Uplinks (multi-WAN)#

The first tab of High availability, at /ha: every way this router can use more than one internet connection, and everything about each one that you can change. Nothing here applies itself — each editor adds to the pending changes, and the Commit Bar applies them.

What counts as an uplink#

An uplink is any interface that carries a default route. That is a static route through a gateway, a DHCP client, a PPPoE connection, a health-checked route, or a member of load balancing — an interface can be an uplink through several at once, and a VLAN can be one like any other interface.

Uplinks are used in the order of their priority: lower numbers first. An uplink with a health check outranks every uplink without one while its check passes, and among health-checked uplinks the priority orders them.

The tiles#

The uplinks table#

Notices above the table are what the router's configuration adds up to, in plain words: two uplinks with the same priority share traffic instead of failing over; an uplink without a health check keeps being used when its path fails; a health check whose targets have no route through their uplink cannot pass again once it fails; an uplink without source NAT sends private addresses to the internet; the routing table could not be read.

Where each health verdict comes from#

Health is the router's own verdict. A health-checked uplink is Passing while the router has its health-checked route installed, and Failing when the check has withdrawn it. A load-balanced uplink's verdict is load balancing's own report. Link down is the kernel's, and wins over both.

Measured, and what the router does about it#

The Measured column and the Measured latency panel are the agent's own numbers: from the router, it pings each uplink's health-check targets and its gateway every five seconds, out of that uplink, and shows the verdict (Passing, Degraded, Failing), the round trip, jitter and loss over the window in the panel's heading.

Beside the numbers is what the router does about them. For an uplink with no health check that is nothing — the router keeps using it whatever the measurements show — and the panel says so. A target that the router reaches through a different uplink is not measured for this one, and the panel says why. When the agent is not running on the router it measures nothing and says that instead.

Editing an uplink#

Click a row. The panel shows the uplink's status — for a health-checked uplink, with each target's route under Target routes — then these sections.

Connection

• A static uplink's Gateway. Changing it moves the default route, and the health check with it. An uplink whose default route goes through the interface itself, as a tunnel's usually does, has no gateway to set.
• A DHCP uplink's Use the default route from DHCP. A health check needs it, so it is on whenever the uplink has one.
• A PPPoE uplink's Username, Password (write-only: leave it empty to keep the one the router has), Connects over (the interface or VLAN the connection runs on), MTU, Service name, Access concentrator, MSS clamping, Use the provider's DNS servers and IPv6 address.
• Priority, 1 to 255. With a health check it orders the health-checked uplinks; without one it is the route's own rank.

Health check

Switch it on and give it one or more Targets — addresses the router should be able to reach through this uplink, such as two public resolvers that the router does not use for its own DNS. Each target gets a route through the uplink when you save; see Target routes. Method is ping, a TCP connection (with its port) or ARP; Interval is the time between checks; Every target must answer makes one unreachable target enough to fail the uplink, which is stricter than a public address usually warrants. Switching it off removes the check and its targets' routes.

A health check needs the uplink's gateway: a PPPoE connection that has not come up yet cannot have one until it has.

Load-balancing tests, on an uplink that is a member of load balancing: the next hop, how many failed tests drop it and how many successful ones bring it back, and each test — a ping (with its response time), a TTL-expiry test, or a script.

Source NAT: Masquerade behind the uplink's own address, Translate to an address (a static address block), or None. A new rule takes the next free source NAT rule number, and the NAT page shows it too.

Stop using as uplink asks once more, then removes the uplink's default route, its health check with its targets' routes, and its place in load balancing. The interface itself stays, and so do the other uplinks' routes.

Target routes#

The router checks a target by pinging it out of the uplink. While the uplink is in use that works. Once its check fails and another uplink takes over, nothing sends the target out of the first uplink any more: the router treats the address as if it were on the uplink's own network, the check can never pass again, and the uplink is never used again. A backup whose check is added while another uplink carries traffic never passes its first check, for the same reason. A TCP check fails differently: it follows the routing table, so without a route it tests whichever uplink carries traffic to the target.

So the page gives each target a route of its own through the uplink, called its target route. A policy local-route rule that sends the router's own ICMP for the target into a table whose route leaves by the uplink does the same job without routing clients there; the agent follows that rule and counts the target as pinned too:

• Saving a health check adds a route for each new target, and removing a target removes its route. Add uplink does the same for the new uplink's targets.
• Switching the health check off, and Stop using as uplink, remove the routes. A route that another uplink shares loses only this uplink's part.
• Changing a static uplink's Gateway moves its target routes to the new gateway.
• No route is needed, and none is added, for an ARP check, for a target on the uplink's own network (its gateway, say), or for a ping out of a PPPoE connection.

Target routes, in the panel's status, lists each target: Through the uplink, Directly connected, or, when something is wrong, No route, Through another uplink, Discarded (a route drops it) or No gateway (a route names the uplink but no gateway). A health check made before the page added these routes has none. Its Health check section names the targets without one, and Add target routes adds just their routes to the pending changes.

A target that belongs to another uplink is refused, because a route can send an address through one uplink only:

• 1.0.0.1 is already a target of eth2's health check. Choose another target.
• 9.9.9.9 is already routed through eth2. Choose another target. — by a route that is applied or only pending.

Adding an uplink#

Add uplink offers the interfaces that are not uplinks yet, VLANs included, and asks how the uplink gets its address: DHCP, a Static address with its gateway, or PPPoE over the interface with its connection name, username and password. It also takes a priority (behind the existing uplinks unless you give one), a description, the source NAT, and health-check targets, each with a route through the new uplink (see Target routes).

Load balancing#

Load balancing shares new connections between uplinks by weight, and stops using an uplink whose tests fail.

Add rule, or click a rule, to set which traffic it takes — arriving on an interface, by protocol, source and destination — and the uplinks it shares it between, each with a weight. Leave this traffic out of load balancing makes the rule an exception that follows the main routing table. Move connections off a failed uplink and Balance each packet are per rule. An uplink added to a rule without load-balancing tests gets one against the target given beside it.

Settings holds the options that apply to all of it: sticky inbound connections, keeping your own source NAT (load balancing masquerades behind each uplink otherwise), balancing the router's own traffic, moving connections when an uplink fails, and balancing only traffic that would use the default route. Remove load balancing takes all of it away; deleting the last rule does the same.

Policy routing#

A policy routing rule sends chosen traffic through a chosen uplink, whatever the priorities say: traffic from 10.0.40.0/24, through the fibre.

Add rule, or click a rule, to set Send through (the uplink), the match — From address, To address, Protocol, To port — a description, and whether the rule is on. Arriving on is the set of interfaces the policy applies to, and applies to every rule in that policy.

The page keeps one routing table per uplink for this and manages it: the first rule through an uplink creates its table, and the table goes with the last rule that used it. A table built as "this uplink or nothing" — both halves of the address space (0.0.0.0/1 and 128.0.0.0/1) through one uplink, and everything else discarded, so a cable pull cannot send its traffic through another uplink — counts as that uplink's table. A new rule through that uplink uses it, so that rule's traffic has no other uplink to fall back to either.

See also#

• Add a second uplink with failover
• Load-balance two uplinks
• Route some traffic out of one uplink
• Masquerade behind each uplink
• Connect with PPPoE
• QoS — shaping the uplink that carries traffic.