Hello everyone
at first, I apologize if my post is repetitious, my search for a good result was unsuccessful and also I have not enough time, thank you if there are any links or hints.
suppose my scenario as follows:
I have 2 WAN link:
ether1-WAN1 → 1.1.1.1 (public IP)
ether2-WAN2 → 2.2.2.2 (public IP)
I have 1 local network (192.168.70.0/24)
ether3-LAN → 192.168.70.1
I have 1 Server that is connected to ether3-LAN interface with remote desktop enabled:
Server IP: 192.168.70.20 Server Gateway: 192.168.70.1
what I want to do is:
remote desktop users be enable connect to server with both WAN links ( 1.1.1.1 and 2.2.2.2).
Are the public IPs, static or dynamic? Same provider or different provider.
RDP is not secure, dont recommend.
Much better off installing wireguard and have your users securely access the router and then you can have them access any LAN device, including an RDP server from the LAN side.
thanks for your reply and warning about rdp (there are some conditions that VPN is not possible, so ignore this issue)
both IP are static from different provider
…
my server has 2 network card, can I add another IP to server and solve the problem
for example:
my server IPs: 192.168.70.20 and 192.168.80.20 (gateway: 192.168.70.1)
ether3-LAN2 → 192.168.80.1
/ ip route
Assuming either default routes are in place or manual routes for both ISPs in MAIN TABLE.
{ add distance=1 check-gateway=ping dst-address=0.0.0.0/0 gateway=1.1.1.1 routing-table=main
{ add distance=2 check-gateway=ping dst-address=0.0.0.0/0 gateway=2.2.2.2 routing-table=main
PLUS
add dst-address=0.0.0.0/0 gateway=1.1.1.1 distance=1 routing-mark=to_WAN1
add dst-address=0.0.0.0/0 gateway=2.2.2.2 distance=1 routing-mark=to_WAN2
MODIFY FAST TRACK RULES IN forward chain by simply adding connection-mark=no-mark
++++++++++++++++++++++++++++++++++++++++++
Nothing changes from the above if you prefer to use two different nics…
Thank you very much!
now, users can access server from both public IPs, but only there is another problem
RDP works randomly, after every 3-4 times, users can not connect and should wait some seconds or minutes.
I put fasttrack on the top of other mangles:
add action=fasttrack-connection chain=forward connection-mark=no-mark
is it in correct place?
my RouterOS version is 7.13.5
how can I solve this problem.
thanks again
The fastrack rule is NOT a mangle rule its a forward chain filter rule and should be typically the first forward chain rule.
Without seeing the whole config ( less any public IP info ) will be hard to pinpoint the issue
ether2-AntenPishgamanWAN has a ppoe-client connection with public IP (x.y.z.89)
there is an GRE tunnel with another company branch (x.y.z.126)
ether1-SimCardWAN is connected to a GSM Modem, the IP of GSM Modem is 192.168.43.1 and is DMZ to 192.168.43.2 (my router), GSM Public IP is x.y.z.178
with following config users can connect only with x.y.z.89 and trying to connect with x.y.z.178 will stuck on "configuring remote session ..."
as I notice there is no packet counter with ether1-SimCardWAN NAT rule.
............................................................................
In your case, better to simply replace in-interface-list=LAN with: in-interface-list=SERVERS
where you add all your Server IPs.
/ip firewall address-list
add address192.168.70.4 list=SERVERS
add address=192.168.70.5 list=SERVERS
add address=192.168.70.6 list=SERVERS
add address=192.168.70.12 list=SERVERS
etc…
\
Firewall rules are incomplete…
/ip firewall filter
add action=accept chain=input comment=“defconf: accept established,related,untracked” connection-state=
established,related,untracked
add action=drop chain=input comment=“defconf: drop invalid” connection-state=invalid
add action=accept chain=input comment=“defconf: accept ICMP” protocol=icmp
add action=accept chain=input comment=“defconf: accept to local loopback (for CAPsMAN)” dst-address=127.0.0.1
add action=accept chain=input comment=“allow LAN to Router traffic” in-interface-list=LAN
==== add any more allow rules here ==== perhaps for gre tunnel???
add action=drop chain=input comment=“drop all else”
+++++++++++++++++++++++++++++++++++++++++++
add action=fasttrack-connection chain=forward comment=“defconf: fasttrack” connection-state=established,related
hw-offload=yes connection-mark=no-mark
add action=accept chain=forward comment=“defconf: accept established,related, untracked” connection-state=
established,related,untracked
add action=drop chain=forward comment=“defconf: drop invalid” connection-state=invalid
add action=accept chain=forward comment=“internet traffic” in-interface-list=LAN out-interface-list=WAN
add action=accept chain=forward comment=“port forwarding” connection-nat-state=dstnat
==== add any more allow rules here ==== perhaps for gre tunnel???
add action=drop chain=forward comment=“drop all else”_