My setup is:
Two WAN: PPPoE (ether1)+ DHCP client(ether2)
I configured the PCC load balance and recursive failover.
Everything is working fine, all LAN devices can use both WANs and failover. The only two things that are not working are: Routeros-tool-ping-- cannot ping any IP on internet(also can not check for package update)
Also, I had setup wireguard server that also do not work.
The thing is that the RouterOS can ping the internet only if I add a default route on main routing table.
But then PCC load balance breaks. I tried every solution out there on the internet but nothing fix this.
Posting my configuration here, please have a look and help me.
Code: Select all
/ip firewall mangle print
Flags: X - disabled, I - invalid; D - dynamic
0 D ;;; special dummy rule to show fasttrack counters
chain=prerouting action=passthrough
1 D ;;; special dummy rule to show fasttrack counters
chain=forward action=passthrough
2 D ;;; special dummy rule to show fasttrack counters
chain=postrouting action=passthrough
3 chain=prerouting action=mark-connection new-connection-mark=WAN1 passthrough=yes
connection-state=new connection-mark=no-mark in-interface=pppoe-out1 log=no log-prefix=""
4 chain=prerouting action=mark-connection new-connection-mark=WAN2 passthrough=yes
connection-state=new connection-mark=no-mark in-interface=ether2 log=no log-prefix=""
5 chain=output action=mark-routing new-routing-mark=via-ISP1 passthrough=no
dst-address-type=!local connection-mark=WAN1 log=no log-prefix=""
6 chain=output action=mark-routing new-routing-mark=via-ISP2 passthrough=no
dst-address-type=!local connection-mark=WAN2 log=no log-prefix=""
7 chain=prerouting action=mark-connection new-connection-mark=WAN1 passthrough=yes
connection-state=new dst-address-type=!local connection-mark=no-mark in-interface=bridge
per-connection-classifier=src-address-and-port:2/0 log=no log-prefix=""
8 chain=prerouting action=mark-connection new-connection-mark=WAN2 passthrough=yes
connection-state=new dst-address-type=!local connection-mark=no-mark in-interface=bridge
per-connection-classifier=src-address-and-port:2/1 log=no log-prefix=""
9 chain=prerouting action=mark-routing new-routing-mark=via-ISP1 passthrough=yes
connection-mark=WAN1 in-interface=bridge log=no log-prefix=""
10 chain=prerouting action=mark-routing new-routing-mark=via-ISP2 passthrough=yes
connection-mark=WAN2 in-interface=bridge log=no log-prefix=""
/ip route print
Flags: D - DYNAMIC; I - INACTIVE, A - ACTIVE; c - CONNECT, s - STATIC; H - HW-OFFLOADED
Columns: DST-ADDRESS, GATEWAY, DISTANCE
# DST-ADDRESS GATEWAY DISTANCE
;;; isp2
0 As 1.1.1.1/32 192.168.1.1 1
;;; isp1
1 As 8.8.8.8/32 117.1xx.x.x 1
DAc 10.0.2.0/24 wireguard1 0
DAc 117.1xx.x.x/32 pppoe-out1 0
DAc 172.16.33.0/24 bridge 0
DAc 192.168.1.0/24 ether2 0
DAc 192.168.2.1/32 ether1 0
2 s 0.0.0.0/0 1.1.1.1 2
3 As 0.0.0.0/0 8.8.8.8 1
4 IsH 8.8.8.8/32 8.8.8.8 1
5 As 192.168.2.1/32 192.168.2.1 1
/ip firewall filter print
Flags: X - disabled, I - invalid; D - dynamic
0 D ;;; special dummy rule to show fasttrack counters
chain=forward action=passthrough
1 ;;; allow WireGuard
chain=input action=accept protocol=udp dst-port=13231 log=no log-prefix=""
2 ;;; defconf: accept established,related,untracked
chain=input action=accept connection-state=established,related,untracked
3 ;;; defconf: drop invalid
chain=input action=drop connection-state=invalid
4 ;;; defconf: accept ICMP
chain=input action=accept protocol=icmp
5 ;;; defconf: accept to local loopback (for CAPsMAN)
chain=input action=accept dst-address=127.0.0.1
6 ;;; defconf: drop all not coming from LAN
chain=input action=drop in-interface-list=!LAN
7 ;;; defconf: accept in ipsec policy
chain=forward action=accept ipsec-policy=in,ipsec
8 ;;; defconf: accept out ipsec policy
chain=forward action=accept ipsec-policy=out,ipsec
9 ;;; defconf: fasttrack
chain=forward action=fasttrack-connection hw-offload=yes
connection-state=established,related log=no log-prefix=""
10 ;;; defconf: accept established,related, untracked
chain=forward action=accept connection-state=established,related,untracked
11 ;;; defconf: drop invalid
chain=forward action=drop connection-state=invalid
12 ;;; defconf: drop all from WAN not DSTNATed
chain=forward action=drop connection-state=new connection-nat-state=!dstnat
in-interface-list=WAN 
for @sindy as well 
