Having some issues with something that I imagine is very simple, and I’m missing a step, and I’m not sure why Mikrotik has a hard time learning the info. I’ve found generalized information on this, but it seems most are related to a bridged L2 network.
I have an OSPF network, that runs wireless out to many different locations. We have multiple WAN’s as backup/more data as well. Normally we had all OSPF traffic go out WAN1, and then WAN2, WAN3 as failover. Now with the network increasing, we need to dump traffic over WAN2 for more bandwidth. So, here’s what I have essentially.
Core router is a CCR2116 with a VPN setup on the core as well to access all devices connecting to network.
WAN1 → routing table main —> primary traffic 192.168.0.1/24 (routed interface via sfp1)
WAN2 → routing table secondary —> secondary traffic 192.168.0.2/24 (routed interface via sfp1)
WAN2 is accomplished via a mangle rule for pre-routing to say all 192.168.0.2/24 traffic goes out secondary routing table to WAN2. All internet works fine, and routes as expected. When I do the mangle rule to tell an IP block to go out secondary route, I cannot access devices via the VPN, core router etc. No pings. I’ve been trying to follow some guides, and done some IP routes to try and get myself to be able to communicate but none have been working.
So, what is the trick to have a block of IP’s go out a separate routing table, but, still be able to access this block of IP’s via my router, and my VPN. I would have thought the Mikrotik would just be logical, and understand that traffic as it is passing through it anyways.
Routing marks that are assigned to route tables have a very high priority.
There are a few options:
- You can force the packets to go via the routing rules, where you can set local network routes to be preferred.
- You can mark only the packets that need to leave your network.
- You can add additional routes for your local networks with that route mark.
For option 1.
You would make an additional route mark/table. Eg. ruleViaWan2
This then becomes the routing mark you would apply to the packets.
Then routing rules.
/routing rule
add action=lookup comment=“min-prefix=0, all except 0.0.0.0/0” disabled=no min-prefix=0 table=main
add action=lookup dst-address=0.0.0.0/0 routing-mark=ruleViaWan2 table=viaWan2
For IP blocks you might use a src-address specifier in the routing rule and not route mark packets at all.
Note:
Apparently the (very handy) rule below can get flaky if routes change
add action=lookup comment=“min-prefix=0, all except 0.0.0.0/0” disabled=no min-prefix=0 table=main
If this causes you problems you would need to add a bunch of rules for your local network in its place.
/routing rule
#internal route group 1
add action=lookup disabled=no dst-address=192.168.0.0/16 table=main
#internal route group 2
add action=lookup disabled=no dst-address=172.16.0.0/12 table=main
add action=lookup dst-address=0.0.0.0/0 routing-mark=ruleViaWan2 table=viaWan2
Awesome, that works! I thought it was either use mangle rules, or routing rules. Didn’t think to try them working together. Follow up question to this, since this now works. With the dual WAN setup we have, it is set so that if fiber A fails, all traffic rolls over to fiber B, and then we also have a 3rd fiber for extra redundancy. With these routing rules, I presume the failover won’t work as it was (it’s setup in routes with distance of 1,2,3 achieved via mangle rules telling IP’s to go to whichever fiber, then failover as needed). I’ll likely need to add more routing rules to tell the IP space to follow the other path if needed if I’m understanding correctly.
Sorry if I don’t make perfect sense. My knowledge of Mikrotik is all self taught, and piling through forums to learn what I can.
@MoparMagic
let me ask you this, from the looks of it you have WAN1 and WAN2 into separate table, is that right?