Creating a low-cost, full feature dual WAN (load balance or fail-over) firewall.

I'm in love...

I guess I should qualify that statement. I've been working on finding a firewall to deploy to our customers. 

Gradually more and more of our customers want or need 2 ADSL lines for fail-over and/or VoIP traffic quality purposes. So the task was to find a robust router that importantly wasn't going to be deprecated or discontinued for a fair while so we could standardise on it. Our problem recently with low end ADSL routers is that we'd find a nice one, then after a few months we wouldn't be able to buy it anymore.

So low cost and sophisticated enough to do :-

• Dual WAN failover - in both directions.
• Ability to chose what traffic leaves which WAN interface. i.e. LAN to WAN/WAN2 control.
• Standard firewall filtering
• NAT and 1-1 NAT
• Port forwarding and port mapping
• Static routes

We bought a Netgear Dual WAN router to investigate the commercial dual WAN routers, as we have had good experiences with their equipment. However on testing it didn't quite do everything I wanted. Particularly be able to choose the exit route of different traffic on our network. It also left me worried that choosing a commercial solution would leave us open to having the product changed or upgraded.

We've been a fan of IPCop's for a long time as we've always found that standard firewall routers have either lacked features or been out of the range of the SME budget. For those customers that have needed a featured firewall we've always used IPCop's. Using an old PC or a new mini-ATX PC and putting IPCop on it has made our lives much nicer in the last 5 years. However IPCop doesn't support dual WAN and there was nothing on the roadmap to suggest it was going to be implemented. The other thing was that being hard drive based, IPCop's are always going to be more prone to failure than an embedded firewall due to the mechanical nature of hard drives. We'd considered putting IPCop on CF-cards, but figured that since they weren't optimised for flash based drives, that the OS would rapidly wear the drive out.

However there is the dual-WAN capable pfsense, and after checking out a virtual appliance and being suitable happy with it, I decided to buy an ALIX embedded PC. This company sells them with m0n0wall or pfsense pre-loaded so I bought 2 for testing and waited for it to arrive.