Best use of multiple ADSL connections

[dhicks]

Hello All,

 

We're looking at how best to increase the amount of bandwidth the school has access to, both for upload and download speed. We currently have one ADSL line at one end of the school that we use, and a second that I planned to get working with a nice new SmoothWall install.

 

We now maybe have a bit more money to spend on this, so I'm looking at getting a third ADSL line installed next to the second one and taking advantage of our ISP's offer of two uncontended ADSL 2+ lines running at 9Mb/s download speed each.

 

We want to make best use of all the bandwidth we'll have available. We'll have two lines next to each other offering 9Mb/s download and maybe 1Mb/s upload, and one line at the other end of the school offering 1Mb/s download and 512Kb/s(?) upload.

 

What's the best solution? Obviously, we want any web access to go through a filter - seemingly we can have multiple copies of SmoothWall installed throughout the school, so that's not a problem. At some point, a load-balancing router would probably come in handy. Routers that sit in the centre of a network seem to be rather expensive, around £3,000+, but routers that sit at the edge of a network, where the Internet connection comes in, seem to be quite cheap, and we can probably just set up a Linux VM to act as a load-balancing router.

 

Could I set up a load-balancing router with three network interfaces and have each seperate ADSL router port-forward incoming requests to a given network interface? If I do that, wouldn't I then have separate routers available on the network which users could connect to to get un-filtered Internet access? Can I set an ADSL router to refuse connections from anything except a trusted source? Can this only be done by (spoofable) MAC address? Is a VLAN the answer instead - set up a VLAN to take traffic from the ADSL router at one end of the school to the load-balancing router at the other end? Would this use up an excessive amount of our 2Gb/s backbone bandwidth?

 

--

David Hicks

[FN-GM]

Have you considered a leased line? It would be far better

[tom_newton]

David, are you on NG or SchoolGuardian? SG can handle 2 internet lines and lb web traffic. Advanced Firewall can handle ~19 and is a minimal cost upgrade from SG.

 

Give me a call tomorrow so I can better understand your setup.

[dhicks]

Have you considered a leased line? It would be far better

 

Better in what way?

 

--

David Hicks

[dhicks]

are you on NG or SchoolGuardian?

 

We're currently evaluating SchoolGuardian. Advanced Firewall sounds like it might be the kind of thing we want - I'll give you a call tomorrow, then. Thanks.

 

--

David Hicks

[benaus]

I have used Zeroshell for multiple ADSL/3g accounts and it does load balancing very nicely, but at the end of the day 2 or 3 adsl lines don't compare to 10/10mbit fiber

[SYNACK]

Better in what way?

 

A leased line will be more robust than DSL, maybe not if the DSL is through different providers with different DSLAMs though. It also offers up the bandwidth in one big chunk allowing for larger downloads to use more than the max bandwidth of one DSL line.

 

Shareing the DSL lines as above gets you three completely seporate connections to the web so no single conversation with the web can use more than the max of one of the DSL lines at a time. You could somewhat get around this with the use of BGP but it is way overcomplicated for what you want to do and probably would not be supported by your ISP. No system that I am aware of can ballance out the usage across the lines in any more than a best effort fassion due to the persistance of TCP connections and the unknown usage patterns of individual users.

 

Not saying it is not a viable idea but just highlighting what it actually provides. I would look at using a central filtering gateway like smoothwall above to share the connections as a distributed system would be even less able to spread the load in an optimized way.

[tom_newton]

A leased line will be more robust than DSL, until it breaks and is just as broken

 

There, fixed that for ya

 

Had a BT man on the other day trying to sell me a leased line.

 

BT Man: "Would you like a leased line, it is $$$$"

Me: That's our entire connectivity budget, what about a backup line?

BT: Err... this never breaks

Me: What? Never?

(this goes on for a while)

BT: No, in all my years with BT I have never seen one break

Me: Jeremy Beadle? Is that you?

[pwds]

FWIW Most routers with a full SPI firewall will allow you to restrict traffic to one IP address. As I understand it, it is possible to spoof a sending IP, but it's not possible to establish communication from a spoofed IP for what are hopefully obvious reasons.

 

There are various load balancing routers around although the Linux VM may well be a good option.

 

Computers -> SM -> VM -> Routers

[tom_newton]

David, if you tried to catch me this aft - sorry, was called out unexpectedly. In as normal tomorrow though. I hope >

[tmcd35]

Just thinking aloud here...

 

I'd probably look at 1 VLAN for each ADSL modem (maybe not the two together if the Router is going in the same location as they could plug straight into the router). I'd then go for a Linux box with 4 Nic. 3 Nics for each ADSL modem and 1 nic for your regular network.

 

Block outgoing connections on port 80 and choose another port only known to your proxy server for web requests. Infact probably block all outgoing traffic by default and then scope some rules depending on what ports are needed.

 

Depending on the spec of the linux box may even have the web proxy/filtering server running on the linux router box.

[Netwacky87]

There, fixed that for ya

 

Had a BT man on the other day trying to sell me a leased line.

 

BT Man: "Would you like a leased line, it is $$$$"

Me: That's our entire connectivity budget, what about a backup line?

BT: Err... this never breaks

Me: What? Never?

(this goes on for a while)

BT: No, in all my years with BT I have never seen one break

Me: Jeremy Beadle? Is that you?

 

HA HA HA!

 

Tom - we have two leased lines....and either 1 is always down!!!! Useless!!!!

[dhicks]

I'd probably look at 1 VLAN for each ADSL modem (maybe not the two together if the Router is going in the same location as they could plug straight into the router). I'd then go for a Linux box with 4 Nic. 3 Nics for each ADSL modem and 1 nic for your regular network.

 

That's rather what I'm thinking at the moment, too. I'd just need to run the one ADSL connection over a VLAN to bring it to the same location as the two others, then plug all three in to a Linux machine of some description. I'm actually rather thinking that this will be a VM running SmoothWall with three virtual interfaces - I'll try and get hold of Tom tomorrow and see if this si practical.

 

--

David Hicks

[mac_shinobi]

That's rather what I'm thinking at the moment, too. I'd just need to run the one ADSL connection over a VLAN to bring it to the same location as the two others, then plug all three in to a Linux machine of some description. I'm actually rather thinking that this will be a VM running SmoothWall with three virtual interfaces - I'll try and get hold of Tom tomorrow and see if this si practical.

 

--

David Hicks

 

any chance you can let us know the outcome ( brief or whatever ) ??

 

Thanks