Hi all,

with a PCC configuration, I'm unable to register on websites using external authentication (e.g. aliexpress.com with google or facebook auth): just after 3rd party agreement, it appears a blank page and stop (e.g. https://thirdparty.aliexpress.com/ggcal ... ahblahblah).
This happens even if with that website the pcc has been expliciy bypassed.

Any ideas?

Thanks
Luca

Wrong PCC configuration.

Wrong PCC configuration.

Any better hint please?
Thanks
Luca

Use only src-addr as classifier.

This happens even if with that website the pcc has been expliciy bypassed.

Can you post your PCC configuration ?

Use only src-addr as classifier.

Unfortunately it didn't change the behaviour, except than reducing throughput.
Thanks anyway
Luca

This happens even if with that website the pcc has been expliciy bypassed.

Can you post your PCC configuration ?

There are 3 SXT LTE6 routers with IP 172.16.2.1, 172.16.4.1 and 172.16.5.1

/interface bridge
add name=bridge1
/interface ethernet
set [ find default-name=ether1 ] rx-flow-control=auto tx-flow-control=auto
/routing table
add disabled=no fib name=rt_wan4
add disabled=no fib name=rt_wan2
add disabled=no fib name=rt_wan5
/interface bridge port
add bridge=bridge1 interface=ether1 trusted=yes
add bridge=bridge1 interface=dynamic trusted=yes
/ip firewall connection tracking
set enabled=yes tcp-close-wait-timeout=1m tcp-established-timeout=1h \
tcp-fin-wait-timeout=1m tcp-last-ack-timeout=30s \
tcp-syn-received-timeout=1m tcp-syn-sent-timeout=10s \
tcp-time-wait-timeout=1m udp-timeout=30s
/interface list member
add interface=ether2 list=WAN
add interface=ether4 list=WAN
/ip address
add address=172.16.2.254/24 interface=ether2 network=172.16.2.0
add address=172.16.4.254/24 interface=ether4 network=172.16.4.0
add address=192.168.10.20/24 interface=bridge1 network=192.168.10.0
add address=172.16.5.254/24 interface=ether5 network=172.16.5.0
/ip firewall address-list
add address=172.16.2.1 list=exempt-from-pcc
add address=172.16.4.1 list=exempt-from-pcc
add address=172.16.5.1 list=exempt-from-pcc
add address=192.168.10.0/24 list=cohousers
add address=127.0.0.1 list=local_ip
add address=192.168.10.20 list=local_ip
add address=192.168.0.0/16 list=internal
add address=172.16.0.0/16 list=internal
/ip firewall filter
add action=drop chain=forward dst-port=137-139,445 in-interface=bridge1 \
protocol=tcp
add action=drop chain=forward dst-port=137-139,445 in-interface=bridge1 \
protocol=udp
add action=accept chain=forward
add action=accept chain=input
add action=accept chain=output
/ip firewall mangle
add action=accept chain=prerouting comment="exempt from PCC hosts" \
dst-address-list=exempt-from-pcc in-interface=bridge1
add action=mark-connection chain=prerouting comment=\
"from LAN egress through WAN2" connection-mark=no-mark dst-address-list=\
"from LAN egress through WAN2" dst-address-type=!local in-interface=\
bridge1 new-connection-mark=conn_wan2 passthrough=yes
add action=mark-connection chain=prerouting comment=\
"from LAN egress through WAN4" connection-mark=no-mark dst-address-list=\
"from LAN egress through WAN4" dst-address-type=!local in-interface=\
bridge1 new-connection-mark=conn_wan4 passthrough=yes
add action=mark-connection chain=prerouting comment=\
"from LAN egress through WAN5" connection-mark=no-mark dst-address-list=\
"from LAN egress through WAN5" dst-address-type=!local in-interface=\
bridge1 new-connection-mark=conn_wan_5 passthrough=yes
add action=mark-connection chain=prerouting comment="PCC to WAN2" \
connection-mark=no-mark dst-address-type=!local in-interface=bridge1 \
new-connection-mark=conn_wan2 passthrough=yes per-connection-classifier=\
both-addresses-and-ports:3/0
add action=mark-connection chain=prerouting comment="PCC to WAN4" \
connection-mark=no-mark dst-address-type=!local in-interface=bridge1 \
new-connection-mark=conn_wan4 passthrough=yes per-connection-classifier=\
both-addresses-and-ports:3/1
add action=mark-connection chain=prerouting comment="PCC to WAN5" \
connection-mark=no-mark dst-address-type=!local in-interface=bridge1 \
new-connection-mark=conn_wan_5 passthrough=yes per-connection-classifier=\
both-addresses-and-ports:3/2
add action=mark-routing chain=prerouting comment="WAN2 egress" \
connection-mark=conn_wan2 in-interface=bridge1 new-routing-mark=rt_wan2 \
passthrough=yes
add action=mark-routing chain=prerouting comment="WAN4 egress" \
connection-mark=conn_wan4 in-interface=bridge1 new-routing-mark=rt_wan4 \
passthrough=yes
add action=mark-routing chain=prerouting comment="WAN5 egress" \
connection-mark=conn_wan_5 in-interface=bridge1 new-routing-mark=rt_wan5 \
passthrough=yes
add action=mark-routing chain=output comment="policy routing WAN2" \
connection-mark=conn_wan2 new-routing-mark=rt_wan2 passthrough=yes
add action=mark-routing chain=output comment="policy routing WAN4" \
connection-mark=conn_wan4 new-routing-mark=rt_wan4 passthrough=yes
add action=mark-routing chain=output comment="policy routing WAN5" \
connection-mark=conn_wan_5 new-routing-mark=rt_wan5 passthrough=yes
add action=mark-connection chain=prerouting comment="mark inbound WAN2" \
connection-mark=no-mark in-interface=ether2 new-connection-mark=conn_wan2 \
passthrough=yes
add action=mark-connection chain=prerouting comment="mark inbound WAN4" \
connection-mark=no-mark in-interface=ether4 new-connection-mark=conn_wan4 \
passthrough=yes
add action=mark-connection chain=prerouting comment="mark inbound WAN5" \
connection-mark=no-mark in-interface=ether5 new-connection-mark=\
conn_wan_5 passthrough=yes
/ip firewall nat
add action=masquerade chain=srcnat comment="WAN masq" out-interface=ether2
add action=masquerade chain=srcnat out-interface=ether4
add action=masquerade chain=srcnat out-interface=ether5
/ip route
add disabled=no distance=1 dst-address=/0 gateway=172.16.2.1 routing-table=\
rt_wan4 suppress-hw-offload=no
add disabled=no distance=1 dst-address=/0 gateway=172.16.5.1 \
suppress-hw-offload=no
add disabled=no distance=1 dst-address=/0 gateway=172.16.4.1 \
suppress-hw-offload=no
add disabled=no distance=1 dst-address=/0 gateway=172.16.3.1 routing-table=\
rt_wan2 suppress-hw-offload=no
add check-gateway=ping comment="marked default via WAN2" disabled=no \
distance=1 dst-address=0.0.0.0/0 gateway=172.16.2.1 pref-src=0.0.0.0 \
routing-table=rt_wan2 scope=30 suppress-hw-offload=no target-scope=10
add check-gateway=ping comment="marked default via WAN4" disabled=no \
distance=1 dst-address=0.0.0.0/0 gateway=172.16.4.1 pref-src=0.0.0.0 \
routing-table=rt_wan4 scope=30 suppress-hw-offload=no target-scope=10
add comment="unmarked default via WAN2" disabled=no distance=2 dst-address=\
0.0.0.0/0 gateway=172.16.2.1 pref-src=0.0.0.0 routing-table=main scope=30 \
suppress-hw-offload=no target-scope=10
add comment="unmarked default via WAN4" disabled=no distance=2 dst-address=\
0.0.0.0/0 gateway=172.16.4.1 pref-src=0.0.0.0 routing-table=main scope=30 \
suppress-hw-offload=no target-scope=10
add check-gateway=ping comment="marked default via WAN5" disabled=no \
distance=1 dst-address=0.0.0.0/0 gateway=172.16.5.1 pref-src=0.0.0.0 \
routing-table=rt_wan5 scope=30 suppress-hw-offload=no target-scope=10
add comment="unmarked default via WAN5" disabled=no distance=2 dst-address=\
0.0.0.0/0 gateway=172.16.5.1 pref-src=0.0.0.0 routing-table=main scope=30 \
suppress-hw-offload=no target-scope=10
add disabled=no distance=1 dst-address=172.16.1.0/24 gateway=192.168.10.11 \
pref-src="" routing-table=main scope=30 suppress-hw-offload=no \
target-scope=10
/routing rule
add action=lookup disabled=no dst-address=192.168.0.0/16 interface=ether1 \
routing-mark=main table=main
add action=lookup-only-in-table disabled=no dst-address=0.0.0.0/0 interface=\
ether2 routing-mark=rt_wan2 table=main
add action=lookup-only-in-table disabled=no dst-address=0.0.0.0/0 interface=\
ether4 routing-mark=rt_wan4 table=main
add action=lookup-only-in-table disabled=no dst-address=0.0.0.0/0 interface=\
ether5 routing-mark=rt_wan5 table=main