Community discussions

MikroTik App
 
heich
just joined
Topic Author
Posts: 10
Joined: Tue Sep 28, 2010 5:12 pm

Firewall. Identify Scripts traffic

Thu Jun 28, 2012 9:51 pm

Hi everyone!

First of all, i want to apologize for my english, I'll try to explain myself the best i can.

The scenario:
RB750 with Routeros 5.18
I have 2 ADSL WAN interfaces.

I'm configuring a per port Load Balancing and Script Failover.

*WAN1 will manage all the traffic for a specific port (RDP to a specific server), and related connections.
*WAN2 will manage all the remaining traffic (HTTP, HTTPS, etc), and related connections.

My failover script, uses fetch command to download 2 small files, one from RDP Server, and other one from an external internet site. After downloading them, the script validates the time they took to download both of them, takes decisions based upon the faster download, and activates/deactivates mangle rules specific for each result.

The RDP Server is publishing its file over http on port 8024. It's considered into fetch command.

2 of the above mangle rules, are for routing the RDP protocol over a WAN interface. 2 more rules are used to route all the remaining traffic to the other WAN interface.

At this moment, the script and the mangle rules are working fine. However, i need to test the RDP Server over a specific WAN.

I have tried to identify this request on port 8024 from the script, using mangle rules - to mark it and route it accordingly- without success.

So, the question is:
is there some way to identify a script fetch command request, and to put a router mark on it's traffic?

These are my mangle rules, where i mark rdp traffic over a specific WAN Interface, and remaining traffic over another WAN interface.
(there are 2 more rules, disabled, wich can be enabled by the failover script)
add action=mark-connection chain=prerouting comment=RDP-WAN1 disabled=no \
    dst-address-type=!local dst-port=3389 in-interface=eth3-LAN \
    new-connection-mark=WAN1_IN passthrough=yes protocol=tcp
add action=mark-connection chain=prerouting comment=TODOS-WAN2 disabled=yes \
    dst-address-type=!local dst-port=!3389 in-interface=eth3-LAN \
    new-connection-mark=WAN2_IN passthrough=yes protocol=tcp


These are the final mangle rules, where I put the corresponding output routing mark
add action=mark-routing chain=prerouting comment="Marca en prerouting el trafi\
    co de salida que fue separado por cada interfaz" connection-mark=WAN1_IN \
    disabled=no in-interface=eth3-LAN new-routing-mark=TO_WAN1 passthrough=\
    yes
add action=mark-routing chain=prerouting connection-mark=WAN2_IN disabled=no \
    in-interface=eth3-LAN new-routing-mark=TO_WAN2 passthrough=yes

Thanks in advanced

Best regards

Who is online

Users browsing this forum: Amaan, GoogleOther [Bot], shahzaddj1 and 178 guests