Hi
I have a mikrotik with a 10.1.1.254/24 lan interface and two WAN interfaces (WAN1 and WAN2). I would like to make all packets that come from the lan with destination port 5353 go out through the WAN1 link and all the others through the WAN2 interface. That is, only packets destined for the external service that runs on port 5353 use the WAN1 link, the rest of the traffic uses the WAN2 link.
example
thanks
I am not sure one can do this based on port traffic if the traffic is https but in any case…
it sounds like you will have to mangle (identify that traffic) and then create another route just for that connection.
If WAN1 is not to be used for any other traffic remove its default route so all traffic egresses via WAN2. Use mangle rules to firstly mark the desired connections, then apply policy routing with a routing table entry for the routing marks.
The wiki has pages on mangle rules https://wiki.mikrotik.com/wiki/Manual:IP/Firewall/Mangle and an example for load sharing https://wiki.mikrotik.com/wiki/Manual:PCC which you can use as a basis, you don’t need the per-connection-classifier rules, just one to mark packets with dst-port=5353
a configuration similar to this?
/ip firewall mangle
add action=mark-routing chain=prerouting dst-port=5353 new-routing-mark=\marcacaoVPN passthrough=yes protocol=tcp
/ip route
add distance=1 gateway=wan2
add distance=1 gateway=wan1 routing-mark=marcacaoVPN
is it necessary to use different distances on the IP Route?
Okay firstly in routing rules
I believe you need two rules for the normal routing table (main) and if you need another one, then add it as necessary.
Seeing as you want all users to use WAN 2.
Default route WAN2, distance = 5
Default route WAN1 distance = 10
Special Route WAN1 distance=2
Is what I would do, then there is no question that the special rule will be used ]
a. cause it has highest priority
b. cause it is specific to the marked traffic.
What I am not sure of in this case (marked traffic) if distance makes a difference???
For example if you had
Special route WAN1 distance=30 I think that the traffic marked would still go out this route because regardless of distance, you are telling the marked traffic to use this table and not the main table
I believe the router will see all the other traffic as unmarked and will not use that rule and thus will then route to the rule with highest distance aka in this instance wan2 with 5.
The distance value only decides between routes whose dst-address and routing-mark are identical.
Hmmmm, double hmmmmmmmmm, triple hmmmmmmmmmmmmmmmmmmmmmm
What do you mean by identical destination address??
Most source nat rules are masquerade, out-interface-list=WAN,
I have two different ISPs, so no way they are identical dst addresses but if I put a distance of 1 for one of them and 2 for the other, all my traffic goes out 1,
so what you said makes little sense to me.
Dst address being 0.0.0.0/0 (a.k.a. default) … so any packet going out to the wild (not being catched by other routes) will go via gateway with lower distance. And both default routes do have identical addresses. Mind that we’re not talking about gateway addresses, we’re talking about destination addresses.
I don’t worry as it’s not the first case like this.
“Identical” means “exactly the same”. And I am not talking about the gateway of the route, or about the destination address of the packet being routed - I’m talking about the dst-address parameters of the routes.
When a route for a packet is being chosen, the first thing to check is reachability of the routes’ gateways; unreachable routes are not taken into consideration. The next match is the routes’ routing-mark - if the packet has one assigned, and reachable routes with that routing-mark exist, only those routes are considered. If the packet has no routing-mark, only reachable routes without any routing-mark are considered. No routing-mark at all and routing-mark=main are treated the same.
Out of all the routes with the necessary routing-mark, those whose dst-address prefixes match the prefix of packet’s destination address are chosen; out of those, the ones with the longest prefix are chosen. And only if there is still more than one candidate, the value of distance decides among them.
In fact some steps above are taken already before a particular packet is being routed - reachability of routes is monitored continuously, and within each group of reachable routes with identical routing-mark and dst-address the one with lowest distance is marked as active, and only the active one from each group is used for the matching by routing-mark and longest prefix.
So imagine you have three routes:
When a packet to 192.168.11.24 is routed and gets routing-mark wan2 in /ip firewall mangle or /ip route rule, route 3. is used, even though route 2’s dst-address matches the 192.168.11.24 equally good and although route 2 has a lower value of distance.