An issue with PCC load balancing

RouterOS General
1

Dear MikroTik fans,

I am having an issue with configuring PCC load balancing on an RB5009UG+S+IN router.
Here is the export from the mangle rules configuration:

/ip firewall mangle
add action=mark-connection chain=prerouting comment=ISP1
connection-mark=no-mark connection-state=new disabled=
yes dst-address-type=!local in-interface-list=LAN
new-connection-mark=ISP1_conn per-connection-classifier=
src-address:2/0
add action=mark-connection chain=prerouting comment=ISP2
connection-mark=no-mark connection-state=new disabled=
yes dst-address-type=!local in-interface-list=LAN
new-connection-mark=ISP2_conn per-connection-classifier=
src-address:2/1
add action=mark-connection chain=prerouting comment=ISP1
connection-mark=no-mark connection-state=new disabled=
yes in-interface=ether1 new-connection-mark=ISP1_conn
add action=mark-connection chain=prerouting comment=ISP2
connection-mark=no-mark connection-state=new disabled=
yes in-interface=ether2 new-connection-mark=ISP2_conn
add action=mark-routing chain=prerouting comment=ISP1
connection-mark=ISP1_conn disabled=yes
in-interface-list=LAN new-routing-mark=to_ISP1
add action=mark-routing chain=prerouting comment=ISP2
connection-mark=ISP2_conn disabled=yes
in-interface-list=LAN new-routing-mark=to_ISP2
add action=mark-routing chain=output comment=ISP1
connection-mark=ISP1_conn disabled=yes new-routing-mark=
to_ISP1
add action=mark-routing chain=output comment=ISP2
connection-mark=ISP2_conn disabled=yes new-routing-mark=
to_ISP2

and from the NAT section:

/ip firewall nat
add action=masquerade chain=srcnat comment="defconf: masquerade" ipsec-policy=out,none out-interface-list=WAN routing-mark=to_ISP1
add action=masquerade chain=srcnat comment="defconf: masquerade" ipsec-policy=out,none out-interface-list=WAN routing-mark=to_ISP2
add action=masquerade chain=srcnat out-interface-list=WAN

In addition, I have 20 VLANs, though currently only a few of them are in use, a configured CAPsMAN, and one VPN connection. There are about 20–30 clients in total at the moment.

I have noticed the following: when I enable the mangle rules, the internet works for clients and PCC also works, but as soon as 2–3 clients are connected, the internet starts to slow down considerably. When I disable the mangle rules, everything works perfectly.

The CPU load is low, and fasttrack is enabled in the forward chain of the firewall.

My question is: what could be the reason for this behavior? Is the router not powerful enough for this configuration, even though the overall load seems to be quite low? My objective is to make this configuration work with WAN failover.

Please assist me in finding a solution.
Best regards.

2

This is usually the cause of the issue right here! Fasttrack is incompatible with mangle mark-routing. If the connections are to be used with mark-routing then they must be excluded from being fasttracked. A quick fix, based on the way you setup your mangle rules, is to modify the fasttrack-connection rule and add to it the condition connection-mark=no-mark. Connections using PCC will then no longer be fasttracked, and the load on the router will be higher.

But, looking at the way you setup your PCC and use it only for 50-50 distribution to your two WAN. It might be better if you just use ECMP (which is compatible with fasttrack).

3

I dont comment on partial configs, but cgg is correct IF.....
a. your Two ISPs have roughly the same throughput then ECMP is much easier configuration approach.
b. your Two ISPs have a much different throughput lets say 2/3 1/3, in which case PCC is warranted and thus his noting that you have setup more like a 50:50 relationship with your mangling.

vice something like,
isp1 3:0
isp2 3:1
isp1 3:2

AND you dont need connection-state=new either,,,,,,,extra for nothing gained in your case.
Ensure the fastrack rule looks like:

add action=fasttrack-connection chain=forward comment="defconf: fasttrack" \
    connection-state=established,related connection-mark=no-mark
4

Dear CGGXANNX and anav, thank you so much for your help! I deeply appreciate your assistance, because I have been configuring the PCC load balancing for several months and always facing with various pitfalls. But now it works perfectly after adding connection-mark=no-mark in the fasttrack-connection rule!

Yes, indeed my 2 ISPs have the same bandwidth, and maybe on another office I will try to configure ECMP.

5

For ECMP, no mangling for PCC is required, just ensure the main table routes for both WANS are identical.