How to route particular networks thru other WAN

7ion · Sun Dec 03, 2017 10:03 pm

Hello. I'm trying to route some networks that I have in address-list "route-thru-wan2" thru WAN2.
I already have a LAN-side network, WAN and WAN2 networks that set up correctly. It works perfect, if WAN route is unreachable, WAN2 works instead.
What I have done now:

Code: Select all

/ip firewall mangle print

15    ;;; Mark all connections to Route-thru-WAN2 addr list

      chain=prerouting action=mark-connection new-connection-mark=route-thru-wan2

      passthrough=yes dst-address-list=route-thru-wan2 log=no log-prefix="" 

16    ;;; Do the same thing for routing

      chain=prerouting action=mark-routing new-routing-mark=route-thru-wan2 

      passthrough=yes connection-mark=route-thru-wan2 log=no log-prefix="" 



/ip firewall filer print

280    chain=forward action=add-src-to-address-list

      address-list=illegal-access address-list-timeout=1d 

      out-interface=wan2 log=yes log-prefix="Illegal access" 

281    chain=forward action=drop out-interface=wan2 log=no 

      log-prefix="" 



/ip route export

add check-gateway=ping distance=7 gateway=wan2 routing-mark=route-thru-wan2



/ip firewall nat print

      chain=srcnat action=masquerade out-interface=wan2 log=no log-prefix=""

And the rule "Illegal access" fires because my router for some reason wanna send received packet back thru wan2.

Code: Select all

22:48:29 firewall,info Illegal sccess: in:wan2 out:wan2, proto TCP (SYN,ACK), xx.xx.xx.xx:443->100.64.25.2:34068, NAT xx.xx.xx.xx:443->(xx.xx.xx.xx:34068(white address on wan2-interface)->100.64.25.2:34068 (address on the lan-side)), len 52

If I just do simple rule without marks (add check-gateway=ping distance=7 gateway=wan2 dst-address=some-range), everything works fine.
What I'm doing wrong?

7ion · Mon Dec 04, 2017 9:37 pm

I understood my mistake, I have to specify all my routes for the "route-thru-wan2" mark too.
I've added thеsе rules and everything got okay for 100.64.25.2 and for the rest of LAN-side (192.168.0.0/16):

Code: Select all

add distance=7 dst-address=100.64.25.2/32 gateway=my-pptp-server routing-mark=route-thru-wan2

add distance=7 dst-address=192.168.0.0/16 gateway="ether1 (lan)" routing-mark=route-thru-wan2

How to route particular networks thru other WAN [SOLVED]

How to route particular networks thru other WAN

Re: How to route particular networks thru other WAN [SOLVED]

Who is online