hAP AX3 Dual WAN Fallover PCC Internet Issue

deanMK · Sat Jun 24, 2023 9:43 pm

Hi !

I setup this configuration for my Dual ISP, and into console can ping 8.8.8.8 sucessfully, but when connect some device to LAN or WiFi, then show that have internet (notification icon in Win 10), but i basically cant open nothing. Whats wrong with my configuration? Some help?

# 1923-06-24 02:09:31 by RouterOS 7.11beta2
# software id = MGL0-4L4W
#
# model = C53UiG+5HPaxD2HPaxD
# serial number = XXXXXX
/interface bridge
add admin-mac=XXXXXXXXXXX auto-mac=no name=bridge
/interface wifiwave2
# SSID not set
set [ find default-name=wifi1 ] configuration.mode=ap disabled=no
set [ find default-name=wifi2 ] configuration.mode=ap .ssid=MikroTIk-2G \
    disabled=no security.authentication-types=wpa-psk,wpa2-psk .encryption=\
    ccmp
/interface list
add name=WAN
add name=LAN
/ip pool
add name=dhcp_pool1 ranges=192.168.88.2-192.168.88.254
/ip dhcp-server
add address-pool=dhcp_pool1 interface=bridge name=dhcp1
/routing table
add disabled=no fib name=to_ISP1
add disabled=no fib name=to_ISP2
/interface bridge port
add bridge=bridge ingress-filtering=no interface=ether3
add bridge=bridge ingress-filtering=no interface=ether4
add bridge=bridge ingress-filtering=no interface=ether5
add bridge=bridge ingress-filtering=no interface=wifi1
add bridge=bridge ingress-filtering=no interface=wifi2
/ip settings
set allow-fast-path=no
/interface list member
add interface=bridge list=LAN
add interface=ether1 list=WAN
add interface=ether2 list=WAN
/ip address
add address=192.168.88.1/24 interface=bridge network=192.168.88.0
/ip cloud
set ddns-enabled=yes
/ip dhcp-client
add add-default-route=no interface=ether1 use-peer-dns=no use-peer-ntp=no
add add-default-route=no interface=ether2 use-peer-dns=no use-peer-ntp=no
/ip dhcp-server network
add address=192.168.88.0/24 dns-server=192.168.88.1 gateway=192.168.88.1
/ip dns static
add address=192.168.88.1 name=router.lan
/ip firewall address-list
add address=192.168.88.0/24 list=local
/ip firewall mangle
add action=accept chain=prerouting dst-address-list=local in-interface-list=\
    LAN
add action=mark-connection chain=prerouting connection-mark=no-mark \
    connection-state=established,related in-interface=ether1 \
    new-connection-mark=ISP1_conn passthrough=yes
add action=mark-connection chain=prerouting connection-mark=no-mark \
    connection-state=established,related in-interface=ether2 \
    new-connection-mark=ISP2_conn passthrough=yes
add action=mark-connection chain=prerouting connection-mark=no-mark \
    dst-address-type=!local in-interface-list=LAN new-connection-mark=\
    ISP1_conn passthrough=yes per-connection-classifier=\
    both-addresses-and-ports:2/0
add action=mark-connection chain=prerouting connection-mark=no-mark \
    dst-address-type=!local in-interface-list=LAN new-connection-mark=\
    ISP2_conn passthrough=yes per-connection-classifier=\
    both-addresses-and-ports:2/1
add action=mark-routing chain=prerouting connection-mark=ISP1_conn \
    in-interface-list=LAN new-routing-mark=to_ISP1 passthrough=yes
add action=mark-routing chain=prerouting connection-mark=ISP2_conn \
    in-interface-list=LAN new-routing-mark=to_ISP2 passthrough=yes
add action=mark-routing chain=output connection-mark=ISP1_conn \
    dst-address-type=!local new-routing-mark=to_ISP1 passthrough=yes
add action=mark-routing chain=output connection-mark=ISP2_conn \
    dst-address-type=!local new-routing-mark=to_ISP2 passthrough=yes
/ip firewall nat
add action=masquerade chain=srcnat ipsec-policy=out,none out-interface-list=\
    WAN
/ip route
add check-gateway=ping disabled=no distance=1 dst-address=0.0.0.0/0 gateway=\
    192.168.1.1 pref-src="" routing-table=to_ISP1 scope=30 \
    suppress-hw-offload=no target-scope=10
add check-gateway=ping disabled=no distance=2 dst-address=0.0.0.0/0 gateway=\
    192.168.99.1 pref-src="" routing-table=to_ISP2 scope=30 \
    suppress-hw-offload=no target-scope=10
add check-gateway=ping disabled=no distance=1 dst-address=8.8.8.8/32 gateway=\
    192.168.1.1 routing-table=main scope=10 suppress-hw-offload=no \
    target-scope=11
add check-gateway=ping disabled=no distance=2 dst-address=8.8.4.4/32 gateway=\
    192.168.99.1 routing-table=main scope=10 suppress-hw-offload=no \
    target-scope=11

drasked · Sun Jun 25, 2023 12:56 am

Looks mostly correct to me, sure it isn't a DNS issue?

You have 192.168.88.1 set as DNS in your DHCP but i'm missing;

/ip dns
set allow-remote-requests=yes

Also i think your recursive routes aren't correct;

/ip route
add check-gateway=ping disabled=no distance=1 dst-address=0.0.0.0/0 gateway=192.168.1.1 pref-src="" routing-table=to_ISP1 scope=30 suppress-hw-offload=no target-scope=10
add check-gateway=ping disabled=no distance=2 dst-address=0.0.0.0/0 gateway=192.168.99.1 pref-src="" routing-table=to_ISP2 scope=30 suppress-hw-offload=no target-scope=10
add check-gateway=ping disabled=no distance=1 dst-address=8.8.8.8/32 gateway=192.168.1.1 routing-table=main scope=10 suppress-hw-offload=no target-scope=11
add check-gateway=ping disabled=no distance=2 dst-address=8.8.4.4/32 gateway=192.168.99.1 routing-table=main scope=10 suppress-hw-offload=no target-scope=11

gateways should be 8.8.8.8@main and 8.8.4.4@main

Sun Jun 25, 2023 10:04 am

Unrelated question

Is the date export on that first line of your config unedited ?
If so, nice bug.
But my device doesn't show that problem so strange ...

deanMK · Sun Jun 25, 2023 10:34 am

Looks mostly correct to me, sure it isn't a DNS issue?

You have 192.168.88.1 set as DNS in your DHCP but i'm missing;

/ip dns
set allow-remote-requests=yes

Also i think your recursive routes aren't correct;

/ip route
add check-gateway=ping disabled=no distance=1 dst-address=0.0.0.0/0 gateway=192.168.1.1 pref-src="" routing-table=to_ISP1 scope=30 suppress-hw-offload=no target-scope=10
add check-gateway=ping disabled=no distance=2 dst-address=0.0.0.0/0 gateway=192.168.99.1 pref-src="" routing-table=to_ISP2 scope=30 suppress-hw-offload=no target-scope=10
add check-gateway=ping disabled=no distance=1 dst-address=8.8.8.8/32 gateway=192.168.1.1 routing-table=main scope=10 suppress-hw-offload=no target-scope=11
add check-gateway=ping disabled=no distance=2 dst-address=8.8.4.4/32 gateway=192.168.99.1 routing-table=main scope=10 suppress-hw-offload=no target-scope=11

gateways should be 8.8.8.8@main and 8.8.4.4@main

First ISP Lan is 192.168.1.1
Second ISP Lan is 192.168.99.1

Yes i get DNS error into chrome when tryed to load some site. Why 8.8.8.8 need to be gateway? i followed this https://gist.github.com/marfillaster/7a ... e099a1c6a1 (excluding ECMP part rules)

@holvoetn

It showed 1970 year so i edited manually but missed some part or code. Nothing serious.

Amm0 · Sun Jun 25, 2023 5:18 pm

DNS server need to be added too, along with being enabled to listen for requests:
/ip dns set allow-remote-requests=yes servers=9.9.9.9

Also you can use the NTP Client or use "/ip cloud set update-time=yes" to avoid see 1970 as the date.

deanMK · Sun Jun 25, 2023 6:59 pm

Looks mostly correct to me, sure it isn't a DNS issue?

You have 192.168.88.1 set as DNS in your DHCP but i'm missing;

/ip dns
set allow-remote-requests=yes

Also i think your recursive routes aren't correct;

/ip route
add check-gateway=ping disabled=no distance=1 dst-address=0.0.0.0/0 gateway=192.168.1.1 pref-src="" routing-table=to_ISP1 scope=30 suppress-hw-offload=no target-scope=10
add check-gateway=ping disabled=no distance=2 dst-address=0.0.0.0/0 gateway=192.168.99.1 pref-src="" routing-table=to_ISP2 scope=30 suppress-hw-offload=no target-scope=10
add check-gateway=ping disabled=no distance=1 dst-address=8.8.8.8/32 gateway=192.168.1.1 routing-table=main scope=10 suppress-hw-offload=no target-scope=11
add check-gateway=ping disabled=no distance=2 dst-address=8.8.4.4/32 gateway=192.168.99.1 routing-table=main scope=10 suppress-hw-offload=no target-scope=11

gateways should be 8.8.8.8@main and 8.8.4.4@main

hi, again i. I found that when ticked "Allow remote requests" and insert manually 8.8.8.8 and 8.8.4.4 as DNS servers Internet come back and works normally.

About gateways, im not in fault, currently is set like before and works great. Just DNS settings and all is working again.

This is working Dual WAN Load Balance PCC configuration for me RoS 7.11beta2:

# 2023-06-25 17:45:00 by RouterOS 7.11beta2
# software id = MGL0-4L4W
#
# model = C53UiG+5HPaxD2HPaxD
# serial number = XXXXXXXX
/interface bridge
add admin-mac=XXXXXXXXXXX auto-mac=no name=bridge
/interface ethernet
set [ find default-name=ether1 ] comment=WAN1
set [ find default-name=ether2 ] comment=WAN2
/interface wifiwave2
set [ find default-name=wifi1 ] channel.band=5ghz-ax .frequency=2300-7300 \
    .width=20/40/80mhz configuration.mode=ap .ssid=MikroTik-5G disabled=no \
    security.authentication-types=wpa2-psk .encryption=ccmp
set [ find default-name=wifi2 ] channel.band=2ghz-ax .width=20mhz \
    configuration.mode=ap .ssid=MikroTik-2G disabled=no \
    security.authentication-types=wpa2-psk .encryption=ccmp
/interface list
add name=LAN
add name=WAN
/ip pool
add name=pool1 ranges=192.168.88.10-192.168.88.254
/ip dhcp-server
add address-pool=pool1 interface=bridge name=dhcp1
/routing table
add disabled=no fib name=to_ISP1
add disabled=no fib name=to_ISP2
/interface bridge port
add bridge=bridge ingress-filtering=no interface=ether3
add bridge=bridge ingress-filtering=no interface=ether4
add bridge=bridge ingress-filtering=no interface=ether5
add bridge=bridge ingress-filtering=no interface=wifi1
add bridge=bridge ingress-filtering=no interface=wifi2
/ip neighbor discovery-settings
set discover-interface-list=!dynamic
/ip settings
set allow-fast-path=no
/interface list member
add interface=bridge list=LAN
add interface=ether1 list=WAN
add interface=ether2 list=WAN
/ip address
add address=192.168.88.1/24 interface=bridge network=192.168.88.0
/ip dhcp-client
add add-default-route=no interface=ether1 use-peer-dns=no use-peer-ntp=no
add add-default-route=no interface=ether2 use-peer-dns=no use-peer-ntp=no
/ip dhcp-server network
add address=192.168.88.0/24 dns-server=192.168.88.1 gateway=192.168.88.1
/ip dns
set allow-remote-requests=yes servers=8.8.8.8,8.8.4.4
/ip dns static
add address=192.168.88.1 name=router.lan
/ip firewall address-list
add address=192.168.88.0/24 list=local
/ip firewall mangle
add action=accept chain=prerouting dst-address-list=local in-interface-list=\
    LAN
add action=mark-connection chain=prerouting comment="WAN to LAN" \
    connection-mark=no-mark connection-state=established,related \
    in-interface=ether1 new-connection-mark=ISP1_conn passthrough=yes
add action=mark-connection chain=prerouting connection-mark=no-mark \
    connection-state=established,related in-interface=ether2 \
    new-connection-mark=ISP2_conn passthrough=yes
add action=mark-connection chain=prerouting comment="PCC Rules" \
    connection-mark=no-mark dst-address-list=!local dst-address-type=!local \
    new-connection-mark=ISP1_conn passthrough=yes per-connection-classifier=\
    both-addresses-and-ports:2/0
add action=mark-connection chain=prerouting connection-mark=no-mark \
    dst-address-list=!local dst-address-type=!local new-connection-mark=\
    ISP2_conn passthrough=yes per-connection-classifier=\
    both-addresses-and-ports:2/1
add action=mark-routing chain=prerouting connection-mark=ISP1_conn \
    in-interface-list=LAN new-routing-mark=to_ISP1 passthrough=yes
add action=mark-routing chain=prerouting connection-mark=ISP2_conn \
    in-interface-list=LAN new-routing-mark=to_ISP2 passthrough=yes
add action=mark-routing chain=output connection-mark=ISP1_conn \
    dst-address-list=!local new-routing-mark=to_ISP1 passthrough=yes
add action=mark-routing chain=output connection-mark=ISP2_conn \
    dst-address-list=!local new-routing-mark=to_ISP2 passthrough=yes
/ip firewall nat
add action=masquerade chain=srcnat ipsec-policy=out,none out-interface-list=\
    WAN
/ip route
add check-gateway=ping disabled=no dst-address=0.0.0.0/0 gateway=192.168.1.1 \
    routing-table=to_ISP1 suppress-hw-offload=no
add check-gateway=ping disabled=no dst-address=0.0.0.0/0 gateway=192.168.99.1 \
    routing-table=to_ISP2 suppress-hw-offload=no
add check-gateway=ping disabled=no distance=1 dst-address=0.0.0.0/0 gateway=\
    192.168.1.1 pref-src="" routing-table=main scope=30 suppress-hw-offload=\
    no target-scope=10
add check-gateway=ping disabled=no distance=2 dst-address=0.0.0.0/0 gateway=\
    192.168.99.1 pref-src="" routing-table=main scope=30 suppress-hw-offload=\
    no target-scope=10

Problem Solved !

bakkarm · Sat Dec 23, 2023 12:28 am

Dear deanMK,

I followed your script to setup Dual-WAN fail-over on my router hAP ax3, but no luck
Internet is active only on ether1 port. Once I disconnect the cable from port 1, nothing failover to ether2. And, I have no internet access

Please help me out configure my router. I am new to this routers and searched everywhere to configure it without any luck

Thank you and waiting for your kind reply

Majed

anav · Sat Dec 23, 2023 3:24 pm

Post your config, or do you think we can read your mind and know what errors you have made without evidence??

hAP AX3 Dual WAN Fallover PCC Internet Issue [SOLVED]

hAP AX3 Dual WAN Fallover PCC Internet Issue

Re: hAP AX3 Dual WAN Fallover PCC Internet Issue

Re: hAP AX3 Dual WAN Fallover PCC Internet Issue

Re: hAP AX3 Dual WAN Fallover PCC Internet Issue

Re: hAP AX3 Dual WAN Fallover PCC Internet Issue

Re: hAP AX3 Dual WAN Fallover PCC Internet Issue [SOLVED]

Re: hAP AX3 Dual WAN Fallover PCC Internet Issue

Re: hAP AX3 Dual WAN Fallover PCC Internet Issue