2pppoe wans linked to separate interfaces

Clauu · Thu Jan 15, 2015 8:54 pm

Hi, so i have ether1 as a wan(1 pppoe account) with dinamyc ip and ether2 as another wan with 2 pppoe accounts(same wire, just 2 pppoe accounts) each one with a static ip, my goal is that a computer connected to ether4 to be on the ether1 internet connection and another one to ether5 on the ether2 internet connection in the same time, no load balancing.. i'm kind a lost here

Caci99 · Fri Jan 16, 2015 11:51 am

Use routing marks in mangle, and after that apply the routing marks in routing table

/ip firewall mangle
add chain=prerouting src-address=computer1 action=mark-connection new-connection-mark=comp1
add chain=prerouting connection-mark=comp1 action=mark-routing new-routing-mark=comp1

same should be done for the other PC. Then:

/ip route
add dst-address=0.0.0.0/0 gateway=pppoe1 routing-mark=comp1
add dst-address=0.0.0.0/0 gateway=pppoe2 routing-mark=comp2

Clauu · Sat Jan 17, 2015 4:57 pm

Thank you, i'll try this and come back with feedback
Ok, at the moment of enabling those rules i can't ping/reach my internal network/hosts 192.168.10.0/24 from my vpn-pptp connection 192.168.30.0/24 network, why is that?

Caci99 · Sat Jan 17, 2015 7:44 pm

Ok, at the moment of enabling those rules i can't ping/reach my internal network/hosts 192.168.10.0/24 from my vpn-pptp connection 192.168.30.0/24 network, why is that?

That's because with policy routing in place, when network 192.168.10.0/24 tries to reach 192.168.30.0/24 instead of using the default connected route, it will go through the gateway into the internet. To avoid that, in mangle you should place a rule before the ones needed for policy routing:

/ip firewall mangle
add chain=prerouting src-address=192.168.10.0/24 dst-address=192.168.30.0/24 action=accept
add chain=prerouting src-address=192.168.30.0/24 dst-address=192.168.10.0/24 action=accept

Clauu · Sat Jan 17, 2015 10:17 pm

Ok thank you again, i've made a test but there is no internet connection on my laptop, maybe is something wrong with my routes?

routes
0 A S  dst-address=0.0.0.0/0 gateway=rds_acc50_229 
        gateway-status=rds_acc50_229 reachable distance=1 scope=30 
        target-scope=10 routing-mark=laptop 

 1 ADS  dst-address=0.0.0.0/0 gateway=10.0.0.1 
        gateway-status=10.0.0.1 reachable via  rds_acc50_229 distance=1 
        scope=30 target-scope=10 

 2 ADC  dst-address=10.0.0.1/32 pref-src=5.14.22.112 
        gateway=rds_fb100,rds_acc50_228,rds_acc50_229 
        gateway-status=rds_fb100 reachable,rds_acc50_228 reachable,rds_acc50_229 
               reachable 
        distance=0 scope=10

mangle
 0    chain=prerouting action=accept src-address=192.168.10.0/24 
      dst-address=192.168.30.0/24 log=no log-prefix="" 

 1    chain=prerouting action=accept src-address=192.168.30.0/24 
      dst-address=192.168.10.0/24 log=no log-prefix="" 

 2    chain=prerouting action=mark-connection new-connection-mark=laptop 
      passthrough=yes src-address=192.168.10.0/24 log=no log-prefix="" 

 3    chain=prerouting action=mark-routing new-routing-mark=laptop 
      passthrough=yes connection-mark=laptop log=no log-prefix=""

rds_fb_100 is the dinamic pppoe connection and rds_acc50_229&228 are the pppoe connections with a static ip

Caci99 · Sat Jan 17, 2015 10:26 pm

On the mangle rules, change the last one passthrough=no

/ip firewall mangle
chain=prerouting action=mark-routing new-routing-mark=laptop passthrough=no connection-mark=laptop

that means that packets will not be processed any more and the mark will remain.

Clauu · Sun Jan 18, 2015 2:09 pm

Thank you again, i have made a test an still the same problem no internet connection, maybe i'm doing something wrong?

Caci99 · Sun Jan 18, 2015 2:38 pm

What about the masquerade rule? How is it set?
Try with a simple masquerade:

/ip firewall nat
add chain=srcnat action=masquerade

Clauu · Sun Jan 18, 2015 10:07 pm

Well here are the rules

chain=srcnat action=masquerade out-interface=rds_fb100 log=no 
      log-prefix="" 

chain=srcnat action=masquerade out-interface=rds_acc50_228 log=no 
      log-prefix="" 

chain=srcnat action=masquerade out-interface=rds_acc50_229 log=no 
      log-prefix=""

Caci99 · Mon Jan 19, 2015 12:28 pm

It should work, I don't see anything stopping it from working.
Try it again, try it with pinging from laptop. Are you using dhcp-server? If yes what is the lease to the laptop, ip address, gateway, dns server?
If not, post in here /ip firewall, /ip route, /ip addresses to have the whole picture in one place.

Clauu · Mon Jan 19, 2015 6:06 pm

Yes i'm using dhcp-server, my config is ether1 and ether2 as wans, ether3 master with dhcp server(192.168.10.0/24 network) on it for ether4 and ether5(slaves for ether3). My laptop is on ether5 with static ip 192.168.10.100
On ether2 i have 2 pppoe accounts each one with a different static ip

[admin@MikroTik] > ip firewall filter print detail             
Flags: X - disabled, I - invalid, D - dynamic 
 0 X  ;;; place hotspot rules here
      chain=unused-hs-chain action=passthrough log=no log-prefix="" 

 1    ;;; default configuration
      chain=input action=accept protocol=icmp log=no log-prefix="" 

 2    ;;; default configuration
      chain=input action=accept connection-state=established log=no 
      log-prefix="" 

 3    ;;; default configuration
      chain=input action=accept connection-state=related log=no log-prefix="" 

 4    chain=input action=accept protocol=udp in-interface=ether1_WAN_rds_fb100 
      src-port=67,68 dst-port=67,68 log=no log-prefix="" 

 5    ;;; default configuration
      chain=input action=jump jump-target=log and drop 
      in-interface=ether1_WAN_rds_fb100 log=no log-prefix="" 

 6    ;;; default configuration
      chain=forward action=accept connection-state=established log=no 
      log-prefix="" 

 7    ;;; default configuration
      chain=forward action=accept connection-state=related log=no 
      log-prefix="" 

 8    ;;; default configuration
      chain=forward action=drop connection-state=invalid log=no log-prefix="" 

 9    chain=input action=jump jump-target=log and drop protocol=tcp 
      in-interface=rds_fb100 dst-port=22 log=no log-prefix="" 

10    chain=input action=jump jump-target=log and drop protocol=tcp 
      in-interface=rds_acc50_228 dst-port=22 log=no log-prefix="" 

11    chain=input action=jump jump-target=log and drop protocol=tcp 
      in-interface=rds_acc50_229 dst-port=22 log=no log-prefix="" 

12    chain=input action=jump jump-target=log and drop protocol=tcp 
      in-interface=rds_fb100 dst-port=23 log=no log-prefix="" 

13    chain=input action=jump jump-target=log and drop protocol=tcp 
      in-interface=rds_acc50_228 dst-port=23 log=no log-prefix="" 

14    chain=input action=jump jump-target=log and drop protocol=tcp 
      in-interface=rds_acc50_229 dst-port=23 log=no log-prefix="" 

15 X  chain=input action=jump jump-target=log and drop protocol=tcp 
      in-interface=rds_fb100 dst-port=21 log=no log-prefix="" 

16 X  chain=input action=jump jump-target=log and drop protocol=tcp 
      in-interface=rds_fb100 dst-port=80 log=no log-prefix="" 

17    chain=input action=drop protocol=udp in-interface=rds_fb100 dst-port=53 
      log=no log-prefix="" 

18    chain=input action=drop protocol=udp in-interface=rds_acc50_228 
      dst-port=53 log=no log-prefix="" 

19    chain=input action=drop protocol=udp in-interface=rds_acc50_229 
      dst-port=53 log=no log-prefix="" 

20    chain=input action=jump jump-target=log and drop protocol=tcp 
      in-interface=rds_fb100 dst-port=53 log=no log-prefix="" 

21    chain=input action=jump jump-target=log and drop protocol=tcp 
      in-interface=rds_acc50_228 dst-port=53 log=no log-prefix="" 

22    chain=input action=jump jump-target=log and drop protocol=tcp 
      in-interface=rds_acc50_229 dst-port=53 log=no log-prefix="" 

23 I  ;;; ppp-out1 not ready
      chain=input action=jump jump-target=log and drop protocol=tcp 
      in-interface=ppp-out1 dst-port=22 log=no log-prefix="" 

24 I  ;;; ppp-out1 not ready
      chain=input action=jump jump-target=log and drop protocol=tcp 
      in-interface=ppp-out1 dst-port=23 log=no log-prefix="" 

25 I  ;;; ppp-out1 not ready
      chain=input action=jump jump-target=log and drop protocol=tcp 
      in-interface=ppp-out1 dst-port=21 log=no log-prefix="" 

26 I  ;;; ppp-out1 not ready
      chain=input action=jump jump-target=log and drop protocol=tcp 
      in-interface=ppp-out1 dst-port=80 log=no log-prefix="" 

27    chain=log and drop action=log log=no log-prefix="" 

28    chain=log and drop action=drop log=no log-prefix="" 

29    chain=input action=accept protocol=udp src-address-list=L2TP_Allowed 
      dst-port=1701 log=no log-prefix="" 

30    chain=input action=accept protocol=udp dst-port=500,4500 log=no 
      log-prefix="" 

31    chain=forward action=jump jump-target=log and drop 
      src-address=192.168.60.96/27 dst-address=192.168.10.96/27 log=no 
      log-prefix="" 

32 X  chain=input action=jump jump-target=log and drop dst-address=192.168.10.1 
      in-interface=wlan3 log=no log-prefix="" 

33 X  chain=input action=accept protocol=tcp dst-port=21 log=no log-prefix=""

[admin@MikroTik] > ip firewall nat print detail
Flags: X - disabled, I - invalid, D - dynamic 
 0 X  ;;; place hotspot rules here
      chain=unused-hs-chain action=passthrough log=no

 1 X  ;;; default configuration
      chain=srcnat action=masquerade out-interface=et
      log=no log-prefix="" 

 2    chain=srcnat action=masquerade out-interface=rd
      log-prefix="" 

 3 I  ;;; ppp-out1 not ready
      chain=srcnat action=masquerade out-interface=pp
      log-prefix="" 

 4 X  chain=dstnat action=dst-nat to-addresses=192.16
      protocol=tcp dst-port=53 log=no log-prefix="" 

 5 X  chain=dstnat action=dst-nat to-addresses=192.16
      protocol=udp dst-port=53 log=no log-prefix="" 

 6    chain=srcnat action=masquerade out-interface=et
      log-prefix="" 

 7    chain=dstnat action=dst-nat to-addresses=192.168.10.106 to-ports=21 
      protocol=tcp dst-address=5.14.xx.xx dst-port=21 log=no log-prefix="" 

 8    chain=srcnat action=masquerade out-interface=rds_acc50_228 log=no 
      log-prefix="" 

 9    chain=srcnat action=masquerade out-interface=rds_acc50_229 log=no 
      log-prefix="" 

10    chain=srcnat action=masquerade log=no log-prefix=""

[admin@MikroTik] > ip firewall mangle print detail                         
Flags: X - disabled, I - invalid, D - dynamic 
 0    chain=prerouting action=accept src-address=192.168.10.0/24 
      dst-address=192.168.30.0/24 log=no log-prefix="" 

 1    chain=prerouting action=accept src-address=192.168.30.0/24 
      dst-address=192.168.10.0/24 log=no log-prefix="" 

 2    chain=prerouting action=mark-connection new-connection-mark=laptop 
      passthrough=yes src-address=192.168.10.0/24 log=no log-prefix="" 

 3    chain=prerouting action=mark-routing new-routing-mark=laptop 
      passthrough=no connection-mark=laptop log=no log-prefix=""

[admin@MikroTik] > ip route print detail
Flags: X - disabled, A - active, D - dynamic, 
C - connect, S - static, r - rip, b - bgp, o - ospf, m - mme, 
B - blackhole, U - unreachable, P - prohibit 
 0 A S  dst-address=0.0.0.0/0 gateway=rds_acc50_229 
        gateway-status=rds_acc50_229 reachable distance=1 scope=30 
        target-scope=10 routing-mark=laptop 

 1 ADS  dst-address=0.0.0.0/0 gateway=10.0.0.1 
        gateway-status=10.0.0.1 reachable via  rds_fb100 distance=1 scope=30 
        target-scope=10 

 2 ADC  dst-address=10.0.0.1/32 pref-src=86.122.xx.xx 
        gateway=rds_acc50_229,rds_acc50_228,rds_fb100 
        gateway-status=rds_acc50_229 reachable,rds_acc50_228 reachable,
               rds_fb100 reachable 
        distance=0 scope=10 

 3   S  dst-address=192.168.1.0/24 gateway=192.168.40.200 
        gateway-status=192.168.40.200 unreachable distance=1 scope=30 
        target-scope=10 

 4 A S  dst-address=192.168.2.1/32 gateway=wlan1 gateway-status=wlan1 reachable 
        check-gateway=ping distance=1 scope=30 target-scope=10 

 5 ADC  dst-address=192.168.10.0/24 pref-src=192.168.10.1 
        gateway=ether3_MASTER_4_5 gateway-status=ether3_MASTER_4_5 reachable 
        distance=0 scope=10 

 6 ADC  dst-address=192.168.20.0/24 pref-src=192.168.20.1 gateway=wlan1 
        gateway-status=wlan1 reachable distance=0 scope=10 

 7  DC  dst-address=192.168.40.0/24 pref-src=192.168.40.1 
        gateway=ether6_MASTER_7_8_10 
        gateway-status=ether6_MASTER_7_8_10 unreachable distance=255 scope=10 

 8 ADC  dst-address=192.168.50.0/24 pref-src=192.168.50.1 gateway=wlan2 
        gateway-status=wlan2 reachable distance=0 scope=10

[admin@MikroTik] > ip address print detail       
Flags: X - disabled, I - invalid, D - dynamic 
 0 X ;;; default configuration
     address=192.168.88.1/24 network=192.168.88.0 interface=wlan1 
     actual-interface=wlan1 

 1   address=192.168.10.1/24 network=192.168.10.0 interface=ether3_MASTER_4_5 
     actual-interface=ether3_MASTER_4_5 

 2   address=192.168.20.1/24 network=192.168.20.0 interface=wlan1 
     actual-interface=wlan1 

 3   address=192.168.40.1/24 network=192.168.40.0 interface=ether6_MASTER_7_8_1>
     actual-interface=ether6_MASTER_7_8_10 

 4   address=192.168.50.1/24 network=192.168.50.0 interface=wlan2 
     actual-interface=wlan2 

 5 I address=192.168.60.97/27 network=192.168.60.96 interface=wlan3 
     actual-interface=wlan3 

 6 X address=86.122.xx.xx/32 network=86.122.xx.x interface=ether2_WAN_rds_acc5>
     actual-interface=ether2_WAN_rds_acc50 

 7 X address=86.122.xx.xx/32 network=86.122.xx.x interface=ether2_WAN_rds_acc5>
     actual-interface=ether2_WAN_rds_acc50 

 8 D address=86.122.xx.xx/32 network=10.0.0.1 interface=rds_acc50_229 
     actual-interface=rds_acc50_229 

 9 D address=86.122.xx.xx/32 network=10.0.0.1 interface=rds_acc50_228 
     actual-interface=rds_acc50_228 

10 D address=5.14.xx.xx/32 network=10.0.0.1 interface=rds_fb100 
     actual-interface=rds_fb100

[admin@MikroTik] > interface pppoe-client print detail
Flags: X - disabled, R - running 
 0  R name="rds_acc50_228" max-mtu=1480 max-mru=1480 mrru=1
      interface=ether2_WAN_rds_acc50 user="xx" 
      password="xx" profile=default keepalive-timeo
      service-name="" ac-name="" add-default-route=no dial-
      use-peer-dns=yes allow=pap,chap,mschap1,mschap2 

 1  R name="rds_acc50_229" max-mtu=1480 max-mru=1480 mrru=1
      interface=ether2_WAN_rds_acc50 user="xx" 
      password="xx" profile=default keepalive-timeo
      service-name="" ac-name="" add-default-route=no dial-
      use-peer-dns=yes allow=pap,chap,mschap1,mschap2 

 2  R name="rds_fb100" max-mtu=1480 max-mru=1480 mrru=disab
      interface=ether1_WAN_rds_fb100 user="xx" p
      profile=default keepalive-timeout=60 service-name="" 
      add-default-route=yes default-route-distance=1 dial-o
      use-peer-dns=yes allow=pap,chap,mschap1,mschap2

192.168.30.0/24 is the pptp-vpn network

Caci99 · Mon Jan 19, 2015 11:05 pm

I am a bit baffled why this is not working. Let's try a different approach. Keep all the config that is needed for this one to work, i.e the mangle rules stay, leave only the masquerade rule in /ip firewall nat, and then disable all rest in nat and in /ip firewall filter and see if it works or not.

Clauu · Tue Jan 20, 2015 6:43 pm

Ok so i have checked over and over again, disabled rules nat etc still the same thing.. i cleaned my config a bit here is the result

[admin@MikroTik] > ip firewall filter print detail
Flags: X - disabled, I - invalid, D - dynamic 
 0    ;;; default configuration - icmp
      chain=input action=accept protocol=icmp log=no log-prefix="" 

 1    ;;; default configuration - established
      chain=input action=accept connection-state=established log=no 
      log-prefix="" 

 2    ;;; default configuration - related
      chain=input action=accept connection-state=related log=no log-prefix="" 

 3    ;;; default configuration - established
      chain=forward action=accept connection-state=established log=no 
      log-prefix="" 

 4    ;;; default configuration - related
      chain=forward action=accept connection-state=related log=no log-prefix="" 

 5    ;;; default configuration
      chain=forward action=drop connection-state=invalid log=no log-prefix="" 

 6    chain=log and drop action=log log=no log-prefix="" 

 7    chain=log and drop action=drop log=no log-prefix=""

[admin@MikroTik] > ip firewall nat print detail
Flags: X - disabled, I - invalid, D - dynamic 
 0    chain=srcnat action=masquerade out-interface=rds_fb100 log=no 
      log-prefix="" 

 1    chain=srcnat action=masquerade out-interface=rds_acc50_228 log=no 
      log-prefix="" 

 2    chain=srcnat action=masquerade out-interface=rds_acc50_229 log=no 
      log-prefix=""

[admin@MikroTik] > ip firewall mangle print detail
Flags: X - disabled, I - invalid, D - dynamic 
 0    chain=prerouting action=accept src-address=192.168.10.0/24 
      dst-address=192.168.30.0/24 log=no log-prefix="" 

 1    chain=prerouting action=accept src-address=192.168.30.0/24 
      dst-address=192.168.10.0/24 log=no log-prefix="" 

 2    chain=prerouting action=mark-connection new-connection-mark=laptop 
      passthrough=yes src-address=192.168.10.0/24 log=no log-prefix="" 

 3    chain=prerouting action=mark-routing new-routing-mark=laptop 
      passthrough=no connection-mark=laptop log=no log-prefix=""

[admin@MikroTik] > ip address print detail
Flags: X - disabled, I - invalid, D - dynamic 
  0   address=192.168.10.1/24 network=192.168.10.0 interface=ether3_MASTER_4_5 
     actual-interface=ether3_MASTER_4_5 

  1 D address=86.122.xx.xx/32 network=10.0.0.1 interface=rds_acc50_228 
     actual-interface=rds_acc50_228 

  2 D address=86.122.yy.yy/32 network=10.0.0.1 interface=rds_acc50_229 
     actual-interface=rds_acc50_229 

  3 D address=5.14.zz.zz/32 network=10.0.0.1 interface=rds_fb100 
     actual-interface=rds_fb100

[admin@MikroTik] > ip route print detail
Flags: X - disabled, A - active, D - dynamic, 
C - connect, S - static, r - rip, b - bgp, o - ospf, m - mme, 
B - blackhole, U - unreachable, P - prohibit 
 0 A S  dst-address=0.0.0.0/0 gateway=rds_acc50_229 
        gateway-status=rds_acc50_229 reachable distance=2 scope=30 
        target-scope=10 routing-mark=laptop 

 1 ADS  dst-address=0.0.0.0/0 gateway=10.0.0.1 
        gateway-status=10.0.0.1 reachable via  rds_fb100 distance=1 scope=30 
        target-scope=10 

 2 ADC  dst-address=10.0.0.1/32 pref-src=86.122.xx.xx 
        gateway=rds_acc50_228,rds_acc50_229,rds_fb100 
        gateway-status=rds_acc50_228 reachable,rds_acc50_229 reachable,
               rds_fb100 reachable 
        distance=0 scope=10 

 3 ADC  dst-address=192.168.10.0/24 pref-src=192.168.10.1 
        gateway=ether3_MASTER_4_5 gateway-status=ether3_MASTER_4_5 reachable 
        distance=0 scope=10

[admin@MikroTik] > interface pppoe-client print detail
Flags: X - disabled, R - running 
 0  R name="rds_acc50_228" max-mtu=1480 max-mru=1480 mrru=1600 
      interface=ether2_WAN_rds_acc50 user="*" 
      password="*" profile=default keepalive-timeout=60 
      service-name="" ac-name="" add-default-route=no dial-on-demand=no 
      use-peer-dns=no allow=pap,chap,mschap1,mschap2 

 1  R name="rds_acc50_229" max-mtu=1480 max-mru=1480 mrru=1600 
      interface=ether2_WAN_rds_acc50 user="*" 
      password="*" profile=default keepalive-timeout=60 
      service-name="" ac-name="" add-default-route=no dial-on-demand=no 
      use-peer-dns=no allow=pap,chap,mschap1,mschap2 

 2  R name="rds_fb100" max-mtu=1480 max-mru=1480 mrru=disabled 
      interface=ether1_WAN_rds_fb100 user="*" password="*" 
      profile=default keepalive-timeout=60 service-name="" ac-name="" 
      add-default-route=yes default-route-distance=1 dial-on-demand=no 
      use-peer-dns=yes allow=pap,chap,mschap1,mschap2

[admin@MikroTik] > ip dhcp-server print detail
Flags: X - disabled, I - invalid 
 0   name="dhcp_lan" interface=ether3_MASTER_4_5 lease-time=3d 
     address-pool=dhcp_lan_pool bootp-support=static 
     authoritative=after-2sec-delay lease-script=""

Anyway disabling this rule restores internet connection but not the marked one(in my case _229). Instead the _fb100 is used

chain=prerouting action=mark-connection new-connection-mark=laptop 
      passthrough=yes src-address=192.168.10.0/24 log=no log-prefix=""

Caci99 · Tue Jan 20, 2015 8:09 pm

Well, the idea is simple. One marks the traffic by means of mangle and then routes that traffic to the desired gateway in ip routes.
Either that gateway is not working, or dns settings on laptop are not correct (not able to resolve http).

Clauu · Tue Jan 20, 2015 8:38 pm

How can i debug further? All my laptop settings are ok, static ip 192.168.10.100, google dns 8.8.8.8 and 8.8.4.4.. is not a problem from here since neither ping isn;t working outside
Pinging 8.8.8.8 with 32 bytes of data:
Request timed out.
Request timed out.
What do you mean by gateway not working?

Clauu · Sun Jan 25, 2015 1:05 pm

Any help on this please? Or maybe a paid one since i really need this

2pppoe wans linked to separate interfaces

2pppoe wans linked to separate interfaces

Re: 2pppoe wans linked to separate interfaces

Re: 2pppoe wans linked to separate interfaces

Re: 2pppoe wans linked to separate interfaces

Re: 2pppoe wans linked to separate interfaces

Re: 2pppoe wans linked to separate interfaces

Re: 2pppoe wans linked to separate interfaces

Re: 2pppoe wans linked to separate interfaces

Re: 2pppoe wans linked to separate interfaces

Re: 2pppoe wans linked to separate interfaces

Re: 2pppoe wans linked to separate interfaces

Re: 2pppoe wans linked to separate interfaces

Re: 2pppoe wans linked to separate interfaces

Re: 2pppoe wans linked to separate interfaces

Re: 2pppoe wans linked to separate interfaces

Re: 2pppoe wans linked to separate interfaces

Who is online