Can someone help me set up 2 wan ports on my Mikrotik?

RouterOS General
1

I have seen a few videos and a few articles on this topic but it seems overwhelmingly complex?

I need to put my ISP1 into Ethernet port 1 and my ISP2 into Ethernet port 2, ports 3 to 5 will be lan ports.

I am not sure if someone can walk through this with me please as I am not only very new to this type of systems but I am also struggling with the online guides in how to do this?

My goal is to utilize port 1 for almost 100% of the time for internet but if it fails or gets slow to take the load from port2 (LTE router)

2

So basically you want a “main” WAN and a “failover” one.

The simplest method is (IMHO) this one:
http://forum.mikrotik.com/t/simpler-failover-for-two-gateways-i-found-working/169108/1
further simplified in this post:
http://forum.mikrotik.com/t/simpler-failover-for-two-gateways-i-found-working/169108/1

If you have difficulties in following it, just say so.

A good idea in case of issues would be to post your config, instructions here:
http://forum.mikrotik.com/t/forum-rules/173010/1

3

There is no point in providing you a stock setup if you dont understand some basics before doing so.
As well we need to know the requirements.
A start was the primary. failover wan setup.
How many subnets do you need.
What type of device do you have
Do you plan on doing any VPN like wireguard
Do you plan to forward any ports.

check out these three fellas for decent videos and start with basics !!!
https://www.youtube.com/@TheNetworkBerg/videos
https://www.youtube.com/@TheNetworkTrip/videos
https://www.youtube.com/@MAICT/playlists

If you want a pay option…
https://networktik.com/courses/mikrotik-ros-v7/entry-level/

4

Honestly this latter post is a bit right to say I need to learn the basics first, because I reviewed the above information and it seems I am still doing something wrong?

5

I’ve attached a screen shot of /export and if maybe someone can look through it and tell me if I am doing something wrong?

[admin@RouterOS] > /export

jan/02/1970 11:57:21 by RouterOS 6.48.7

software id = KDN6-1P76

model = RBD52G-5HacD2HnD

serial number = HE808SVJ3SN

/interface bridge
add admin-mac=48:A9:8A:84:73:1F auto-mac=no comment=defconf name=bridge
/interface ethernet
set [ find default-name=ether1 ] name=Wan1
set [ find default-name=ether2 ] name=Wan2
/interface wireless
set [ find default-name=wlan1 ] band=2ghz-b/g/n channel-width=20/40mhz-XX country=“south africa” disabled=no distance=indoors frequency=auto installation=indoor mode=ap-bridge \ ssid=MikroTik-847323 wireless-protocol=802.11
set [ find default-name=wlan2 ] band=5ghz-a/n/ac channel-width=20/40/80mhz-XXXX country=“south africa” disabled=no distance=indoors frequency=auto installation=indoor mode=\ ap-bridge ssid=MikroTik-847324 wireless-protocol=802.11
/interface list
add comment=defconf name=WAN
add comment=defconf name=LAN
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
/ip pool
add name=dhcp ranges=192.168.88.10-192.168.88.254
/ip dhcp-server
add address-pool=dhcp disabled=no interface=bridge name=defconf
/interface bridge port
add bridge=bridge comment=defconf interface=ether3
add bridge=bridge comment=defconf interface=ether4
add bridge=bridge comment=defconf interface=ether5
add bridge=bridge comment=defconf interface=wlan1
add bridge=bridge comment=defconf interface=wlan2
/ip neighbor discovery-settings
set discover-interface-list=LAN
/interface list member
add comment=defconf interface=bridge list=LAN
add comment=defconf interface=Wan1 list=WAN
add interface=Wan2 list=WAN
/ip address
add address=192.168.88.1/24 comment=defconf interface=bridge network=192.168.88.0
add address=192.168.0.1 interface=Wan1 network=192.168.0.1
add address=192.168.1.100 interface=Wan2 network=192.168.1.100
/ip dhcp-client
add comment=defconf disabled=no interface=Wan1
add disabled=no interface=Wan2
/ip dhcp-server network
add address=192.168.88.0/24 comment=defconf gateway=192.168.88.1
/ip dns
set allow-remote-requests=yes
/ip dns static
add address=192.168.88.1 comment=defconf name=router.lan
/ip firewall filter
add action=accept chain=input comment=“defconf: accept established,related,untracked” connection-state=established,related,untracked
add action=drop chain=input comment=“defconf: drop invalid” connection-state=invalid
add action=accept chain=input comment=“defconf: accept ICMP” protocol=icmp
add action=accept chain=input comment=“defconf: accept to local loopback (for CAPsMAN)” dst-address=127.0.0.1
add action=drop chain=input comment=“defconf: drop all not coming from LAN” in-interface-list=!LAN
add action=accept chain=forward comment=“defconf: accept in ipsec policy” ipsec-policy=in,ipsec
add action=accept chain=forward comment=“defconf: accept out ipsec policy” ipsec-policy=out,ipsec add action=fasttrack-connection chain=forward comment=“defconf: fasttrack” connection-state=established,related
add action=accept chain=forward comment=“defconf: accept established,related, untracked” connection-state=established,related,untracked
add action=drop chain=forward comment=“defconf: drop invalid” connection-state=invalid
add action=drop chain=forward comment=“defconf: drop all from WAN not DSTNATed” connection-nat-state=!dstnat connection-state=new in-interface-list=WAN
/ip firewall nat
add action=masquerade chain=srcnat comment=“defconf: masquerade” ipsec-policy=out,none out-interface-list=WAN
/ip route
add check-gateway=ping distance=1 gateway=192.168.0.1
add check-gateway=ping distance=2 gateway=192.168.1.100
/system identity set name=RouterOS /tool mac-server set allowed-interface-list=LAN
/tool mac-server mac-winbox
set allowed-interface-list=LAN
[admin@RouterOS] >

6

This stands out

/ip address
add address=192.168.88.1/24 comment=defconf interface=bridge network=192.168.88.0
add address=192.168.0.1 interface=Wan1 network=192.168.0.1
add address=192.168.1.100 interface=Wan2 network=192.168.1.100
/ip dhcp-client
add comment=defconf disabled=no interface=Wan1
add disabled=no interface=Wan2

You are assigning a static IP to each WAN then attaching a dhcp client so I assume that is an ISP address.

The failover won’t work because 192.168.0.1 and 192.168.1.100 are on this router they will always be pingable.
So even when 192.168.0.1 has no internet traffic will still try to go out it
The dhcp clients is where you need the distance 1 for isp1 and 2 for isp2.

7

Also, unless you did it on purpose, you set /32 addresses. Normally those would be /24 (a network of 256 addresses of which 254 are usable, netmask 255.255.255.0 in the “other” notation, these networks have the last number as 0)

/ip address
add address=192.168.88.1/24 comment=defconf interface=bridge network=192.168.88.0
add address=192.168.0.1/24 interface=Wan1 network=192.168.0.0
add address=192.168.1.100/24 interface=Wan2 network=192.168.1.0

It is quite common, when you set an IP address the network is set automatically so you must specify the cdr network mask, otherwise ROS will assume you want a /32 one.

Right now, BTW, your static routes are “using self”:

/ip route
add check-gateway=ping distance=1 gateway=192.168.0.1
add check-gateway=ping distance=2 gateway=192.168.1.100

192.168.0.1 and 192.168.1.100 are the addresses you just gave to your WAN1 and WAN2 interfaces, so they are “internal” to the router, while gateway should be “next hop”.

Since you have DHCP client(s) enabled, beside the configuration, you should post also the output of the commands:

/ip address print

and

/ip route print

so that we can see also the Dynamic addresses and routes.