c. Set the Destination Port Start/End. In this case we use any. d. Make sure the VPN tunnel is up, and then choose the VPN service in Interface. e. In this case, the Netflix service is available only when the VPN interface is up, and thus it’s not required to tick Auto Failover To The Other WAN.
2. And now, we may do a trace route test to verify if the rule is applied:
console-traceroute
-->
Macintosh-8:~ henrylo$ traceroute netflix-380.vo.llnwd.net
traceroute to netflix-380.vo.llnwd.net (208.111.151.36), 64 hops max, 52 byte packets
1 192.168.1.1 (192.168.1.1) 144.972 ms 0.228 ms 0.222 ms
2 192.168.171.1 (192.168.171.1) 31.985 ms 32.061 ms 31.788 ms
The trace route result shows the rule has been applied successfully, that the traffic to the Netflix server is sent via the VPN tunnel.
3. Or, if we want to limit that only certain users (for example, some managers in the company) may use the VPN service, we may set the profile like this:
Load-Balance-Route-Policy-Index-2-configuration
Part C. An Example using Part A and B
The requirements are:
I. When LAN 1 clients access to the Internet, the router do NAT and the traffics go via WAN 1. II. When LAN 1 clients access to the Private Network, the router do Routing and the traffics go via WAN 2. III. When WAN 1 is down, traffics to the Internet should auto failover to WAN 2. IV. When WAN 2 is down, a LAN-to-LAN VPN tunnel should get established via WAN1 to the Private Network, and traffics to the Private Network should go via the VPN tunnel.
1. To fulfill the requirements, we edit 2 rules:
Load-Balance-Route-Policy
2. Index 1 fulfill the requirement II,
Load-Balance-Route-Policy-Index-1-configuration
a. When LAN 1 clients access to the Private Network, the traffics should be sent via WAN 2. b. Leave Auto Failover disabled, so when WAN2 disconnected, the traffics to the Private Network won’t go via WAN 1 (should go via the VPN tunnel). c. Choose force Routing so the traffics will be routed to the Private Network.
3. Index 2 fulfills requirement I and III,
Load-Balance-Route-Policy-Index-2-configuration
a. When LAN 1 clients access to the Internet (we set the destination as any), the traffics should be sent via WAN 1. b. When WAN 1 is down, the traffics will be sent via WAN 2. c. Router should do NAT for the Internet browsing.
4. To fulfill requirement IV, please create a LAN-to-LAN VPN profile to the Private Network.
VPN-and-Remote-Access >> LAN-to-LAN
a. Please choose WAN 1 only, since the VPN tunnel should only be dialed out to the Private Network via WAN 1. b. Please disable always on. When WAN 2 disconnected, the router will be triggered to establish the VPN tunnel automatically whenever there are traffics from LAN clients to the Private Network. c. The VPN server should be in the Private Network.
5. The rules and VPN profile have been configured, and nowwe may do some tests to verify:
a. LAN client trace route to the Private Network
console-traceroute
-->
C:\Users\henrylo>tracert 172.16.2.1
Tracing route to 172.16.2.1 over a maximum of 30 hops
The LAN client is able to access to the Private Network via WAN 2.
b. LAN client trace router to the Internet (8.8.8.8).
console-traceroute
-->
C:\Users\henrylo>tracert 8.8.8.8
Tracing route to google-public-dns-a.google.com [8.8.8.8]
over a maximum of 30 hops:
1 <1 ms <1 ms <1 ms Vigor.router [192.168.200.1]
2 27 ms 24 ms 26 ms h254.s98.ts.hinte.net [168.95.98.254]
3 98 ms 24 ms 25 ms SCZS-3302.hinet.net [168.95.91.6]
The traffics to the Internet are sent via WAN 1.
c. Disconnect WAN 1, and the LAN client try to access to the Internet again.
console-traceroute
-->
C:\Users\henrylo>tracert 8.8.8.8
Tracing route to google-public-dns-a.google.com [8.8.8.8]
over a maximum of 30 hops:
1 <1 ms <1 ms <1 ms Vigor.router [192.168.200.1]
2 <1 ms <1 ms <1 ms 172.16.2.1
The traffics to the Internet are sent via WAN 2 this time.
d. Make WAN 1 connected back again, and disconnect WAN 2 this time.
The LAN client try to access to the Private Network:
console-ping
-->
C:\Users\henrylo>ping 172.16.2.4 -t
Pinging 172.16.2.4 with 32 bytes of data:
Request timed out.
Reply from 172.16.2.4: bytes=32 time=128ms TTL=254
Reply from 172.16.2.4: bytes=32 time=124ms TTL=254
Reply from 172.16.2.4: bytes=32 time=128ms TTL=254
The first ping was timed out since the VPN tunnel was not established yet. The router was then triggered by the ping packets to establish the VPN tunnel, and started with the second ping, the LAN client was able to reach the Private Network via the VPN tunnel.
Part D. LAN NAT host to another LAN NAT host via WAN
The scenario is that LAN 1 clients may access the FTP server in LAN2 via the WAN 1 public IP address. This is the WAN1 detail:
WAN-1-Status
To do so, we may to set the rule so when LAN 1 clients trying to reach WAN1, they may go out via WAN2.
Load-Balance-Route-Policy-Index-3-configuration
a. Set the Src IPStart/End for LAN 1 clients. b. Set the Dest IP Start/End as the WAN 1 public IP. c. Choose the outbound Interface as WAN2. To do the NAT loopback, please choose WAN1 as the interface. d. Tick forceNAT.
2. And then, we may set the Open Port rule for the FTP server:
NAT >> Open-Ports >> Edit-Open-Ports
3. Now, the function should be work! Here we use a PC in LAN2 running the HFS software as the FTP server, and a PC in LAN1 trying to access the FTP server via the WAN1 IP address:
Connection-to-FTP-Server-via-WAN-1
Part E. VoIP Service with Multi-PVCs
The Load-Balance/RoutePolicy also supports routing traffics according to different PVCs. The scenario is:
I. LAN customers should go to the Internet via WAN1. II. IP phones may dial to SIP services in the Internet via PVC1 => DNS lookup may be required. III. IP phones may also be able to dial to the internal SIP service via PVC2.
1. To fulfill these requirements, we edit multiple rules:
Load-Balance-Route-Policy
Now let’s look into each rules.
2. Index 1 routes the traffics going from IP phones to the iptel server via WAN1.
Load-Balance-Route-Policy-Index-1-configuration
3. When IP phones dialing to the iptel server, a DNS lookup may be applied, and thus we also need to edit rules to make sure the DNS lookup traffics going through WAN1.
a. Before editing the routing rules, we need to make sure which DNS servers the LAN clients may use:
DHCP-Server-Configuration
b. And then, we may edit 2 routing rules for these 2 DNS servers:
i. For DNS server 168.95.1.1
Load-Balance-Route-Policy-Index-2-configuration
ii. For DNS server 8.8.8.8
Load-Balance-Route-Policy-Index-3-configuration
4. Besides dialing to the iptel server, in the rest cases the IP phones dialto the internal SIP server, and the traffics should go via WAN5:
Load-Balance-Route-Policy-Index-4-configuration
Please note that the reason we left the Dest IP as blank is, the IP phone traffics
should either go to the external server, or the internal one, and we have created multiple rules to make
sure the traffics heading to the external server will go via WAN1, and now the remaining traffics should
only go to the internal server via WAN5, and thus it’s ok to leave the Dest IP as blank.
5. Now, the rules have been created well, andwe may do some tests to verify the routing:
a. PC in LAN1 trace route to 8.8.8.8
console-traceroute
-->
Macintosh-8:~ henrylo$ traceroute 8.8.8.8
traceroute to 8.8.8.8 (8.8.8.8), 64 hops max, 52 byte packets
1 vigor.router (192.168.1.1) 0.350 ms 0.219 ms 0.209 ms
2 h254.s98.ts.hinet.net (168.95.98.254) 37.956 ms 86.617 ms 37.939 ms
The first hop is the gateway for LAN1 clients, and the second hop is the gateway for WAN1.
b. SIP phone clients trace route to 8.8.8.8
console-traceroute
-->
Macintosh-8:~ henrylo$ traceroute 8.8.8.8
traceroute to 8.8.8.8 (8.8.8.8), 64 hops max, 52 byte packets
1 10.20.10.2 (10.20.10.2) 5.351 ms 0.494 ms 0.468 ms
2 h254.s98.ts.hinet.net (168.95.98.254) 37.560 ms 37.446 ms 36.969 ms
The first hop is the gateway for SIP phones, and the second hop is the gateway for WAN1.
c. SIP phone clients trace route to the another internal SIP client
console-traceroute
-->
traceroute to 192.168.11.10 (192.168.11.10), 64 hops max, 52 byte packets
1 10.20.10.2 (10.20.10.2) 0.607 ms 0.435 ms 0.420 ms
2 192.168.11.1 (192.168.11.1) 17.081 ms 16.342 ms 15.383 ms
3 192.168.11.10 (192.168.11.10) 33.723 ms 16.596 ms 16.403 ms
The first hop is the gateway for SIP phones, the second hop is the gateway for WAN5, and the third hop is another internal SIP client.
1. I have more than 1 rules applying to the same LAN client(s), and I want to know how do these rules been respected?
Answer: The first rule (according to the index number) been hit will be applied to the LAN client(s), while the rests will be ignored.
2. What is the priority between Firewall Rule, Inter-LAN Routing, Load-Balance/RoutePolicy, and Static Route?
*: To force traffic go between different LANs with Load-Balance/Route Policy rules, make sure the Inter-LAN Routing policy is configured properly in LAN >> General Setup, so the traffics can go between the LANs.
