Routing some traffic over sstp

lcx · Tue Nov 01, 2016 7:15 pm

I'm fighting with this issue since yesterday.
I have a DSL Provider to which I connect over PPoE, then I have a VPN Provider to which I connect over SSTP through which I want to route only some traffic.
As an example I took one server and my laptop IP and set up a mangle to route the traffic through SSTP for data coming from my laptop and are going to that server.

My Laptop hast the Internal IP 192.168.10.252
The Server hast the IP 145.245.48.237
My VPN provider gives me a the IP 100.64.126.14

Here is what I have now (I tried several configurations, I'm just posting the last one)

/ip firewall mangle print
chain=prerouting action=mark-routing new-routing-mark=LINE1 passthrough=yes src-address=192.168.10.252 dst-address=145.245.48.237 in-interface=bridge log=yes log-prefix="**MANGLE:"

/ip route print detail 
dst-address=0.0.0.0/0 pref-src=100.64.126.14 gateway=sstp-out1 gateway-status=sstp-out1 reachable distance=1 scope=30 target-scope=10 routing-mark=LINE1

/ip firewall nat print
chain=srcnat action=masquerade routing-mark=LINE1 out-interface=sstp-out1

so far, I can ping the server and the traffic is going through the SSTP as desired, but if I try to ssh or telnet to port 80 ... it doesn't work.
I really have no clue anymore what I am missing and since I didn't get much sleep due to this I think it's about time to ask for help.

lcx · Wed Nov 02, 2016 2:43 pm

If anyone else is facing this issue, the solution is in this blog post I found: https://blog.linitx.com/load-balancing- ... nnections/

First thing to note is that by default, bridge interfaces were designed for transparently bridging Layer 2 traffic and therefore it is logical that the traffic passing between the bridge ports and the bridge will not normally need to be processed by the Layer 3 firewall rules. To force Layer 2 traffic on a bridge to be processed by the Layer 3 firewall rules, we need to explicitly enable this.

so in the end, this solved my issue!

/interface bridge settings set use-ip-firewall=yes
/interface bridge settings set use-ip-firewall-for-pppoe=yes

Routing some traffic over sstp

Routing some traffic over sstp

[SOLVED] Routing some traffic over sstp