Need suggestions: "easy" alternative to some sort of high availability config for my case?

wireless · March 5, 2025, 11:00am

Hi,
I would like to implement the config in the picture, where router_2 should manage the network in case router_1 fails for some reason.
Each router has its own UPS; router_2 wifi is off to simplify.

With "manage" I mean DHCP, DNS (need more?) and also remote access via a backup wireguard network (via wireguard interface on the router_2 itself). Please note that this backup wireguard network is completely indipendent from the primary one (on router_1) and might be used even if the router_1 is ok but the main wireguard network does not work for some reason.

I know that this solution has some limits (first one: the ISP modem as a single point of failure) but actually I mainly need to solve the router_1 eventually fails.
I've seen the forum page about the high availability https://openwrt.org/docs/guide-user/network/high-availability (is it updated?), but I the solution proposed seems to be advanced for me and the risk to block the network - we work from home too - seems to high.

Considering that my network structure is enough stable, my idea is:

config router_1 in a way that it informs the hosts about two dhcp/dns server on the network (172.16.1.1 and 172.16.1.2)
copy the main config file (static ip, internal domain name/address... what else) from router_1 to router_2.
This two step may be automatize via rsync or other tools, to avoid to copy configs once/twice a year.

What do you think about this approach? What risks might it introduce?

slh · March 5, 2025, 11:34am

For the most part it introduces additional complexity, without any gain of reliability - imho rather to the contrary.

Simple litmus test:

ISP connection goes down (the proverbial excavator, it happens, twice for me last year(
ISP router goes down

What gains do you expect from your two OpenWrt routers in either of these cases, which are more likely than the OpenWrt router having problems - and in cases of misconfiguration, your doubled routers aren't likely to help either.

wireless · March 5, 2025, 11:54am

Router_1 has a less powered UPS (long story).
VPN_1@Router_1 may not work.

I'm playing a little but the "easy" solution I propose seems not so easy too, I'm not sure how router_2 can have it's own ip (given by router_1) as a dhcp client and act as a server on need.

Actually I have the following config but VPN_2@Router_2 do not allow me to reach the home subnet, it seems to not forward the traffic...

root@ar150:/# cat /etc/config/dhcp 

config dnsmasq
        option domainneeded '1'
        option localise_queries '1'
        option rebind_protection '1'
        option rebind_localhost '1'
        option local '/lan/'
        option domain 'lan'
        option expandhosts '1'
        option readethers '1'
        option leasefile '/tmp/dhcp.leases'
        option resolvfile '/tmp/resolv.conf.d/resolv.conf.auto'
        option localservice '1'

config dhcp 'lan'
        option interface 'lan'
        option start '100'
        option limit '150'
        option leasetime '12h'
        option dhcpv6 'hybrid'
        option ra 'hybrid'
        option dns_service '0'

config dhcp 'wan'
        option interface 'wan'
        option ignore '1'

config odhcpd 'odhcpd'
        option maindhcp '0'
        option leasefile '/tmp/hosts/odhcpd'
        option leasetrigger '/usr/sbin/odhcpd-update'
        option loglevel '4'

root@ar150:/# cat /etc/config/network 

config interface 'loopback'
        option proto 'static'
        option ipaddr '127.0.0.1'
        option netmask '255.0.0.0'
        option device 'lo'

config globals 'globals'
        option ula_prefix 'fd65:15e0:8d75::/48'
        option packet_steering '1'

config interface 'wan'
        option proto 'dhcp'
        option device 'eth0'

config interface 'lan'
        option proto 'dhcp'
        option device 'eth1'

config interface 'wan6'
        option proto 'dhcpv6'
        option device 'eth0'
        option auto '0'
        option reqaddress 'try'
        option reqprefix 'auto'
        option norelease '1'

config interface 'wg_backup'
        option proto 'wireguard'
        option delegate '0'
        list addresses '10.234.0.2/32'
        option private_key EDITED

config wireguard_wg_backup
        option description 'VPS1'
        option endpoint_host EDITED
        option preshared_key EDITED
        option route_allowed_ips '1'
        option persistent_keepalive '25'
        option public_key EDITED
        list allowed_ips '10.234.0.1/32'
        list allowed_ips '10.234.0.3/32'
        option endpoint_port EDITED

config device
        option name 'br-lan'
        option type 'bridge'
        list ports 'eth0'

slh · March 5, 2025, 12:37pm

Do yourself a favour, get one router that is 100% reliable and sufficient for your needs all of the time, under all circumstances. If you want a fallback at home, keep a cold-spare (just switch two cables in case of problems, if labelled correctly, your family shouldn't have any problems with that either, should the need arise). Everything else is just part of the fleet, APs etc.

HA is possible, even with OpenWrt (including real HA), but you really need to dive into the topic and make it your job - and it doesn't make sense, unless you really meet the conditions (multiple independent WAN connections, no ISP router in the way, dual-PSU devices, etc.). It's all possible, just complicated - and expensive, both in terms of capable devices and running costs (idle power consumption). If you lose thousands every minute of downtime, it's worth it - for all other cases you're much better suited by keeping it low-key and re-plugging two cables (bonus points if you make it idiot safe, colour matched cables, logical arrangement, etc.). In a typical home environment 10 minutes downtime once in a blue moon just aren't that much of a problem, to go through trouble and expenses for HA (and half-assed HA is no improvement).

wireless · March 5, 2025, 1:06pm

slh, thanks for the answering (it is not the first time you help me and I really appreciate it).
I understood that this config it is very difficult.
I need to manage my home network from remote if I'm away for days, it is not a question of ten minutes.
While my main router might be easily disabled by anybody, the second one is hidden.
Cant describe here all the considerations caused to finally evaluate this approach.
By the way, maybe I'm too newbie to do it.