costs £500 for an 8 GB version.

Plus 'how to team two opnsense routers' into Google and it will tell you about CARP. I've not done it myself, mind you.

I will look into that, thanks.

General advice is not to, but for a home environment, consider if a VM would fulfil your needs?

It's more of a home lab thing, the only one inconvenienced setting it up would be me. VM's might be the answer,

how about run a Proxmox node and run 2x Opnsense as VMs. Use one as primary. Have secondary turned off.

You can go step further and run proxmox nodes in a cluster.

I think this may be the way to go. I have never used Proxmox before but I have heard a lot about it in the past.

One stumbling block might be that current OPNsense system runs on a i5 6600 that only has 4 thread's.

I do have an old Intel Core i7-5930K system with 32/64GB RAM that is not being used. but it's quite power hungry for a firewall/router.

Why would the PHP exploits affect the internal management page of your firewall?

According to the OPNsense forums the PHP thing would only be an issue if someone already had access to the firewall. There was no real danger of an attack, but for safety sake to patch it in any case. Also, I had not updated the firewall for almost a year, so it was overdue so I ran a backup first then updated it.

 

[RavenLunatic]

I have been having a think about how I am going to set this up. CARP looks like the real deal, but its overkill for what I want.

I saw in another thread someone was using a network switch plugged directly into the ONT, but for the life of me I couldn’t find it.

So, I am thinking about doing the same, connecting my current OPNsense firewall and my unused 5930K system as a second OPNsense firewall with a 2.5Gbps switch plugged into to the EE ONT.

The idea is to only have one firewall powered on at a time to avoid any conflicts, with the power hungry 5930K as a backup. I am hoping that copying the settings from my original firewall to the backup one will keep the same IP address’s ARP table and unbound dns settings for all my devices.

My 5930K only has one 10Gbps rj45 via an add in card, the two ports on the motherboard are just 1Gbps which is plenty in the event of a failure, that would be the least of my worries.

The red lines are for the modifications that I want to make to my current setup. The direct black line from the EE ONT to the primary OPNsense box would be cut.



Do you think it could work?

I don't know how to integrate the Virgin Media line into this, but the odds of both EE and my primary OPNsense firewall going down at the same time is probably unlikely.

Is it possible to connect the Hub5 to my 5930K system from one of the 1Gbps ports on the router in modem mode with the primary OPNsense connected to the 2.5Gbps ports but powered off?

 

[RavenLunatic]

That's it really, nothing complicated ... you should be done by lunchtime tomorrow

lol, you have lost me.

My knowledge of VLAN's stops at Tailscale.

My switches are all unmanaged so I don't think I can do VLAN's like you describe as there is no option to set rules.

Thank you for the suggestion. Your approach is incredibly neat and to the point, I need something even simpler with minimal configuration using my current hardware, VLAN's at the moment go over my head..

 

[RavenLunatic]

Don't say that mate, it's honestly not that complicated and I would recommend you get a cheap switch to try it out. A 6 port sodola 2.5g managed switch can be found for 46 quid in the old forest.

Just think of a vlan as an isolated network and to tap into it you need use vlan tags ... Once you get it and play around with it you won't go back

GL

I appreciate the suggestion and the encouragement mate! However, managing complex VLAN tags across multiple active systems is a bit beyond my comfort zone right now, I honestly just can't visualize how it all works in my head.

I don’t want to run the backup system all the time as it is a power hungry, and instant failover is not required for my plan.

I actually already have a spare unmanaged 8-port 2.5Gbps switch. I'm just planning to use the switch right now on the ONT to share the EE WAN link between my main OPNsense box and my old i7-5930K backup system.

Since I'll only ever have one firewall powered on at a time, I hope the configuration in my network plan will work without adding that extra layer of complexity!

 

[RavenLunatic]

After further investigation the VM connection is a bit tricky to include in my plan. Apparently the Hub 5 in modem mode has strict MAC address locking and needs rebooting before reissuing a WAN IP address when a new connection is made.

I know this could probably be overcome using VLAN’s

As it turns out my Motherboard only has one 1Gbps Ethernet port, so I will have to do with just the EE PPPoE for now with the components on hand.

Currently referring and revising my plan with AI in case I have missed something, so far it says it makes sense.

The tricky part will be getting OPNsense on my 5930K with the settings from the primary without crashing my network with conflicts. I have read that I need to connect the WAN from the 5930K to the live main LAN, and connect the other Ethernet port to a second PC to the 5930K’s making sure the second PC its isolated from the LAN and WiFi.

The diagram makes more sense.

[ LIVE HOME LAN SWITCH ]
       │
       └─── (WAN / em0) ─── [ 5930K BACKUP BOX ] ─── (LAN / aq0) ─── [ ISOLATED UBUNTU PC ]
            Pulls internet safely                                    Manages the 5930K via
            from your primary firewall                               browser at https://192.168.1.1
            (Acts like a normal PC client)                           (Completely cut off from home LAN)

I need to take a breather and let the plan sink in for a bit before I proceed.

On a side note, I finally cancelled my Microsoft 365 subscription today, and emptied my Onedrive for good! Yay