Community discussions

MikroTik App
 
shyl
just joined
Topic Author
Posts: 6
Joined: Tue Jul 04, 2023 2:20 pm

ccr2116-12g-4s+The strategy is not effective

Tue Dec 26, 2023 5:33 pm

ccr2116-12g-4s+ Link 500 l2tp clients and set an internal network segment to go out from one l2tp client. Set a command, rule, and route, and occasionally touch a network segment. One of the IPs cannot access the internet, such as 10.10.1.1 cannot access the internet, and 10.10.1.2 can access the internet normally,Fully static address,
The configuration is as follows:I hope to receive help. Thank you!
Test the same results on RB1100,7. x Any version
# dec/26/2023 23:20:06 by RouterOS 7.8
# model = CCR2116-12G-4S+
/ip route
add disabled=no dst-address=0.0.0.0/0 gateway=vpn-out1 routing-table=route_1
add disabled=no dst-address=0.0.0.0/0 gateway=vpn-out2 routing-table=route_2
/ip firewall mangle
add action=mark-routing chain=prerouting new-routing-mark=route_1 \
passthrough=no src-address=10.10.1.0/24
add action=mark-routing chain=prerouting new-routing-mark=route_2 \
passthrough=no src-address=10.10.2.0/24
/routing rule
add action=lookup-only-in-table routing-mark=route_1 table=route_1
add action=lookup-only-in-table routing-mark=route_2 table=route_2
/ip address
add address=10.10.0.1/16 interface=bridge1 network=10.10.0.0
add address=10.11.0.1/16 interface=bridge1 network=10.11.0.0
 
LdB
Member Candidate
Member Candidate
Posts: 187
Joined: Thu May 20, 2021 4:23 pm

Re: ccr2116-12g-4s+The strategy is not effective

Sat Dec 30, 2023 4:47 pm

To your static routes try adding
action=lookup-only-in-table

You might get into trouble if this gets more complex you are pre-route marking based on source address ... what if it's just local LAN-LAN traffic. I suspect it wants to be output marked or pre-route with LAN destination exclusions so you don't mark LAN-LAN traffic.
 
shyl
just joined
Topic Author
Posts: 6
Joined: Tue Jul 04, 2023 2:20 pm

Re: ccr2116-12g-4s+The strategy is not effective

Tue Jan 02, 2024 12:48 pm

Thank you very much for your reply
LAN has another network segment, and unmarked addresses will go through the default interface
I have added a strategy in the rule to include the/routing rule
Add action=lookup only in table routing mark=route_ 1 table=route_ Change 1 to action=lookup only in table