Bonding/joining 2x VDSL/FTTC lines

Not so much a question but more a "I've done this and it works". I thought I'd share what I've found out on here as I never saw too much on the subject by reading or found many people that had done this.

In a nutshell, I've bonded two separate internet connections together and am achieving not too far off twice the speed. Both lines sync at the full 80/20mbps and are with Zen internet. These connections are effectively bonded and not load balanced (a single connection can achieve full speed).

https://www.thinkbroadband.com/speedtest/16078698842...

On the home side, I'm using the Zen supplied Fritz!box router/modems (using my own AC68U for WLAN) and running some software called openmtcprouter on a Core2 Duo powered Dell Optiplex 780 (can be picked up off ebay for <£50). I'm then using a VPS rented from Digital Ocean to join the connections back together out on the internet.

Setup was suprisingly easy. Just really a case of having each modem on its own subnet, running the openmtcprouter installation script on the VPS and adding in the details into your local openmtcprouter machine (based on OpenWRT so has a nice web-based UI).

Plus points:
* Little overhead
* Very easy to setup with some basic networking knowledge (if you know what a subnet is and SSH to a Linux machine, you'll be just fine).
* Works well "out the box"
* Little impact on latency (gaming seems fine)

Bad points:
* Expensive - Two broadband lines are an expensive and might not be an option for some. The VPS is about $5 a month and gives 1TB of usage.
* The connection seems to take a little time to max out both connections so it's not quite as good as having a single connection of the same speed.
* It does work with mobile broadband but the slightly up and down non-consistent nature does hurt performance and reliability.
* Some websites don't like you browsing from server IP addresses (especially Digital Ocean) so may block access or trigger CAPTCHA.

Hopefully this is of interest to some of you or perhaps you may even have some suggestions.

Edited by deleted (Sun 13-Dec-20 14:58:21)

I see more exploit attempts against my web servers originating from Digital Ocean IP address ranges than any other source and I also see frequent port scans. I do have some IP ranges permanently blocked. I suspect I'm not alone in that respect.

In reply to a post by Benjanyan:

* Some websites don't like you browsing from server IP addresses (especially Digital Ocean) so may block access or trigger CAPTCHA.

I've seen the same from other VPS and hosting suppliers, even the expensive corporate services such as AWS or Azure.

One option is to get your server to connect to an L2TP tunnel from AAISP, but it is capped at 100 Mb/s which may not help your case as you have 2x 80 VDSL.

https://www.aa.net.uk/broadband/l2tp-service/

Maybe try Mythic Beasts, I'm doing similar to you but using peplink Speedfusion.

I did use openmptcprouter but my lines are a fair bit worse than yours and I had issues around the way it uses VPN's to transport UDP but Proxies TCP through shadowsocks, It's particularly troublesome if you want to use IPv6 as some traffic come from the VPS IP and some comes from the subnet behind it.

*I Believe it now supports v2ray for both TCP/UDP but when I last used it that was only available in beta and it didn't work for me.

Also Mythic will probably give you a proper routed V6 subnet if you ask them.

Edited by dragon2611 (Mon 14-Dec-20 14:30:31)

Yes, DO have a bad reputation when reacting to abuse reports from what I've heard so I guess that explains why to a degree. It's unfortunate as you will catch legitimate users when blocking ranges.

That aside, the performance vs. value of their VPS is the best I've come across so far out of the handful I've tried.

Not heard of that company but will check them out perhaps. They're about twice the price though at first glance. I've tried a few others but DO has had them all beat on throughput and latency.

Not tried using IPv6 or any UDP based VPN (as far as benchmarking - they connect and work) so far with this setup yet.

I find that MPTCP and UDP had a number of issues. For example using the L2TP to AAISP prior to MPTCP had a huge perf penalty due to the MTU issues and the load balancing algorithms. Putting L2TP on the VPS has it's own problems as you can't easily QoS that end without another router and is very inflexible that end. In any case, OMR seems to work best with OpenVPN pipes as most of our [censored] ISPs in the UK don't actually support MPTCP (the entire path needs to), so it's best to find other solutions.

Some other alternatives, YMMV, as it depends what you want to do: just Internet access, or Site to Site mesh VPN:

1. ZeroTier means you can have a far more lightweight solution that runs on another core node of your choosing and proper mesh VPNing and allows bonding of VPN links in recent versions

2. Tinc will allow full L2 mesh VPN, that is effectively the same as ZeroTier minus routing abilities, or like a specially configured OpenVPN, and you'd have to manage loadbalancing yourself via a Linux bond (not a problem when both lines are the same), more a prob if bonding say DSL and 5G as it's bonkers asymmetric.

3. Use DMVPN, which is how Cisco manages Hub & Spoke mesh VPNs. You'll need a proper router like VyOS to do this though.

4. FlexiWAN is another OpenSource SD-WAN solution, free for up to 3 sites, which will use DPDK and other much more modern packet processors.

SD-WAN is what to look out for but is still not really ready for enterprise robustness, but sooner rather than later there'll be a kick-ass open source solution that dominates them all, as they're all bitpart proprietary nonsense like peplink right now.

AAISP L2TP is great, and you can 2 of them and bond them if you want > 100mbps, but a little expensive. In fact getting 2 AAISP lines providing the full FTTC is actually one of the cheapest bonding solutions in the UK, even if their individual lines are expensive. AAISP should bump that 100mbps limitation of L2TP, but the xl2tpd configuration in Linux leaves a lot to be desired, and isn't easily managed as Linux's PPP stack doesn't really handle L2TPv2 properly.