Routing table ignoring routing mark
Posted: Sun Aug 26, 2012 2:17 am
I followed the wiki at http://wiki.mikrotik.com/wiki/PCC to set up loadbalancing of two internet connections. Because of an ipsec tunnel I added the following:
(1.2.3.0/24 is a subnet including the ipsec remote peer 1.2.3.4. 172.29.5.0/24 is the ipsec remote local subnet)
I suspected it didn't work (ipsec was unstable), so I did some testing. I deleted the two routes to 0.0.0.0/0 without routing-mark and added the following:
Now, when I ping 1.2.3.3 or 1.2.3.4 (or try to establish ipsec from my local side to 1.2.3.4) I see in the log quite frequently that the log display the package will be using ISP2 as out interface, with ISP1 as source address! I think that explains why the ipsec is so unstable. (Further logging show that ipsec packets go out on IPS2 interface, and returning packets come on ISP1 interface.)
And the fact that anything shows up in the log at all proves that the routing-mark is correct.
Then I run the following commands:
In my understanding of routing-mark, these two rules should not make any difference at all, as there are other routing rules with lower distance that matches the routing-mark. But they do make a difference. After these two commands are entered the packets to the ipsec peer is sent on the ISP2 interface 100% of the times, except when establishing the tunnel. (For some reason tunnel is established. But all packets thereafter are sent on the wrong interface.) And ping are always sent on the wrong interface.
But if I add the route
everything works fine with the ipsec. But still most of the packages to the internet are using ISP2.
So, my question. Is it me doing something completely wrong here, or is routing-mark frequently ignored in the routing table?
The real setup where I experienced the issue was on a RB450G with ROS4.11
The issue is reproduced on a RB751G with ROS 5.11, which I used for all testing/debug. To make sure I didn't fail on translating the addresses in the commands from the wiki, I setup a complete test environment using the exact same addresses as the wiki, using two more rb751g as ISP* routers, and even two more to create a "internet" with an remote ipsec peer.
Code: Select all
/ip firewall mangle add chain=prerouting dst-address=172.29.5.0/24 action=accept
/ip firewall mangle add chain=prerouting dst-address=1.2.3.0/24 action=mark-connection new-connection-mark=ISP1_conn
/ip firewall mangle add chain=output dst-address=1.2.3.0/24 action=mark-connection new-connection-mark=ISP1_conn
I suspected it didn't work (ipsec was unstable), so I did some testing. I deleted the two routes to 0.0.0.0/0 without routing-mark and added the following:
Code: Select all
/ip firewall filter add action=log chain=output disabled=no dst-address=1.2.3.0/24 log-prefix="ipsec out:" routing-mark=to_ISP1
/ip firewall filter add action=log chain=forward disabled=no dst-address=1.2.3.0/24 log-prefix="ipsec fwd:" routing-mark=to_ISP1
And the fact that anything shows up in the log at all proves that the routing-mark is correct.
Then I run the following commands:
Code: Select all
/ip route
add dst-address=0.0.0.0/0 gateway=10.111.0.1 distance=5 check-gateway=ping
add dst-address=0.0.0.0/0 gateway=10.112.0.1 distance=2 check-gateway=ping
But if I add the route
Code: Select all
add dst-address=1.2.3.0/24 gateway=10.111.0.1 distance=1 check-gateway=ping
So, my question. Is it me doing something completely wrong here, or is routing-mark frequently ignored in the routing table?
The real setup where I experienced the issue was on a RB450G with ROS4.11
The issue is reproduced on a RB751G with ROS 5.11, which I used for all testing/debug. To make sure I didn't fail on translating the addresses in the commands from the wiki, I setup a complete test environment using the exact same addresses as the wiki, using two more rb751g as ISP* routers, and even two more to create a "internet" with an remote ipsec peer.
