Dual WAN problem

Tal · Sun Oct 11, 2015 4:30 am

I have 2 WAN links connected to my 493 - one on ether1 and one on ether3

My IPs:

WAN IP on ether1: 1.1.1.10
Gateway on ether1: 1.1.1.1

WAN IP on ether3: 3.3.3.10
Gateway on ether3: 3.3.3.1

IP I'll be managing the 493 from (HQ) through winbox: 5.5.5.5

I'm trying to set it up so that:

1. I can connect and remotely manage the 493 using winbox from either public IP anytime. This means that whatever IP I used to connect to the 493 with is the IP it should reply with.
2. When the router needs to send packets out to the internet, it will only use whatever link the default gateway points to. I don't need any failover, or load balancing, or anything like that.

Note: The reason I have a router with 2 WAN links and no need for failover or load balancing is because I already run a script in the background that handles this. The ether3 WAN link is a backup link. When the primary ether1 link goes down, my script detects it and changes the default route (0.0.0.0/0 in main routing table) to point to 3.3.3.1 as the gateway.

What I'm currently doing is this:

I added 2 static routes for the management IP, and assigned each route a different routing mark:

add dst-address=5.5.5.5 gateway=1.1.1.1 routing-mark=to_ether1
add dst-address=5.5.5.5 gateway=3.3.3.1 routing-mark=to_ether3

and my script either adds this route:

add dst-address=0.0.0.0/0 gateway=1.1.1.1

or this one:

add dst-address=0.0.0.0/0 gateway=3.3.3.1

I setup mangle rules to mark connections coming on either ether1 or ether3, and then mark packets going back out so they get forced through the same public IP that they came in on:

/ip firewall mangle
    add action=mark-connection chain=prerouting connection-mark=no-mark in-interface=ether1 new-connection-mark=ether1_conn src-address=5.5.5.5
    add action=mark-connection chain=prerouting connection-mark=no-mark in-interface=ether3 new-connection-mark=ether3_conn src-address=5.5.5.5

    add action=mark-routing chain=output connection-mark=ether1_conn dst-address=5.5.5.5 new-routing-mark=to_ether1
    add action=mark-routing chain=output connection-mark=ether3_conn dst-address=5.5.5.5 new-routing-mark=to_ether3

This works great - I can connect to either WAN IP to manage the device from my HQ (5.5.5.5). There is one problem however: If there is no 0.0.0.0/0 route in the main table, everything stops working.
If there is a 0.0.0.0/0 route pointing to either the ether1 default gateway (1.1.1.1) or the ether3 default gateway (3.3.3.1), everything works fine.
Why does it need the default gateway in this case? It seems like it should just use whatever management route I used to connect to the device with, and not the default gateway.
How can I make it so that it doesn't need the 0.0.0.0/0 route at all?