hi there

i just configured a RB750 with three adsl lines same isp with static ip and one port is a single LAN

the three lines are working perfectly

port 1,2,3 for adsl lines with pppoe
port 4 is the single lan

behind port 4 is another mikrotik RB750

all my clients are connectet to the second RB750 ( port one for internet from first RB750, port 2 for lan clients, port 3,4,5 for wireless clients with AP)

my problem is that i can't controll the mikrotik's of clients ( i can't open either the second RB750 but i can ping it). the clients dont have problems. i just want to manage them but i cant

here is my configuration

/ ip address
add address=192.168.1.1/24 network=192.168.1.0 broadcast=192.168.1.255 interface=Local

/ ip firewall mangle
add chain=input in-interface=PPPOE1 action=mark-connection new-connection-mark=LINE1
add chain=input in-interface=PPPOE2 action=mark-connection new-connection-mark=LINE2
add chain=input in-interface=PPPOE3 action=mark-connection new-connection-mark=LINE3
add chain=output connection-mark=LINE1 action=mark-routing new-routing-mark=to_LINE1
add chain=output connection-mark=LINE2 action=mark-routing new-routing-mark=to_LINE2
add chain=output connection-mark=LINE3 action=mark-routing new-routing-mark=to_LINE3
add chain=prerouting dst-address-type=!local in-interface=Local per-connection-classifier=both-addresses:3/0 \
action=mark-connection new-connection-mark=LINE1 passthrough=yes
add chain=prerouting dst-address-type=!local in-interface=Local per-connection-classifier=both-addresses:3/1 \
action=mark-connection new-connection-mark=LINE2 passthrough=yes
add chain=prerouting dst-address-type=!local in-interface=Local per-connection-classifier=both-addresses:3/2 \
action=mark-connection new-connection-mark=LINE3 passthrough=yes
add chain=prerouting connection-mark=LINE1 in-interface=Local action=mark-routing new-routing-mark=to_LINE1
add chain=prerouting connection-mark=LINE2 in-interface=Local action=mark-routing new-routing-mark=to_LINE2
add chain=prerouting connection-mark=LINE3 in-interface=Local action=mark-routing new-routing-mark=to_LINE3

/ ip route
add dst-address=0.0.0.0/0 gateway=LINE1 routing-mark=to_LINE1 check-gateway=ping
add dst-address=0.0.0.0/0 gateway=LINE2 routing-mark=to_LINE2 check-gateway=ping
add dst-address=0.0.0.0/0 gateway=LINE3 routing-mark=to_LINE3 check-gateway=ping
add dst-address=0.0.0.0/0 gateway=LINE1 distance=1 check-gateway=ping
add dst-address=0.0.0.0/0 gateway=LINE2 distance=2 check-gateway=ping
add dst-address=0.0.0.0/0 gateway=LINE3 distance=3 check-gateway=ping

/ ip firewall nat
add chain=srcnat out-interface=LINE1 action=masquerade
add chain=srcnat out-interface=LINE2 action=masquerade
add chain=srcnat out-interface=LINE3 action=masquerade

please any idea, what i am missing ???

ps: is any problem with the lines becouse the bandwidth are different

LINE1 5 MB
LINE2 3,5 MB does PCC devide the trafic or i have to add more rules ???
LINE3 2 MB

I create a pptp
i am connected with pptp i cant ping second RB750 i can't login in it

i create a nat rule

/ip firewall nat

add chain=srcnat action=src-nat to-addresses=192.168.1.1 src-address=170.14.1.2


170.14.1.2 is the remote ip address for pptp

now i can login to the second rb750 and login to the clients

but when i disconect the pptp i cant

what rule is missing ???

where are the veterans???

no one can help ?

If you want to access your 750 directly you need a specific NAT rule with one of the public IP addresses and the appropriate mangle rules to mark the incoming connection so it knows what route to send the connection out of. Without this the router could send the replies out of the wrong interface and the connection won't work. If you want to use your PPTP tunnel, be sure that the "remote address" is an IP on a different subnet than what is on the LAN, otherwise the 750 will think you are a local address and will not use it's default gateway to get back to you.

If you want to access your 750 directly you need a specific NAT rule with one of the public IP addresses and the appropriate mangle rules to mark the incoming connection so it knows what route to send the connection out of. Without this the router could send the replies out of the wrong interface and the connection won't work.

Code: Select all

add action=mark-connection chain=forward comment="" connection-state=new disabled=no in-interface=ether1 new-connection-mark=outside1_connection passthrough=no
add action=mark-routing chain=prerouting comment="" connection-mark=outside1_connection disabled=no new-routing-mark=to_outside1 passthrough=no 

If you want to use your PPTP tunnel, be sure that the "remote address" is an IP on a different subnet than what is on the LAN, otherwise the 750 will think you are a local address and will not use it's default gateway to get back to you.

I resolve my problem

thank you Feklar

someone have mikrotik hotspot load balancing configuration please help me how to configure that?