Disable hEX Ethernet port depending on which WAN port is active

RouterOS General
1

In my previous post, I was asking about how a particular documented fail over method actually worked. This is an associated post. The scenario is a wedding barn where they take cashless payments, i.e. the card readers have to work if the main internet link fails - hence the fail over to a mobile phone hot spot; which is working a treat.

However, normally there are three UBNT access points used by wedding clients to upload pictures of the happy couple etc. These are connected to a MikroTik 5-port PoE switch which is in turn connected to the main hEX router.

In the fail over scenario, I’d like to consider one of two things: firstly disabling the hEX ethernet port entirely - so sorry, no Wi-FI everyone but at least we can still take your money :slight_smile: Secondly, leaving the port open but putting some serious throttling on there.

Any pointers how to go about achieving this? I’m guessing it’s going to be a scheduled script (already have one to fix up the routing tables with the dynamic gateway addresses) that somehow determines which is the current live WAN port. Maybe those flags on the left? The live one seems to have DAS there and the other DS. A for active?

I know how to manage throttling on a port so once the above is solved I can either disable the port or enable/disable queue/throttle?

Thanks in advance… all a bit of a learning curve

2

You don’t need to disable any ports, it should be possible with static firewall config. Normally the traffic will go from some LAN (or Guest) interface to ether1-ISP1. Backup will use ether2-ISP2. So create your firewall in a way that traffic from LAN/Guest to ether1-ISP1 is allowed, and from LAN/Guest to ether2-ISP2 blocked. I’m not sure about queues, I don’t use them much, but something similar may be possible too.

3

Ahh good idea about looking at the firewall and blocking some paths. Later…