complicated routing and i am confused!

RouterOS General
1

Basically my setup i need to get working is this. (all WAN links are PPOE)
WAN1 = TPG (general traffic goes out this and never goes out WAN2 even if WAN 1 goes down.)
WAN2 = aaNet (web traffic from LAN goes out this, DNS, VOIP etc but if down this traffic uses WAN1)
Note that incomming connections should be treated differently on the different WANs and may map to different PC’s

LAN = 192.168.1.1/24 with DHCP server and set as gateway on all machines
aaNet-modem = 10.0.0.1/30 no dhcp and no default gateway for items on this network.
TPG-modem = 10.0.0.5/30 no dhcp and no default gateway for items on this network.
Hotspot = 192.168.10.1/24 with DHCP server and set as gateway on all machines
HomeWifi = 192.168.2.1/24 with DHCP server and set as gateway on all machines

LAN can access LAN, aaNet-modem, TPG-modem, HomeWifi, router, internet.
HomeWifi can access LAN, HomeWifi, internet.
Hotspot can access Hotspot, internet.
aaNet-modem can’t access anything.
TPG-modem can’t access anything.

incoming ports
aaNet
22 → 192.168.1.15
80 - > 192.168.1.15
10000 → 192.168.1.15
TPG
22 → router
80 → 192.168.1.6

I am just having trouble working out what interfaces to put the snat or mascaraed on and getting the firewall rules protecting my networks correctly. I have it partly working with one internet connection but i am worried my router is not secure and i can;t get port forwarding working so wanted to start from scratch. I have been reading the wiki but find the different setups conflicting.

*** EDIT ***
One other thing i would like to do but don’t think is possible is to have a shared cache for web traffic but depending on the source of the original request a different wan connection would be used to get the data if it is not in the cache. based on the rules above.

Hopefully someone can help me get started.

Chris

2

You need to put your src-nat/masquerade rules on the outgoing interfaces?

If your are terminating the PPPoE session on your Mikrotik router then just use a rule like this

1 chain=srcnat action=masquerade src-address=192.168.1.0/24 out-interface=pppoe-out-TPG
2 chain=srcnat action=masquerade src-address=192.168.1.0/24 out-interface=pppoe-out-aaNet


IF you are terminating the sessions on your modems and using them as routers, you will have to set them up to do src-nat/masquerade AND make sure they have a static route to find your 192.168.1.0/24 network

3

ok that is what i have done and that part is working for one route anyway. but then i was having issues with data not flowing between my LAN, HomeWifi and modems. Internet was working for all as i chanced the src-address above to support that. not that i only have one connection enabled at the min as i am not sure about making sure some traffic from some hosts on set ports or traffic types goes out 1 connection and not the other or it prefers one then the other.