L7 Firewall

[Norphy]

I’m moving up to what my friend @Roberto likes to call The Land of the Deep Fried Mars Bar (and he’s half Scottish so that’s allowed) at the end of the month. The house that I’m moving to is very rural and presently has two internet connections: a satellite connection and a DSL one.

 

I’m now working for an MSP and will be working permanently from home, so a half decent internet connection is a hard and fast requirement. The trouble is, the DSL connection has pretty poor bandwidth (1.5-3mbps with a following wind) and the satellite connection has fair bandwidth but horrible latency (1 second is typical). Being as I’m going to be using Teams, RDP etc and will be using the latter over VPN, I’m dreading what that will be like.

 

I’m therefore wondering if there is some kind of clever firewall/router widget out there that does L7 inspection, can take two WAN connections and then route traffic over them depending on the type of traffic that it is or the destination of the traffic. For example, any Teams traffic or traffic to my MSP’s NOC goes routed over the DSL and everything else that doesn’t care about latency goes over the satellite.

 

I’m sure there must be something that can do it, possibly Pfsense or similar, or maybe an appliance from the likes of Sonicwall but I’m not sure what. Any recommendations?

 

Cheers [emoji4]

 

/edit

 

Oh, and if either connection falls over, I’d want the router to automatically fail over all traffic to the active connection and use the conditional routing again once both connections are up.

Edited November 1, 2021 by Norphy

[Guest Guest]

Are starlink an option? Their median latency is 45ms according to Google

[Primus]

Depending on where - Starlink might be an option - the latency is a lot better on that than traditional satellite broadband.

[Norphy]

I’ve preordered Starlink but they’re targeting the area in mid 2022. I need something in the shorter term.

 

I’m also going to see if cellular broadband using an external antenna will work, but I’m not that hopeful that it will.

Edited November 1, 2021 by Norphy

[mavhc]

pfsense seems to have some of those options https://docs.netgate.com/pfsense/en/latest/multiwan/policy-route.html

[FN-GM]

pfsense seems to have some of those options https://docs.netgate.com/pfsense/en/latest/multiwan/policy-route.html

 

It doesn't have the Layer 7 component. So you won't be able to send specific applications via a specific WAN interface. It will have to be done via IP addressing.

[tom_newton]

You will not find such a thing, I'm afraid. All layer 7 stuff is fuzzy. Even those that claim "first packet match" are BS (I know, I have evaluated most all of the 3rd party components that exist) and getting worse - so much traffic is encrypted these days it's increasingly hard to match.

 

There's a couple of options as I see it. Most bulk traffic is HTTP/S so you could run a web proxy on/pointing to the Sat gateway, and that way shift the majority of slowish-but-big traffic in that direction, leaving your DSL to take the unproxied UDP traffic from zoom/teams? You might also do some layer3 routing on anything that's unproxied, but bulk: backups, perhaps? I think my advice here is don't let perfect be the enemy of working.

Hopefully your DSL comes towards the top end of 3Mb as much less and you might struggle with video - particularly as the upstream is likely to be pretty rancid.

I spent a lot of time tuning when I moved here (surrounded by FTTC and Virgin, our new build was off a child cabinet which had a bit of long, thin, worn wet string to the exchange). It is certainly worth fiddling with the DSL modem (swapping the ISP supplied junk out) and trying stuff like going for ADSL2 rather than 2+ as that can even out your upload.

[RobD]

I moved to the sticks a while back and am stuck with 10mbps until I can get starlink or FTTP (4G was less than 10mbps), myself and my wife both work from home and teams was often cutting out etc while both on a calls so I setup some QoS priorities on a Draytek router which has hugely improved my teams calls.

 

I've never have any issues with my VPN or RDP etc (but saying that my latency is pretty good) but if you have two lines you could do some port based load balancing with a draytek.

 

Should note that in Wales the Welsh Assembly will pay for the starlink dish, might be something similar in Scotland.

Edited November 2, 2021 by RobD

[Davit2005]

You will not find such a thing, I'm afraid. All layer 7 stuff is fuzzy. Even those that claim "first packet match" are BS (I know, I have evaluated most all of the 3rd party components that exist) and getting worse - so much traffic is encrypted these days it's increasingly hard to match.

 

I used Application based firewalls for near on 10 years. You do need to make sure that you have all the dependency applications added otherwise it can sometimes be a trial and error also if there are non-standard ports in use this need to be added too. In actual fact a previous place we used 95% application based rules. It was the preferred method, why pay all the money for a application based firewall if you don't use it.

 

It does catch people out when they try to putty into web severs or databases as a connection test then you explain to them why it does not work.

[tom_newton]

It'll do for blocking - but routing, you can't miss a packet.

[SchoolsBroadband]

Hello,

 

my dad had the same issue when moving to a rural house in Yorkshire. I installed for him a 2Mbps DSL and a 4G connection that could get speeds of around 5Mbps on a good day.

 

We used a small Fortinet device to do the job. You can send different types of traffic down different links depending on latency, usage and other metrics which means you could keep your latency sensitive applications on one link and the downloads on the poor latency but faster link.

 

I've just upgraded him from 4G to Starlink and its amazing!!!!!!! My top throughput speed has been about 340Mbps download and 20Mbps upload! Latency from recollectin is about 18ms - 25ms which is absolutely fine for remote desktop.

 

I'd highly recommend getting it to anyone if you have no other option. However it did take us about 9 months from point of order to get it and now we have I'd have to upgrade his internal wireless (he had a max of .n!) and also his laptop only has an FE port in it so that needs replacing too!

 

If you need any help specifying the right Fortigate Device do let me know.

 

Thanks

 

Dave

[Norphy]

Thanks Dave, I may well take you up on that offer.

[Wave9_Lee]

I’m moving up to what my friend @Roberto likes to call The Land of the Deep Fried Mars Bar (and he’s half Scottish so that’s allowed) at the end of the month. The house that I’m moving to is very rural and presently has two internet connections: a satellite connection and a DSL one.

 

I’m now working for an MSP and will be working permanently from home, so a half decent internet connection is a hard and fast requirement. The trouble is, the DSL connection has pretty poor bandwidth (1.5-3mbps with a following wind) and the satellite connection has fair bandwidth but horrible latency (1 second is typical). Being as I’m going to be using Teams, RDP etc and will be using the latter over VPN, I’m dreading what that will be like.

 

I’m therefore wondering if there is some kind of clever firewall/router widget out there that does L7 inspection, can take two WAN connections and then route traffic over them depending on the type of traffic that it is or the destination of the traffic. For example, any Teams traffic or traffic to my MSP’s NOC goes routed over the DSL and everything else that doesn’t care about latency goes over the satellite.

 

I’m sure there must be something that can do it, possibly Pfsense or similar, or maybe an appliance from the likes of Sonicwall but I’m not sure what. Any recommendations?

 

Cheers [emoji4]

 

/edit

 

Oh, and if either connection falls over, I’d want the router to automatically fail over all traffic to the active connection and use the conditional routing again once both connections are up.

 

Pretty sure you can do this with Sophos XGS and they have a home SW version which is free https://www.sophos.com/en-us/products/free-tools/sophos-xg-firewall-home-edition/software

 

[Maxtgw]

Hi Norphy, go and speak to the guys at evolving networks [email protected].

 

Full disclosure, I used to work there but trying not to be biased! They can aggregate any connectivity and present it with a single static-IP meaning you get the combined throughput of multiple links and if any link fails then you just lose abit of bandwidth rather than 'failover' or worry about an IP change.

 

Tell em Max sent you and they might just give you a generous quote!

[SchoolsBroadband]

Thanks @Maxtgw

 

we already have our own plans for SD-WAN and link aggregation. Watch this space everyone

 

Dave

[Norphy]

In preparation for my move up north to the middle of nowhere, I've ordered myself one of these:

 

https://www.broadbandbuyer.com/products/37640-poynting-5g-xpol-a0002/

 

What I didn't realise is just how friggin' huge it is! Here is a picture of it with a 4G dongle attached:

 

 

Oh well, hopefully it will help.

Edited November 25, 2021 by Norphy

[Norphy]

I did some wandering today with my comically oversized 4G antenna attached to a tallish pole and to my dongle, plugged into a laptop. I managed to get 13mbps out of it on EE. I'll have that!

 

Called a television aerial company today to ask if they could attach the antenna to an existing TV aerial pole, they're quoting for the job tomorrow. Just need a router now.