I’m trying to setup mangle rules to create load balancing but I’m battling to decide between using prerouting and input chain. I’ve done some reading but still can’t wrap my head around when to use which rule.
My setup:
/ip address
add address=172.16.0.1/24 interface=Local-slave5
add address=10.1.1.2/24 interface=WAN1
add address=10.2.2.2/24 interface=WAN2
add address=10.3.3.2/24 interface=WAN3
/ip firewall mangle
add action=accept chain=prerouting disabled=no dst-address=10.1.1.0/24 in-interface=Local-slave5
add action=accept chain=prerouting disabled=no dst-address=10.2.2.0/24 in-interface=Local-slave5
add action=accept chain=prerouting disabled=no dst-address=10.3.3.0/24 in-interface=Local-slave5
add action=mark-connection chain=prerouting connection-mark=no-mark disabled=no dst-address-type=!local in-interface=Local-slave5 new-connection-mark=WAN1_mark passthrough=yes per-connection-classifier=both-addresses-and-ports:3/0
add action=mark-connection chain=prerouting connection-mark=no-mark disabled=no dst-address-type=!local in-interface=Local-slave5 new-connection-mark=WAN2_mark passthrough=yes per-connection-classifier=both-addresses-and-ports:3/1
add action=mark-connection chain=prerouting connection-mark=no-mark disabled=no dst-address-type=!local in-interface=Local-slave5 new-connection-mark=WAN3_mark passthrough=yes per-connection-classifier=both-addresses-and-ports:3/2
add action=mark-routing chain=prerouting connection-mark=WAN1_mark disabled=no in-interface=Local-slave5 new-routing-mark=to_WAN1 passthrough=yes
add action=mark-routing chain=prerouting connection-mark=WAN2_mark disabled=no in-interface=Local-slave5 new-routing-mark=to_WAN2 passthrough=yes
add action=mark-routing chain=prerouting connection-mark=WAN3_mark disabled=no in-interface=Local-slave5 new-routing-mark=to_WAN3 passthrough=yes
add action=mark-routing chain=output connection-mark=WAN1_mark disabled=no new-routing-mark=to_WAN1 passthrough=yes
add action=mark-routing chain=output connection-mark=WAN2_mark disabled=no new-routing-mark=to_WAN2 passthrough=yes
add action=mark-routing chain=output connection-mark=WAN3_mark disabled=no new-routing-mark=to_WAN3 passthrough=yes
I need to create the marks for the incoming packets but which is better (prerouting or input chain):
add action=mark-connection chain=prerouting connection-mark=no-mark disabled=no in-interface=WAN1 new-connection-mark=WAN1_mark passthrough=yes
add action=mark-connection chain=prerouting connection-mark=no-mark disabled=no in-interface=WAN2 new-connection-mark=WAN2_mark passthrough=yes
add action=mark-connection chain=prerouting connection-mark=no-mark disabled=no in-interface=WAN3 new-connection-mark=WAN3_mark passthrough=yes
or
add action=mark-connection chain=input disabled=no new-connection-mark=WAN1_mark in-interface=WAN1 passthrough=yes
add action=mark-connection chain=input disabled=no new-connection-mark=WAN2_mark in-interface=WAN2 passthrough=yes
add action=mark-connection chain=input disabled=no new-connection-mark=WAN3_mark in-interface=WAN3 passthrough=yes