Chain input vs chain prerouting for Mangle

netbits · Mon Nov 25, 2013 10:02 pm

I'm trying to setup mangle rules to create load balancing but I'm battling to decide between using prerouting and input chain. I've done some reading but still can't wrap my head around when to use which rule.

My setup:

/ip address
add address=172.16.0.1/24 interface=Local-slave5
add address=10.1.1.2/24 interface=WAN1
add address=10.2.2.2/24 interface=WAN2
add address=10.3.3.2/24 interface=WAN3

/ip firewall mangle
add action=accept chain=prerouting disabled=no dst-address=10.1.1.0/24 in-interface=Local-slave5
add action=accept chain=prerouting disabled=no dst-address=10.2.2.0/24 in-interface=Local-slave5
add action=accept chain=prerouting disabled=no dst-address=10.3.3.0/24 in-interface=Local-slave5

add action=mark-connection chain=prerouting connection-mark=no-mark disabled=no dst-address-type=!local in-interface=Local-slave5 new-connection-mark=WAN1_mark passthrough=yes per-connection-classifier=both-addresses-and-ports:3/0
add action=mark-connection chain=prerouting connection-mark=no-mark disabled=no dst-address-type=!local in-interface=Local-slave5 new-connection-mark=WAN2_mark passthrough=yes per-connection-classifier=both-addresses-and-ports:3/1
add action=mark-connection chain=prerouting connection-mark=no-mark disabled=no dst-address-type=!local in-interface=Local-slave5 new-connection-mark=WAN3_mark passthrough=yes per-connection-classifier=both-addresses-and-ports:3/2

add action=mark-routing chain=prerouting connection-mark=WAN1_mark disabled=no in-interface=Local-slave5 new-routing-mark=to_WAN1 passthrough=yes
add action=mark-routing chain=prerouting connection-mark=WAN2_mark disabled=no in-interface=Local-slave5 new-routing-mark=to_WAN2 passthrough=yes
add action=mark-routing chain=prerouting connection-mark=WAN3_mark disabled=no in-interface=Local-slave5 new-routing-mark=to_WAN3 passthrough=yes

add action=mark-routing chain=output connection-mark=WAN1_mark disabled=no new-routing-mark=to_WAN1 passthrough=yes
add action=mark-routing chain=output connection-mark=WAN2_mark disabled=no new-routing-mark=to_WAN2 passthrough=yes
add action=mark-routing chain=output connection-mark=WAN3_mark disabled=no new-routing-mark=to_WAN3 passthrough=yes

I need to create the marks for the incoming packets but which is better (prerouting or input chain):

add action=mark-connection chain=prerouting connection-mark=no-mark disabled=no in-interface=WAN1 new-connection-mark=WAN1_mark passthrough=yes
add action=mark-connection chain=prerouting connection-mark=no-mark disabled=no in-interface=WAN2 new-connection-mark=WAN2_mark passthrough=yes
add action=mark-connection chain=prerouting connection-mark=no-mark disabled=no in-interface=WAN3 new-connection-mark=WAN3_mark passthrough=yes

or

add action=mark-connection chain=input disabled=no new-connection-mark=WAN1_mark in-interface=WAN1 passthrough=yes
add action=mark-connection chain=input disabled=no new-connection-mark=WAN2_mark in-interface=WAN2 passthrough=yes
add action=mark-connection chain=input disabled=no new-connection-mark=WAN3_mark in-interface=WAN3 passthrough=yes

aaronhun22 · Tue Nov 26, 2013 12:41 am

Input and Output are for connections to the router (ie webfig and winbox). Prerouting, Postrouting, and Forward are for connections to the WAN or LAN. You can only load balance connections from the LAN to WAN. Going from WAN to LAN packets must be received and sent from the connection it came on because servers on the WAN are waiting for packets to come from the address they were sent to. So load balancing rules should only be applied to connections originating from the LAN.

Chain input vs chain prerouting for Mangle

Chain input vs chain prerouting for Mangle

Re: Chain input vs chain prerouting for Mangle