Port Forward not working with PCC Load Balancing

netbits · Thu May 09, 2013 5:46 pm

I'm trying to setup a port forward rule with my pcc setup, but its not working 100%. My port forwards are working through WAN1, but not through WAN2 or WAN3. It only works through WAN2 when I disable WAN1. I'm a bit of noob when it comes to this sort of routing, so any help would be awesome.

My config is as follows:

/ip firewall mangle
add chain=input in-interface=WAN1 action=mark-connection new-connection-mark=WAN1_conn
add chain=input in-interface=WAN2 action=mark-connection new-connection-mark=WAN2_conn
add chain=input in-interface=WAN3 action=mark-connection new-connection-mark=WAN3_conn

add chain=output connection-mark=WAN1_conn action=mark-routing new-routing-mark=to_WAN1
add chain=output connection-mark=WAN2_conn action=mark-routing new-routing-mark=to_WAN2
add chain=output connection-mark=WAN3_conn action=mark-routing new-routing-mark=to_WAN3

add chain=prerouting dst-address=10.1.1.0/30 action=accept in-interface=17216
add chain=prerouting dst-address=10.2.2.0/30 action=accept in-interface=17216
add chain=prerouting dst-address=10.3.3.0/30 action=accept in-interface=17216

add chain=prerouting dst-address-type=!local in-interface=17216 per-connection-classifier=both-addresses-and-ports:3/0 action=mark-connection new-connection-mark=WAN1_conn passthrough=yes
add chain=prerouting dst-address-type=!local in-interface=17216 per-connection-classifier=both-addresses-and-ports:3/1 action=mark-connection new-connection-mark=WAN2_conn passthrough=yes
add chain=prerouting dst-address-type=!local in-interface=17216 per-connection-classifier=both-addresses-and-ports:3/2 action=mark-connection new-connection-mark=WAN3_conn passthrough=yes

add chain=prerouting connection-mark=WAN1_conn in-interface=17216 action=mark-routing new-routing-mark=to_WAN1
add chain=prerouting connection-mark=WAN2_conn in-interface=17216 action=mark-routing new-routing-mark=to_WAN2
add chain=prerouting connection-mark=WAN3_conn in-interface=17216 action=mark-routing new-routing-mark=to_WAN3


/ip route
add dst-address=0.0.0.0/0 gateway=10.1.1.1 routing-mark=to_WAN1 check-gateway=ping
add dst-address=0.0.0.0/0 gateway=10.2.2.1 routing-mark=to_WAN2 check-gateway=ping
add dst-address=0.0.0.0/0 gateway=10.3.3.1 routing-mark=to_WAN3 check-gateway=ping

add dst-address=0.0.0.0/0 gateway=10.1.1.1 distance=1 check-gateway=ping
add dst-address=0.0.0.0/0 gateway=10.2.2.1 distance=2 check-gateway=ping
add dst-address=0.0.0.0/0 gateway=10.3.3.1 distance=3 check-gateway=ping


/ip firewall nat
add chain=srcnat out-interface=WAN1 action=masquerade
add chain=srcnat out-interface=WAN2 action=masquerade
add chain=srcnat out-interface=WAN3 action=masquerade

add action=dst-nat chain=dstnat dst-port=80,10000 in-interface=WAN1 protocol=tcp to-addresses=172.16.0.2
add action=dst-nat chain=dstnat dst-port=80,6802,6803 in-interface=WAN2 protocol=tcp to-addresses=172.16.10.200
add action=dst-nat chain=dstnat dst-port=25,143,1111,22,110 in-interface=WAN3 protocol=tcp to-addresses=172.16.10.100

netbits · Fri May 10, 2013 12:49 pm

From what I understand I'm missing something or something is not right in my marketing. Can someone please help me?

CelticComms · Fri May 10, 2013 5:18 pm

This input chain and output chain rules are affecting traffic to/from the router itself - do you realize that? e.g. Input/output does not refer to traffic WAN<>LAN.

netbits · Fri May 10, 2013 6:20 pm

So how would I fix it?

cicserver · Mon May 13, 2013 11:12 am

I am also using port forwarding with PCC and it works without any difficulty,
I have dual wan PCC setup. its something like below . . .

DSL1 |
| >>>> RB750 as PCC >>>> RB450G as pppoe server >>> Users
DSL2 |

I wanted to access RB450g Web server (which is running on port 1234)
First I created port forwarding rule on DSL which forward port 1234 to RB750, and I have added following dst-nat rule as below on RB750.

/ip firewall nat
add action=dst-nat chain=dstnat disabled=no dst-port=1234 in-interface=WAN1 protocol=tcp to-addresses=192.168.5.3 to-ports=1234
add action=dst-nat chain=dstnat disabled=no dst-port=1234 in-interface=WAN2 protocol=tcp to-addresses=192.168.5.3 to-ports=1234

192.168.5.3 is RB450G IP address.

Now when I try to access public ip of dsl1 , it simply forward my request to rb750, which again forward it to RB405G and its working fine for me

netbits · Mon May 13, 2013 10:42 pm

I've revised my config and still can't get my port forward to work to work on all the lines.

Here is my setup:

[admin@Core Router] > /ip address print 
Flags: X - disabled, I - invalid, D - dynamic
 #   ADDRESS            NETWORK         INTERFACE
 0   172.16.0.1/16      172.16.0.0      17216
 1   172.17.0.1/16      172.17.0.0      17217
 2   10.1.1.2/29        10.1.1.0        WAN1
 3   10.2.2.2/29        10.2.2.0        WAN2
 4   10.3.3.2/29        10.3.3.0        WAN3

/ip route print detail 
Flags: X - disabled, A - active, D - dynamic, C - connect, S - static, r - rip, b - bgp, o - ospf, m - mme, B - blackhole, U - unreachable, P - prohibit 
 0 A S  dst-address=0.0.0.0/0 gateway=10.1.1.1 gateway-status=10.1.1.1 reachable via  WAN1 check-gateway=ping distance=1 scope=30 target-scope=10 routing-mark=to_WAN1 
 1 A S  dst-address=0.0.0.0/0 gateway=10.2.2.1 gateway-status=10.2.2.1 reachable via  WAN2 check-gateway=ping distance=1 scope=30 target-scope=10 routing-mark=to_WAN2 
 2   S  dst-address=0.0.0.0/0 gateway=10.3.3.1 gateway-status=10.3.3.1 unreachable check-gateway=ping distance=1 scope=30 target-scope=10 routing-mark=to_WAN3 
 3 A S  dst-address=0.0.0.0/0 gateway=10.1.1.1 gateway-status=10.1.1.1 reachable via  WAN1 check-gateway=ping distance=1 scope=30 target-scope=10 
 4   S  dst-address=0.0.0.0/0 gateway=10.2.2.1 gateway-status=10.2.2.1 reachable via  WAN2 check-gateway=ping distance=2 scope=30 target-scope=10 
 5   S  dst-address=0.0.0.0/0 gateway=10.3.3.1 gateway-status=10.3.3.1 unreachable check-gateway=ping distance=3 scope=30 target-scope=10 
 6 ADC  dst-address=10.1.1.0/29 pref-src=10.1.1.2 gateway=WAN1 gateway-status=WAN1 reachable distance=0 scope=10 
 7 ADC  dst-address=10.2.2.0/29 pref-src=10.2.2.2 gateway=WAN2 gateway-status=WAN2 reachable distance=0 scope=10 
 8  DC  dst-address=10.3.3.0/29 pref-src=10.3.3.2 gateway=WAN3 gateway-status=WAN3 unreachable distance=0 scope=255 
 9 ADC  dst-address=172.16.0.0/16 pref-src=172.16.0.1 gateway=17216 gateway-status=17216 reachable distance=0 scope=10 
10 ADC  dst-address=172.17.0.0/16 pref-src=172.17.0.1 gateway=17217 gateway-status=17217 reachable distance=0 scope=10

/ip firewall mangle print
Flags: X - disabled, I - invalid, D - dynamic 
 0   chain=output action=mark-routing new-routing-mark=to_WAN1 passthrough=yes connection-mark=WAN1_conn 
 1   chain=output action=mark-routing new-routing-mark=to_WAN2 passthrough=yes connection-mark=WAN2_conn 
 2   chain=output action=mark-routing new-routing-mark=to_WAN3 passthrough=yes connection-mark=WAN3_conn 
 3   chain=prerouting action=accept dst-address=10.1.1.0/29 in-interface=17216 
 4   chain=prerouting action=accept dst-address=10.2.2.0/29 in-interface=17216 
 5   chain=prerouting action=accept dst-address=10.3.3.0/29 in-interface=17216 
 6   chain=prerouting action=accept dst-address=10.1.1.0/29 in-interface=17217 
 7   chain=prerouting action=accept dst-address=10.2.2.0/29 in-interface=17217 
 8   chain=prerouting action=accept dst-address=10.3.3.0/29 in-interface=17217 
 9   chain=input action=mark-connection new-connection-mark=WAN1_conn passthrough=yes in-interface=WAN1 connection-mark=no-mark 
10   chain=input action=mark-connection new-connection-mark=WAN2_conn passthrough=yes in-interface=WAN2 connection-mark=no-mark 
11   chain=input action=mark-connection new-connection-mark=WAN3_conn passthrough=yes in-interface=WAN3 connection-mark=no-mark 
12   chain=prerouting action=mark-connection new-connection-mark=WAN1_conn passthrough=yes dst-address-type=!local in-interface=17216 connection-mark=no-mark per-connection-classifier=both-addresses:3/0 
13   chain=prerouting action=mark-connection new-connection-mark=WAN2_conn passthrough=yes dst-address-type=!local in-interface=17216 connection-mark=no-mark per-connection-classifier=both-addresses:3/1 
14   chain=prerouting action=mark-connection new-connection-mark=WAN3_conn passthrough=yes dst-address-type=!local in-interface=17216 connection-mark=no-mark per-connection-classifier=both-addresses:3/2 
15   chain=prerouting action=mark-connection new-connection-mark=WAN1_conn passthrough=yes dst-address-type=!local in-interface=17217 connection-mark=no-mark per-connection-classifier=both-addresses:3/0 
16   chain=prerouting action=mark-connection new-connection-mark=WAN2_conn passthrough=yes dst-address-type=!local in-interface=17217 connection-mark=no-mark per-connection-classifier=both-addresses:3/1 
17   chain=prerouting action=mark-connection new-connection-mark=WAN3_conn passthrough=yes dst-address-type=!local in-interface=17217 connection-mark=no-mark per-connection-classifier=both-addresses:3/2 
18   chain=prerouting action=mark-routing new-routing-mark=to_WAN1 passthrough=yes in-interface=17216 connection-mark=WAN1_conn 
19   chain=prerouting action=mark-routing new-routing-mark=to_WAN2 passthrough=yes in-interface=17216 connection-mark=WAN2_conn 
20   chain=prerouting action=mark-routing new-routing-mark=to_WAN3 passthrough=yes in-interface=17216 connection-mark=WAN3_conn 
21   chain=prerouting action=mark-routing new-routing-mark=to_WAN1 passthrough=yes in-interface=17217 connection-mark=WAN1_conn 
22   chain=prerouting action=mark-routing new-routing-mark=to_WAN2 passthrough=yes in-interface=17217 connection-mark=WAN2_conn 
23   chain=prerouting action=mark-routing new-routing-mark=to_WAN3 passthrough=yes in-interface=17217 connection-mark=WAN3_conn

 /ip firewall nat print
Flags: X - disabled, I - invalid, D - dynamic 
 0   ;;; NAT:
     chain=srcnat action=masquerade out-interface=WAN1 
 1   chain=srcnat action=masquerade out-interface=WAN2 
 2   chain=srcnat action=masquerade out-interface=WAN3 
 3   ;;; WAN1 Port Forwards:
     chain=dstnat action=dst-nat to-addresses=172.16.0.2 to-ports=80 protocol=tcp in-interface=WAN1 dst-port=80 
 4   chain=dstnat action=dst-nat to-addresses=172.16.0.2 to-ports=10000 protocol=tcp in-interface=WAN1 dst-port=10000 
 5   chain=dstnat action=dst-nat to-addresses=172.16.10.200 to-ports=6802 protocol=tcp in-interface=WAN1 dst-port=6802 
 6   chain=dstnat action=dst-nat to-addresses=172.16.10.200 to-ports=6803 protocol=tcp in-interface=WAN1 dst-port=6803 
 7   ;;; WAN2 Port Forwards:
     chain=dstnat action=dst-nat to-addresses=172.16.10.200 to-ports=80 protocol=tcp in-interface=WAN2 dst-port=80 
 8   chain=dstnat action=dst-nat to-addresses=172.16.10.200 to-ports=6802 protocol=tcp in-interface=WAN2 dst-port=6802 
 9   chain=dstnat action=dst-nat to-addresses=172.16.10.200 to-ports=6803 protocol=tcp in-interface=WAN2 dst-port=6803 
10   ;;; WAN3 Port Forwards:
     chain=dstnat action=dst-nat to-addresses=172.16.10.100 to-ports=25 protocol=tcp in-interface=WAN3 dst-port=25 
11   chain=dstnat action=dst-nat to-addresses=172.16.10.100 to-ports=143 protocol=tcp in-interface=WAN3 dst-port=143 
12   chain=dstnat action=dst-nat to-addresses=172.16.10.100 to-ports=1111 protocol=tcp in-interface=WAN3 dst-port=1111 
13   chain=dstnat action=dst-nat to-addresses=172.16.10.100 to-ports=22 protocol=tcp in-interface=WAN3 dst-port=22 
14   chain=dstnat action=dst-nat to-addresses=172.16.10.100 to-ports=110 protocol=tcp in-interface=WAN3 dst-port=110

I followed the advice on http://forum.mikrotik.com/viewtopic.php?f=2&t=45974. Please can someone help? I'm not sure what I am missing?

Port Forward not working with PCC Load Balancing

Port Forward not working with PCC Load Balancing

Re: Port Forward not working with PCC Load Balancing

Re: Port Forward not working with PCC Load Balancing

Re: Port Forward not working with PCC Load Balancing

Re: Port Forward not working with PCC Load Balancing

Re: Port Forward not working with PCC Load Balancing

Who is online