Hello,
You have posted this in the wrong section.
You’re asking for assistance with your configuration, not scripting or code.
Regardless, let’s start with a few observations:
- The ip pool named “pooll” doesn’t appear to be used anywhere, so you may want to remove it.
- The network “192.168.0.0/24” under “/ip dhcp-server network” also doesn’t appear to be used anywhere.
Onto your mangle rules now:
- Improper usage of chains, you may want to consult this primer and this manual entry, so you can have a clearer picture of how things are supposed to work.
- Much like the accept action, whatever hits a rule that doesn’t have passthrough, is going to stop there.
- Wrong order of rules. You generally want to be marking connections first and then routing.
- While you are excluding traffic from your “Local” interface (which is your LAN I suppose) to your three WAN subnets, you are not doing it in both directions - plus you’re not excluding LAN traffic itself.
- Wrong selection of “in-interface” on the PCC rules. You’re supposed to supply the WAN interfaces there, not the LAN one.
- You should be using “connection-mark=no-mark” more, so you would mark only what’s not already marked. Will improve the load of the device slightly also.
These being said, that’s how I’d go about configuring the mangle table instead.
- Create a “LOCAL” address list, containing all your internal networks:
/ip firewall address-list add list=LOCAL address=192.168.1.0/24
/ip firewall address-list add list=LOCAL address=192.168.2.0/24
/ip firewall address-list add list=LOCAL address=192.168.3.0/24
/ip firewall address-list add list=LOCAL address=192.168.5.0/24
- Exclude LAN to LAN traffic from load balancing:
/ip firewall mangle add action=accept chain=prerouting dst-address-list=LOCAL src-address-list=LOCAL
- Mark inbound connections (these rules should always be on, to avoid the common multi-WAN problem):
/ip firewall mangle add action=mark-connection chain=prerouting connection-mark=no-mark in-interface=WAN1 new-connection-mark=WAN1_conn passthrough=yes
/ip firewall mangle add action=mark-connection chain=prerouting connection-mark=no-mark in-interface=WAN2 new-connection-mark=WAN2_conn passthrough=yes
/ip firewall mangle add action=mark-connection chain=prerouting connection-mark=no-mark in-interface=WAN3 new-connection-mark=WAN3_conn passthrough=yes
- Mark the outbound connections (these can be turned off, if you wish to pause load balancing):
/ip firewall mangle add action=mark-connection chain=prerouting connection-mark=no-mark dst-address-type=!local in-interface=WAN1 new-connection-mark=WAN1_conn passthrough=yes per-connection-classifier=both-addresses:3/0
/ip firewall mangle add action=mark-connection chain=prerouting connection-mark=no-mark dst-address-type=!local in-interface=WAN2 new-connection-mark=WAN2_conn passthrough=yes per-connection-classifier=both-addresses:3/1
/ip firewall mangle add action=mark-connection chain=prerouting connection-mark=no-mark dst-address-type=!local in-interface=WAN3 new-connection-mark=WAN3_conn passthrough=yes per-connection-classifier=both-addresses:3/2
- Assign routing marks to marked connections (LAN clients - these rules should always be on, to avoid the common multi-WAN problem):
/ip firewall mangle add action=mark-routing chain=prerouting connection-mark=WAN1_conn in-interface=Local new-routing-mark=to_WAN1 passthrough=no
/ip firewall mangle add action=mark-routing chain=prerouting connection-mark=WAN2_conn in-interface=Local new-routing-mark=to_WAN2 passthrough=no
/ip firewall mangle add action=mark-routing chain=prerouting connection-mark=WAN3_conn in-interface=Local new-routing-mark=to_WAN3 passthrough=no
- Assign routing marks to marked connections (Router itself - these rules should always be on, to avoid the common multi-WAN problem):
/ip firewall mangle add action=mark-routing chain=output connection-mark=WAN1_conn new-routing-mark=to_WAN1 passthrough=no
/ip firewall mangle add action=mark-routing chain=output connection-mark=WAN2_conn new-routing-mark=to_WAN2 passthrough=no
/ip firewall mangle add action=mark-routing chain=output connection-mark=WAN3_conn new-routing-mark=to_WAN3 passthrough=no
Your NAT configuration and routes appear to be alright.
PS: What I refer to as “common multi-WAN problem” is when traffic is entering through one WAN interface and then due to improper configuration leaves through another one. Simple rule of the thumb to remember: whatever enters, must exit from where it came from.