Hi, I have 2 ISPs (names are VTR and TELSUR), and own a Mikrotik RB2011UiAS-2HnD-IN router.
I wish I could configure the router to have both WAN connections, and route traffic to them based on VLAN (or maybe on source network). My plan is to have 2 SSID, each on its own VLAN, and that depending on which wifi SSID a devices connects to, route that traffic through one WAN or the other.
I will use separated Access Points, not the one incorporated into the MikroTik router.
I am first testing the configuration using ethernet cables, and I am stuck on how to make both WAN connections work at the same time.
For example, currently I have:
- VLAN 86: network 192.168.86.0/24, router IP: 192.168.86.1, dhcp server and pool
- VLAN 87: network 192.168.87.0/24, router IP: 192.168.87.1, dhcp server and pool
VLAN configuration is working.
Can someone give me ideas, on how to configure the router, so VLAN 86 gets routed through isp VTR, and VLAN 87 gets routed through isp TELSUR?
For TELSUR, pppoe connection. For VTR, DHCP (cablemodem).
Here is the configuration:
[admin@MikroTik] > export
# jan/02/2017 12:02:05 by RouterOS 6.37.3
# software id = 7H9U-CE6U
#
/interface bridge
add admin-mac=E4:8D:8C:24:C8:0A auto-mac=no comment=defconf name=bridge
add name=bridge-vlan86
add name=bridge-vlan87
/interface pppoe-client
add add-default-route=yes allow=pap,chap interface=ether2 name=pppoe_telsur password=xxxx user=yyyy
/interface wireless
set [ find default-name=wlan1 ] band=2ghz-onlyn channel-width=20/40mhz-eC disabled=no distance=indoors frequency=auto mode=ap-bridge ssid=wifi_vtr wireless-protocol=802.11
/ip neighbor discovery
set ether1 discover=no
set bridge comment=defconf
/interface vlan
add comment=none interface=ether8 name=VLAN_TELSUR vlan-id=87
add interface=ether7 name=VLAN_VTR vlan-id=86
/ip neighbor discovery
set VLAN_TELSUR comment=none
/interface ethernet switch port
set 7 default-vlan-id=86
set 9 default-vlan-id=86 vlan-header=add-if-missing
/interface wireless security-profiles
set [ find default=yes ] authentication-types=wpa2-psk mode=dynamic-keys wpa-pre-shared-key=zzzz wpa2-pre-shared-key=zzzz
/ip pool
add name=dhcp ranges=192.168.88.10-192.168.88.254
add name=pool_vtr ranges=192.168.86.20-192.168.86.200
add name=pool_telsur ranges=192.168.87.20-192.168.87.200
/ip dhcp-server
add address-pool=dhcp disabled=no interface=bridge name=defconf
add address-pool=pool_telsur disabled=no interface=bridge-vlan87 name=dhcp_telsur
add address-pool=pool_vtr disabled=no interface=bridge-vlan86 name=dhcp_vtr
/interface bridge port
add bridge=bridge comment=defconf interface=ether6
add bridge=bridge-vlan86 interface=VLAN_VTR
add bridge=bridge-vlan86 interface=ether9
add bridge=bridge-vlan87 interface=VLAN_TELSUR
add bridge=bridge-vlan87 interface=ether8
add bridge=bridge-vlan86 interface=wlan1
/ip address
add address=192.168.88.1/24 comment=defconf interface=ether2 network=192.168.88.0
add address=192.168.86.1/24 interface=VLAN_VTR network=192.168.86.0
add address=192.168.87.1/24 interface=VLAN_TELSUR network=192.168.87.0
/ip dhcp-client
add comment=defconf dhcp-options=hostname,clientid disabled=no interface=ether1 use-peer-dns=no
/ip dhcp-server network
add address=192.168.86.0/24 dns-server=192.168.86.1 gateway=192.168.86.1
add address=192.168.87.0/24 dns-server=192.168.87.1 gateway=192.168.87.1
add address=192.168.88.0/24 comment=defconf gateway=192.168.88.1
/ip dns
set allow-remote-requests=yes servers=8.8.8.8,8.8.4.4
/ip dns static
add address=192.168.88.1 name=router
/ip firewall filter
add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp
add action=accept chain=input comment="defconf: accept established,related" connection-state=established,related
add action=drop chain=input comment="defconf: drop all from WAN" in-interface=ether1
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" connection-state=established,related
add action=accept chain=forward comment="defconf: accept established,related" connection-state=established,related
add action=drop chain=forward comment="defconf: drop invalid" connection-state=invalid
add action=drop chain=forward comment="defconf: drop all from WAN not DSTNATed" connection-nat-state=!dstnat connection-state=new in-interface=ether1
# pppoe_telsur not ready
add action=drop chain=input comment="drop all from WAN telsur" in-interface=pppoe_telsur
# pppoe_telsur not ready
add action=drop chain=forward comment="drop all from WAN telsur not DSTNATed" connection-nat-state=!dstnat connection-state=new in-interface=pppoe_telsur
/ip firewall nat
add action=masquerade chain=srcnat comment="defconf: masquerade" out-interface=ether1
add action=masquerade chain=srcnat log=yes out-interface=ether2
/system clock
set time-zone-name=America/Santiago
/system logging
add topics=pppoe
add topics=ppp
add topics=interface
/tool mac-server
set [ find default=yes ] disabled=yes
add interface=bridge
/tool mac-server mac-winbox
set [ find default=yes ] disabled=yes
add interface=bridge
I currently have TELSUR disabled. I tried adding default (0.0.0.0/0) routes, using the pref-src parameter to specify the 2 internal networks. But I lost connection to the internet from my pc. Maybe this is the way, but got a misconfiguration?
Any recommendation?
Thanks!