2 SSTP clients to same remote IP, each VPN through different ISP

I need to connect two SSTP clients to one remote SSTP Server through two different ISP:

/interface ethernet
set [ find default-name=ether1 ] comment=ISP1 name=ether1-ISP1
set [ find default-name=ether2 ] comment=ISP2 name=ether1-ISP2

/interface sstp-client
add authentication=mschap2 connect-to=111.111.111.1:443 disabled=no http-proxy=0.0.0.0:0 keepalive-timeout=30 name=sstp-out1 password=pass1 pfs=yes profile=sstp1 \
    tls-version=only-1.2 user=user1
add authentication=mschap2 connect-to=111.111.111.1:443 disabled=no http-proxy=0.0.0.0:0 keepalive-timeout=30 name=sstp-out1 password=pass2 pfs=yes profile=sstp2 \
    tls-version=only-1.2 user=user2

The superior option is to give the remote server a second public IP (“.2” in your examples) and then set routing toward the separate ISPs:


/ip/route
add dst-address=111.111.111.1 gateway=ether1
add dst-address=111.111.111.2 gateway=ether2

If that is impossible, then you might be able to achieve the same results with switch chip rules, provided you can set up two different TCP target ports to make the distinction with:


/interface/ethernet/switch/rule
add dst-address=111.111.111.1 dst-port=443 new-dst-ports=ether1
add dst-address=111.111.111.1 dst-port=444 new-dst-ports=ether2

You don’t need both rules; I’m showing both for clarity only. The default behavior should include one of these two, so that you need the second only to override this default behavior.

This is dirty, ugly, and you should feel ashamed at having to do this. :slight_smile: Try to do it with routing instead, if you can.