Community discussions

MikroTik App
 
vazzY00
just joined
Topic Author
Posts: 8
Joined: Sun Feb 14, 2021 11:07 pm

Dual WAN forwarding routes connection drop

Thu Mar 17, 2022 1:42 am

Hey everyone! Just using a hap lite rb941-2nd as a load balancer.

After changing to 7.1.3 version I'm having troubles marking the connection to route through one, or another ISP (eth1&eth2 interfaces to this case). This would be necessary for later bandwidth management over queues tree.

Having ip/firewall/mangle rule:
chain=prerouting action=mark-routing new-routing-mark=to_wan2 passthrough=no dst-address=126.18.22.26 log=no log-prefix=""
Traffic is forwarded just great. But for what I've read about traffic marking and later queueing, I would have to mark the connection, and packets as well:
chain=prerouting action=mark-connection new-connection-mark=test_mark passthrough=yes dst-address=126.18.22.26 log=no log-prefix="" 
chain=prerouting action=mark-routing new-routing-mark=to_wan2 passthrough=no connection-mark=test_mark log=no log-prefix="
This immediately ends up with loss of communication to 126.18.22.26 address (or whatever IP has been added to mangle).

Still can't get what is the difference but that connection marking rule seems to be missing traffic, and then mark routing just messes things up.

Image
 
vazzY00
just joined
Topic Author
Posts: 8
Joined: Sun Feb 14, 2021 11:07 pm

Re: Dual WAN forwarding routes connection drop

Thu Mar 17, 2022 1:53 am

Just found out MY mistake!

Marking the connection also identifies the incoming traffic, which was then, forwarded out of my network.

Ignoring the IP address as source of the traffic did the trick.

Does anyone have any better approach on this?

Image
 
Sob
Forum Guru
Forum Guru
Posts: 9188
Joined: Mon Apr 20, 2009 9:11 pm

Re: Dual WAN forwarding routes connection drop  [SOLVED]

Thu Mar 17, 2022 3:23 am

Foolproof shortcut is to say that no matter what, only main routing table should be used for local destinations, e.g.:
/ip route rule
add action=lookup-only-in-table dst-address=192.168.0.0/16 table=main
(or whatever you use in LAN)

What you have now is ok too, only instead of src-address=!<remote server> you can use more universal src-address=<local subnet>, it will work with any number of servers.
 
vazzY00
just joined
Topic Author
Posts: 8
Joined: Sun Feb 14, 2021 11:07 pm

Re: Dual WAN forwarding routes connection drop

Thu Mar 17, 2022 3:55 am

Actually proceeded with queueing by packet marking only, 'cause I also have another rules filtered by ports.

Still marked the connection for statistics purpouses, but only routing marked packets.
Image

What you have now is ok too, only instead of src-address=!<remote server> you can use more universal src-address=<local subnet>, it will work with any number of servers.
That'd be a very much cleaner approach. Thank you!