fast track working for LAN but not WAN

ahmet82 · Wed Dec 25, 2024 4:58 pm

I have 2 WAN connectıons. I used to use mangle rules for load balancing. This limited my fasttrack capabilities naturally. So I removed all mangle rules and converted to load balancing through routes.

/ip route
add distance=1 dst-address=8.8.4.4/32 gateway=192.168.10.1 scope=10
add blackhole distance=20 dst-address=8.8.4.4/32
add distance=1 dst-address=8.8.8.8/32 gateway=192.168.20.1 scope=10
add blackhole distance=20 dst-address=8.8.8.8/32
add distance=1 dst-address=208.67.220.220/32 gateway=192.168.1.40 scope=10
add blackhole distance=20 dst-address=208.67.220.220/32
add distance=1 dst-address=208.67.222.222/32 gateway=192.168.1.30 scope=10
add blackhole distance=20 dst-address=208.67.222.222/32
add check-gateway=ping disabled=no distance=1 dst-address=0.0.0.0/0 gateway=208.67.222.222 routing-table=main scope=30 \
    suppress-hw-offload=no target-scope=11
add check-gateway=ping disabled=no distance=1 dst-address=0.0.0.0/0 gateway=208.67.220.220 routing-table=main scope=30 \
    suppress-hw-offload=no target-scope=11
add check-gateway=ping disabled=no distance=2 dst-address=0.0.0.0/0 gateway=8.8.8.8 routing-table=main scope=30 \
    suppress-hw-offload=no target-scope=11
add check-gateway=ping disabled=no distance=2 dst-address=0.0.0.0/0 gateway=8.8.4.4 routing-table=main scope=30 \
    suppress-hw-offload=no target-scope=11

The load balancing works. However it only works with a specific fasttrack configraiton. If I keep it like this, it does fasttrack but only for LAN (as expected)

add action=fasttrack-connection chain=forward comment="fasttrack all communication from device networks" connection-state=\
    established,related dst-address-list=FIBER-INTERNET-LIST hw-offload=yes log-prefix=DEVICE-NETWORKS src-address-list=\
    FIBER-INTERNET-LIST
add action=accept chain=forward comment="defconf: accept established,related, untracked" connection-state=\
    established,related,untracked

if I remove dst-address-list=FIBER-INTERNET-LIST and src-address-list=\FIBER-INTERNET-LIST my network slows down so much that it is apperant that there is a problem. So effectively it breaks. Does anyone know why? I thought fasttrack could also work for WAN connections. Is it only meant to be for LAN?

My mangle rules are empty
my address list is as below

add address=10.4.0.0/16 list=FIBER-INTERNET-LIST
add address=10.5.0.0/16 list=FIBER-INTERNET-LIST
add address=10.6.0.0/16 list=FIBER-INTERNET-LIST

sindy · Wed Dec 25, 2024 6:16 pm

What is your device model, i.e. does it actually support routing in hardware?

WAN<->LAN traffic can normally indeed be fasttracked, and fasttracking is indeed compatible with ECMP load balancing, so one thing to come to my mind is that ECMP in hardware might not work on your device, as the table in the documentation regarding L3HW indicates some ECMP limitations for one group of device models and is totally silent about ECMP for another group.

Another thing is that your routing configuration is a bit incomprehensible to me. You mention two WANs but your /32 routes use 4 distinct gateways. Normally, I would set one Google DNS address and one OpenDNS one as the canaries for each WAN, both with the same gateway, and I would set the same distance for all the default routes using the individual canaries as gateway addreses. Maybe it is just an incorrect obfuscation because the gateway addresses are public ones?

I do realize that if the issue is this, it should affect also the traffic that is not fasttracked, but so far I cannot see any reason why allowing fasttracking for all the traffic should have such a detrimental effect on your router's throughput.

ahmet82 · Wed Dec 25, 2024 6:55 pm

What is your device model, i.e. does it actually support routing in hardware?

I have a RB 5009

Another thing is that your routing configuration is a bit incomprehensible to me. You mention two WANs but your /32 routes use 4 distinct gateways. Normally, I would set one Google DNS address and one OpenDNS one as the canaries for each WAN, both with the same gateway, and I would set the same distance for all the default routes using the individual canaries as gateway addreses. Maybe it is just an incorrect obfuscation because the gateway addresses are public ones?

Before I had 4 WANs. But I stopped using 2 of them. I just forgot to remove the routing rules. So you are right about it.

I want to use fasttrack mainly because of the LAN traffic. I have lots of cameras that use inter VLAN routing, and I also want to have some firewall rules being applied. Before fasttrack, CPU utilizaiton was a lot. So just by getting LAN fasttrack to work, I actually increased to the performance I need.

Having said that I was curious, why I have issues with fasttracking WAN connections. I was thinking that it would work pretty much the same.

sindy · Wed Dec 25, 2024 7:29 pm

I have a RB 5009

OK, so we may completely forget about the L3HW as a possible cause.

Having said that I was curious, why I have issues with fasttracking WAN connections. I was thinking that it would work pretty much the same.

At the moment I can only say that I am curious too, as it makes little sense to me so far. Can you post the complete configuration export, of course after obfuscating the identifying details?

fast track working for LAN but not WAN

fast track working for LAN but not WAN

Re: fast track working for LAN but not WAN

Re: fast track working for LAN but not WAN

Re: fast track working for LAN but not WAN

Who is online