Security Gateway Manual XG-7100
• Click to add a new rule at the top of the list
• Configure the rule as follows:
Action
Pass
Interface
LAN
Protocol
Any
Source
LAN net
Destination
The other local subnet, VPN network, or an alias of such networks.
Description
Pass to local and VPN networks
Do not set a gateway on this rule.
• Click Save
• Click Apply Changes
2.7.9 Dynamic DNS
Dynamic DNS provides several benefits for multiple WANs, particularly with VPNs. If the firewall does not already
have one or more Dynamic DNS hostnames configured, consider signing up with a provider and creating one or more.
It’s a good practice to have a separate DNS entry for each WAN and a shared entry for failover, or one per failover
group. If that is not viable, at least have one for the most common needs.
The particulars of configuring Dynamic DNS entries vary by provider and are beyond the scope of this document.
2.7.10 VPN Considerations
IPsec can use a gateway group as an as interface, but needs a dynamic DNS hostname as companion. The remote peer
would need to use the Dynamic DNS hostname as the peer address of this firewall instead of an IP address. Because
this relies on DNS, failover can be slow.
WireGuard does not bind to an interface, but can work with Multi-WAN. It will respond from WAN2 if client contacts
WAN2, but when initiating it will always use the current default gateway. Static routes can nudge traffic for a specific
peer out a specific WAN.
OpenVPN can use a gateway group as an interface for clients or servers. Client behavior is OK and should match
default failover behavior configured on the group. For servers it is better to bind the server to localhost and use port
forwards from each WAN to localhost. Remote clients can then have multiple remote entries and contact each WAN
as needed at any time.
© Copyright 2024 Rubicon Communications LLC 56
To Next Page
Loading...
