Community discussions

MikroTik App
 
goftari
just joined
Topic Author
Posts: 4
Joined: Wed Feb 01, 2012 12:35 am

Problem opening some websites

Wed Feb 01, 2012 12:42 am

I have a Mikrotik RouterBOARD and have configured two gateways (for the 2 of my ISPs) and enabled web proxy for http browsing (dst nat redirect dst-port:80), I have problem opening web pages. please help!
 
User avatar
nest
Forum Veteran
Forum Veteran
Posts: 823
Joined: Tue Feb 27, 2007 1:52 am
Location: UK
Contact:

Re: Problem opening some websites

Wed Feb 01, 2012 12:53 am

We can't see over your shoulder - help us, to help you, by telling us your config ?! :-)
 
goftari
just joined
Topic Author
Posts: 4
Joined: Wed Feb 01, 2012 12:35 am

Re: Problem opening some websites

Wed Feb 01, 2012 10:21 am

I have a Microsoft ISA Server 2006 in front of my LAN, and all the traffic going to the Internet is directed through ISA Server; so I have a NAT rule only for my ISA (srcnat src.add:172.18.90.19(ISA) action:masquarade).
I have two ISPs, one is connected via a Mikrotik port (ether4) (ISP1) and the other one is through an IP Tunnel (ISP2).
I've created an IP Tunnel (ipip1), and assigned one of my valid IP addresses to the IP Tunnel.
I can ping 4.2.2.4 from both interfaces.
to take both Internet connections in use, I've created a default route in my routes, having 3 gateways, one is the ISP1 interface (ether4) (which provides a 1Mb Internet conenction) and two of them are ISP2 interface (ipip1) (which provides a 2 Mb Internet connection).
this way, both my internet connections are in use and IP packets are referred to them using round robin.
I faced a problem browsing webpages, the problem I guess was that as there are multiple gateways, the packets lose their way and there'd be packet loss, so I tried web proxy (Enabled web proxy listening on port #8080 and wrote a NAT rule to redirect TCP packets with destination port #80 to port #8080). my Internet browsing experience improved, but still there were problems.
I did this today and this may change the question. I changed the MTU on my IP Tunnel interface from 1480 to 1200, as recommended in a topic in this forum, and nothing feasible happened. I tried another recommendation to rewrite the TCP MSS to 1360 to work around fragmentation issues: / ip firewall mangle add chain=forward protocol=tcp tcp-flags=syn tcp-mss=1361-65535 action=change-mss new-mss=1360 disabled=no

and it worked. Yahoo, Yahoo mail and several other webpages opened.
Still had problem opening some webpages like Microsoft.com homepage; but fixed that by switching back the MTU from 1200 to 1480.
But still sometimes employees are not able to access the above mentioned websites.
Now I'm looking for a way to improve my Internet browing experience.
Any one's help would be appreciated!
(Excuse me for my poor English)
 
User avatar
nest
Forum Veteran
Forum Veteran
Posts: 823
Joined: Tue Feb 27, 2007 1:52 am
Location: UK
Contact:

Re: Problem opening some websites

Wed Feb 08, 2012 3:31 am

I have a Microsoft ISA Server 2006 in front of my LAN, and all the traffic going to the Internet is directed through ISA Server; so I have a NAT rule only for my ISA (srcnat src.add:172.18.90.19(ISA) action:masquarade).
I have two ISPs, one is connected via a Mikrotik port (ether4) (ISP1) and the other one is through an IP Tunnel (ISP2).
I've created an IP Tunnel (ipip1), and assigned one of my valid IP addresses to the IP Tunnel.
I can ping 4.2.2.4 from both interfaces.
to take both Internet connections in use, I've created a default route in my routes, having 3 gateways, one is the ISP1 interface (ether4) (which provides a 1Mb Internet conenction) and two of them are ISP2 interface (ipip1) (which provides a 2 Mb Internet connection).
this way, both my internet connections are in use and IP packets are referred to them using round robin.
I faced a problem browsing webpages, the problem I guess was that as there are multiple gateways, the packets lose their way and there'd be packet loss, so I tried web proxy (Enabled web proxy listening on port #8080 and wrote a NAT rule to redirect TCP packets with destination port #80 to port #8080). my Internet browsing experience improved, but still there were problems.
I did this today and this may change the question. I changed the MTU on my IP Tunnel interface from 1480 to 1200, as recommended in a topic in this forum, and nothing feasible happened. I tried another recommendation to rewrite the TCP MSS to 1360 to work around fragmentation issues: / ip firewall mangle add chain=forward protocol=tcp tcp-flags=syn tcp-mss=1361-65535 action=change-mss new-mss=1360 disabled=no

and it worked. Yahoo, Yahoo mail and several other webpages opened.
Still had problem opening some webpages like Microsoft.com homepage; but fixed that by switching back the MTU from 1200 to 1480.
But still sometimes employees are not able to access the above mentioned websites.
Now I'm looking for a way to improve my Internet browing experience.
Any one's help would be appreciated!
(Excuse me for my poor English)
If MTU is the problem, then trying different values you find in forum posts will not help you, it is like guessing. You have thousands of possibilities and you may be lucky, you may not. Instead, find out what the MTU value actually really is on each of those ISPs and then change your MTU on your side to be the same. There are many pages on the internet explaining how to find your MTU, just raise the MTU artificially on your network first, so that it is larger than your two backhaul. You will then know how large the MTU is there, so that you can reduce it on your public interfaces to match.
 
User avatar
macgaiver
Forum Guru
Forum Guru
Posts: 1770
Joined: Wed May 18, 2005 5:57 pm
Location: Sol III, Sol system, Sector 001, Alpha Quadrant

Re: Problem opening some websites

Wed Feb 08, 2012 2:49 pm

You need to create a proper load balancing - you can't use masquerade and round robin load-balancing together - if page require several connections some of them might come from your other public IP - that is wrong - use http://wiki.mikrotik.com/wiki/Manual:PC ... _Balancing
 
goftari
just joined
Topic Author
Posts: 4
Joined: Wed Feb 01, 2012 12:35 am

Re: Problem opening some websites

Mon Feb 13, 2012 9:40 am

Thanks to you both, I checked the MTU for both my ISP interfaces with ping google.com -f -l xxxx, and both were already correct.
And about PCC, I once tried to use it, bot didn't realize that all my traffic is going through ISA server and I used src-address as connection classifier and all my traffic was going through one ISP interface and the other one was idle, but I suppose that I have to use dst-address and both-ports as connection classifier; Thank you to remind me about PCC.
I have other questions that are not related to this topic, so I'll post them as a new topic.

Who is online

Users browsing this forum: No registered users and 22 guests