Hi all,
I am sturgling with my setup which is as follows: I have 2 ISPs and both of them gave me home routers that are locked on 192.168.1.1
I want to implement some simple failover between my two ISPs (Orange and Starlink) using my Mikrotik. I though this would be as simple as putting the 2 routers in two different VRFs and let my Mikrotik router do the routing and NATing.
( LAN - 192.168.2.0/24 )---(ether3/4/5)---MK --(ether1)---- (VRF-ORANGE - 192.168.1.0/24 gw 192.168.1.1)
|
---(ether2)-----(VRF-STARLINK - 192.168.1.0/24 gw 192.168.1.1)
Unfortunately the routing seems to works OK but the packets from the LAN to the VRFs are not NATed. Using the packet sniffing I can see packets in the VRF with the IPs from the LAN.
Here is my config (note I’m trying to have the vrf-orange working so most of the configuration for the other vrf is missing or disabled):
The IP of the Mikrotik in the LAN is 192.168.2.211, in the vrf-orange it’s 192.168.1.211 and in the vrf-starlink it is 192.168.1.212
/ip vrf
add comment="vrf vers starlink" interfaces=ether2 name=vrf-starlink
add comment="vrf vers livebox" interfaces=ether1 name=vrf-orange
/interface bridge port
add bridge=bridge comment=defconf interface=ether3
add bridge=bridge comment=defconf interface=ether4
add bridge=bridge comment=defconf interface=ether5
add bridge=bridge comment=defconf disabled=yes interface=sfp1
add bridge=bridge disabled=yes interface=ether1
add bridge=bridge disabled=yes interface=ether2
/interface list member
add comment=defconf interface=bridge list=LAN
add interface=sfp1 list=WAN
add interface=ether1 list=WAN
add interface=ether3 list=LAN
add interface=ether4 list=LAN
add interface=ether5 list=LAN
/ip address
add address=192.168.1.211/24 comment=orange interface=ether1 network=192.168.1.0
add address=192.168.1.212/24 comment=starlink disabled=yes interface=ether2 network=192.168.1.0
add address=192.168.2.211/24 comment=bridge interface=bridge network=192.168.2.0
/ip firewall filter
add action=accept chain=input comment="defconf: accept established,related,untracked" connection-state=established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=invalid
add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp
add action=accept chain=input comment="defconf: accept to local loopback (for CAPsMAN)" dst-address=127.0.0.1
add action=drop chain=input comment="defconf: drop all not coming from LAN" in-interface-list=!LAN
add action=accept chain=forward comment="defconf: accept in ipsec policy" ipsec-policy=in,ipsec
add action=accept chain=forward comment="defconf: accept out ipsec policy" ipsec-policy=out,ipsec
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" connection-state=established,related hw-offload=yes
add action=accept chain=forward comment="defconf: accept established,related, untracked" connection-nat-state="" connection-state=established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" connection-state=invalid
add action=drop chain=forward comment="defconf: drop all from WAN not DSTNATed" connection-nat-state=!dstnat connection-state=new in-interface-list=WAN
/ip firewall nat
add action=masquerade chain=srcnat out-interface-list=WAN
/ip route
add disabled=no distance=1 dst-address=0.0.0.0/0 gateway=192.168.1.1@vrf-orange pref-src="" routing-table=main suppress-hw-offload=no
add disabled=no distance=1 dst-address=0.0.0.0/0 gateway=192.168.1.1@vrf-orange pref-src="" routing-table=vrf-orange suppress-hw-offload=no vrf-interface=ether1
which is not very useful for other newbies like myself attempting to learn/get inspiration.
.
).