Firewall failover Project

[RavenLunatic]

Hello all!

I had to backup and update my OPNsense firewall the other day due to all this PHP H4xor situation.

Ultimately I was without wired Internet for a couple of hours.

I have two internet connections from EE (Openreach FTTP) and Virgin (DOCSIS).

The weakest link is only having one Firewall/Router

How would I go about setting up a backup firewall?

Having both firewalls to have the same IP addresses and rules for all my connected devices is a would be useful.

I don’t need instantaneous failover, although that would be interesting if possible, just something I could switch over if needed with minimal manual intervention.

My vision would be the 2nd firewall would be permanently switched off, only to be turned on when the primary firewall is unavailable.

I guess the simplest way to do this would be to build a 2nd firewall with the same hardware as the 1st, but I built it from a renewed DEL Office SFF PC which may not be available now.

I am not currently using my EE router for anything, could that be used?

Another option I think would be interesting would be to virtualise both firewalls on a single machine, although that does not help if there is a hardware issue.

What about running dual NAT with Virgin Media HUB in router mode direct to my network switch?

So many options...

What do you think?

 

[Quartz]

Plus 'how to team two opnsense routers' into Google and it will tell you about CARP. I've not done it myself, mind you.

 

[Avalon]

General advice is not to, but for a home environment, consider if a VM would fulfil your needs?

 

[lmfy2k]

how about run a Proxmox node and run 2x Opnsense as VMs. Use one as primary. Have secondary turned off.

You can go step further and run proxmox nodes in a cluster.

 

[Armageus]

I had to backup and update my OPNsense firewall the other day due to all this PHP H4xor situation.

Why would the PHP exploits affect the internal management page of your firewall?

 

[RavenLunatic]

Well buying identical hardware is out of the question as my renewed 16GB DELL SFF PC that cost me £80 now costs £500 for an 8 GB version.

Plus 'how to team two opnsense routers' into Google and it will tell you about CARP. I've not done it myself, mind you.

I will look into that, thanks.

General advice is not to, but for a home environment, consider if a VM would fulfil your needs?

It's more of a home lab thing, the only one inconvenienced setting it up would be me. VM's might be the answer,

how about run a Proxmox node and run 2x Opnsense as VMs. Use one as primary. Have secondary turned off.

You can go step further and run proxmox nodes in a cluster.

I think this may be the way to go. I have never used Proxmox before but I have heard a lot about it in the past.

One stumbling block might be that current OPNsense system runs on a i5 6600 that only has 4 thread's.

I do have an old Intel Core i7-5930K system with 32/64GB RAM that is not being used. but it's quite power hungry for a firewall/router.

Why would the PHP exploits affect the internal management page of your firewall?

According to the OPNsense forums the PHP thing would only be an issue if someone already had access to the firewall. There was no real danger of an attack, but for safety sake to patch it in any case. Also, I had not updated the firewall for almost a year, so it was overdue so I ran a backup first then updated it.