Dual WAN config - i need some help

unhuzpt · October 15, 2025, 3:06pm

Hello all!

Kindly ask your support to untangle my brain on my setup. Trying here to configure my amazing RB5009 to use 2 WAN in a load balance and fail over. It would be great to have it working correctly as is now but i am grasping on the subject.

My setup is:

WAN1 - ether1: coaxial internet with fixed IP as i have the ISP router in front of the RB5009

WAN2 - ether6: fiber internet from ONT as DHCP client and vlan35

DNS - internal adguard home

Goal:

Policy based routing with load balance and fail over between the 2 WAN

IPTV box working fast ; is not from the ISP

For the moment things mostly work but i think i have maybe some asymmetric routing as sometimes pages fail to load or there is delay. What i have trouble mostly is how to setup the routing with the fiber as is dhcp client and i am not sure i have it correct; for the WAN1 as is fixed ip and gw i think i get it.

Can you please take a look in my config, specially on the routing side, and help me achieve my goal?

Thanks in advance for your time and help!

PS - For a home setup have some nice HW from Microtik

# 2025-10-15 12:05:09 by RouterOS 7.20.1
# software id = S4WN-FA1U
#
# model = RB5009UG+S+
# serial number = REDDACTED
/caps-man channel
add band=2ghz-b/g/n control-channel-width=20mhz name=aplite-2ghz tx-power=16
/interface bridge
add REDDACTED-mac=78:9A:REDDACTED auto-mac=no comment=defconf name=bridge
/interface ethernet
set [ find default-name=ether1 ] comment="WAN1 Fixed IP" name=ether1::COAX
set [ find default-name=ether2 ] name=ether2::LAN
set [ find default-name=ether3 ] name=ether3:LAN
set [ find default-name=ether4 ] name=ether4:LAN
set [ find default-name=ether5 ] name=ether5:LAN
set [ find default-name=ether6 ] comment="WAN2 VLAN 35" name=ether6::FIBER
set [ find default-name=ether7 ] name=ether7:LAN
set [ find default-name=ether8 ] name=ether8:LAN
/interface wireguard
add comment=back-to-home-vpn listen-port=REDDACTED mtu=1420 name=back-to-home-vpn
/interface vlan
add comment=ORANGE interface=ether6::FIBER name=wan-fiber:FIBER vlan-id=35
/caps-man datapath
add bridge=bridge name=aplite-sec
/caps-man security
add authentication-types=wpa2-psk name=aplite-sec
/caps-man configuration
add channel=aplite-2ghz country=REDDACTED datapath=aplite-sec installation=indoor mode=ap name=aplite-config-REDDACTED security=aplite-sec security.authentication-types=\
    wpa2-psk ssid=REDDACTED
add channel=aplite-2ghz country=REDDACTED datapath=aplite-sec installation=indoor mode=ap name=aplite-config-foffice security=aplite-sec security.authentication-types=\
    wpa2-psk ssid=REDDACTED
/caps-man interface
add channel=aplite-2ghz configuration=aplite-config-REDDACTED datapath=aplite-sec disabled=no l2mtu=1600 mac-address=REDDACTED master-interface=none name=ap-REDDACTED \
    radio-mac=REDDACTED radio-name=789A1888BB1B security=aplite-sec
add channel=aplite-2ghz configuration=aplite-config-foffice datapath=aplite-sec disabled=no l2mtu=1600 mac-address=REDDACTED master-interface=none name=\
    ap-REDDACTED-office radio-mac=REDDACTED radio-name=789A1888BB17 security=aplite-sec
/interface list
add comment=defconf name=WAN
add comment=defconf name=LAN
/interface wifi channel
add band=2ghz-ax disabled=no frequency=2412,2432,2452,2472 name=2ghz-home width=20mhz
add band=5ghz-ax disabled=no frequency=5180,5240,5745,5825 name=5ghz-home width=20/40mhz
/interface wifi datapath
add disabled=no name=default-home
/interface wifi security
add authentication-types=wpa2-psk,wpa3-psk disabled=no name=wifi-home wps=disable
/interface wifi configuration
add channel=2ghz-home channel.frequency=2412,2432,2452,2472 country=REDDACTED datapath=default-home disabled=no installation=indoor manager=capsman-or-local mode=ap \
    name=2ghz-home-REDDACTED security=wifi-home security.authentication-types=wpa2-psk,wpa3-psk .ft=yes .ft-over-ds=yes ssid=dragonball2g tx-power=21
add channel=5ghz-home channel.frequency=5180,5240,5745,5825 country=REDDACTED datapath=default-home disabled=no installation=indoor manager=capsman-or-local mode=ap \
    name=5ghz-home-REDDACTED security=wifi-home security.authentication-types=wpa2-psk,wpa3-psk .ft=yes .ft-over-ds=yes ssid=REDDACTED tx-power=21
add channel=5ghz-home channel.band=5ghz-ax .frequency=5180,5240,5745,5825 country=REDDACTED datapath=default-home disabled=no installation=indoor manager=\
    capsman-or-local mode=ap name=5ghz-home-REDDACTED security=wifi-home security.authentication-types=wpa2-psk,wpa3-psk .ft=yes .ft-over-ds=yes ssid=REDDACTED \
    tx-power=21
add channel=2ghz-home channel.frequency=2412,2432,2452,2472 country=REDDACTED datapath=default-home disabled=no installation=indoor manager=capsman-or-local mode=ap \
    name=2ghz-home-REDDACTED security=wifi-home security.authentication-types=wpa2-psk,wpa3-psk .ft=yes .ft-over-ds=yes ssid=dragonball2g tx-power=21
add channel=5ghz-home channel.band=5ghz-ax .frequency=5180,5240,5745,5825 country=REDDACTED datapath=default-home disabled=no installation=indoor manager=\
    capsman-or-local mode=ap name=5ghz-home-REDDACTED security=wifi-home security.authentication-types=wpa2-psk,wpa3-psk .ft=yes .ft-over-ds=yes ssid=REDDACTED \
    tx-power=21
add channel=2ghz-home channel.frequency=2412,2432,2452,2472 country=REDDACTED datapath=default-home disabled=no installation=indoor manager=capsman-or-local mode=ap \
    name=2ghz-home-REDDACTED security=wifi-home security.authentication-types=wpa2-psk,wpa3-psk .ft=yes .ft-over-ds=yes ssid=dragonball2g tx-power=21
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
/ip pool
add name=dhcp ranges=192.168.178.10-192.168.178.150
/ip dhcp-server
add address-pool=dhcp interface=bridge name=defconf
/routing table
add comment=COAXIAL-Table disabled=no fib name=COAXIAL
add comment=FIBER-Table disabled=no fib name=FIBER
/user group
add name=REDDACTED policy=read,test,api,!local,!telnet,!ssh,!ftp,!reboot,!write,!policy,!winbox,!password,!web,!sniff,!sensitive,!romon,!rest-api
add comment=REDDACTED name=REDDACTED policy=read,write,api,!local,!telnet,!ssh,!ftp,!reboot,!policy,!test,!winbox,!password,!web,!sniff,!sensitive,!romon,!rest-api
/user-manager profile
add name=REDDACTED name-for-users=REDDACTED override-shared-users=unlimited starts-when=first-auth validity=unlimited
add name=REDDACTED name-for-users=REDDACTED override-shared-users=unlimited starts-when=first-auth validity=unlimited
/user-manager user
add name=REDDACTED
/user-manager user group
add attributes=Mikrotik-Group:full inner-auths=ttls-pap,ttls-chap,ttls-mschap1,ttls-mschap2,peap-mschap2 name=REDDACTED-REDDACTED outer-auths=\
    pap,chap,mschap1,mschap2,eap-tls,eap-ttls,eap-peap,eap-mschap2
add attributes=Mikrotik-Group:full inner-auths=ttls-pap,ttls-chap,ttls-mschap1,ttls-mschap2,peap-mschap2 name=REDDACTED-REDDACTED outer-auths=\
    pap,chap,mschap1,mschap2,eap-tls,eap-ttls,eap-peap,eap-mschap2
add attributes=Mikrotik-Group:full inner-auths=ttls-pap,ttls-chap,ttls-mschap1,ttls-mschap2,peap-mschap2 name=REDDACTED-REDDACTED outer-auths=\
    pap,chap,mschap1,mschap2,eap-tls,eap-ttls,eap-peap,eap-mschap2
add inner-auths=ttls-pap,ttls-chap,ttls-mschap1,ttls-mschap2,peap-mschap2 name=REDDACTED outer-auths=pap,chap,mschap1,mschap2,eap-tls,eap-ttls,eap-peap,eap-mschap2
add inner-auths=ttls-pap,ttls-chap,ttls-mschap1,ttls-mschap2,peap-mschap2 name=REDDACTED outer-auths=pap,chap,mschap1,mschap2,eap-tls,eap-ttls,eap-peap,eap-mschap2
add inner-auths=ttls-pap,ttls-chap,ttls-mschap1,ttls-mschap2,peap-mschap2 name=REDDACTED outer-auths=pap,chap,mschap1,mschap2,eap-tls,eap-ttls,eap-peap,eap-mschap2
add attributes=Mikrotik-Group:REDDACTED inner-auths=ttls-pap,ttls-chap,ttls-mschap1,ttls-mschap2,peap-mschap2 name=hauserread outer-auths=\
    pap,chap,mschap1,mschap2,eap-tls,eap-ttls,eap-peap,eap-mschap2
/user-manager user
add group=REDDACTED-REDDACTED name=REDDACTED-REDDACTED
add group=REDDACTED name=REDDACTED
add group=REDDACTED name=REDDACTED
add attributes=Mikrotik-Group:full group=REDDACTED-REDDACTED name=REDDACTED-REDDACTED shared-users=2
add group=hauserread name=hauserread
add group=REDDACTED-REDDACTED name=REDDACTED-apREDDACTED
add attributes=Mikrotik-Group:full group=REDDACTED-REDDACTED name=REDDACTED shared-users=2
/caps-man access-list
add disabled=no signal-range=-75..120
/caps-man manager
set ca-certificate=auto certificate=auto enabled=yes package-path=/packages upgrade-policy=suggest-same-version
/caps-man proREDDACTEDsioning
add action=create-dynamic-enabled hw-supported-modes=gn master-configuration=aplite-config-foffice name-prefix=ap-REDDACTEDoffice- radio-mac=REDDACTED
add action=create-dynamic-enabled hw-supported-modes=gn master-configuration=aplite-config-REDDACTED name-prefix=ap-REDDACTED- radio-mac=REDDACTED
/certificate settings
set builtin-trust-anchors=not-trusted
/disk settings
set auto-media-interface=bridge auto-media-sharing=yes auto-smb-sharing=yes
/interface bridge port
add bridge=bridge comment=defconf interface=ether2::LAN
add bridge=bridge comment=defconf interface=ether3:LAN
add bridge=bridge comment=defconf interface=ether4:LAN
add bridge=bridge comment=defconf interface=ether5:LAN
add bridge=bridge comment=defconf interface=ether6::FIBER
add bridge=bridge comment=defconf interface=ether7:LAN
add bridge=bridge comment=defconf interface=ether8:LAN
add bridge=bridge comment=defconf interface=sfp-sfpplus1
/ip neighbor discovery-settings
set discover-interface-list=LAN
/ipv6 settings
set disable-ipv6=yes
/interface list member
add comment=defconf interface=bridge list=LAN
add comment=defconf interface=ether1::COAX list=WAN
/interface wifi access-list
add action=accept disabled=no signal-range=-75..120
/interface wifi capsman
set ca-certificate=auto certificate=auto enabled=yes interfaces=all package-path=/packages require-peer-certificate=no upgrade-policy=suggest-same-version
/interface wifi proREDDACTEDsioning
add action=create-dynamic-enabled disabled=no master-configuration=2ghz-home-REDDACTED name-format=2ghz-REDDACTED radio-mac=D4:01:REDDACTED
add action=create-dynamic-enabled disabled=no master-configuration=2ghz-home-REDDACTED name-format=2ghz-REDDACTED radio-mac=78:9A:REDDACTED
add action=create-dynamic-enabled disabled=no master-configuration=2ghz-home-REDDACTED name-format=2ghz-REDDACTED radio-mac=04:F4:REDDACTED
add action=create-dynamic-enabled disabled=no master-configuration=5ghz-home-REDDACTED name-format=5ghz-REDDACTED radio-mac=D4:01:REDDACTED
add action=create-dynamic-enabled disabled=no master-configuration=5ghz-home-REDDACTED name-format=5ghz-REDDACTED radio-mac=78:9A:REDDACTED
add action=create-dynamic-enabled disabled=no master-configuration=5ghz-home-REDDACTED name-format=5ghz-REDDACTED radio-mac=04:F4:REDDACTED
/ip address
add address=192.168.178.1/24 comment=defconf interface=bridge network=192.168.178.0
add address=172.16.1.2/30 comment="COAX REDDACTED" interface=ether1::COAX network=172.16.1.0
/ip cloud
set back-to-home-vpn=enabled ddns-enabled=yes ddns-update-interval=10m
/ip cloud back-to-home-user
add allow-lan=yes comment="REDDACTED.home.arpa | RB5009UG+S+" name="Redmi Note 12 Pro 5G" private-key="REDDACTED=" public-key=\
    "REDDACTED"
/ip dhcp-client
add comment=defconf disabled=yes interface=ether1::COAX use-peer-dns=no
/ip dhcp-server lease
REDDACTED
/ip dhcp-server network
add address=192.168.178.0/24 caps-manager=192.168.178.1 comment=defconf dns-server=192.168.178.116 domain=home.arpa gateway=192.168.178.1 netmask=24 ntp-server=\
    192.168.178.1
/ip dns
set servers=192.168.178.116
/ip dns static
add address=192.168.178.1 comment=defconf name=router.lan type=A
/ip firewall address-list
add address=172.16.1.2 comment=Coaxial list=wan-interfaces
add address=90.REDDACTED9 comment=FIber list=wan-interfaces
add address=192.168.178.0/24 comment=LAN list=lan-interfaces
/ip firewall filter
add action=accept chain=input comment="defconf: accept established,related,untracked" connection-state=established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=invalid
add action=accept chain=input comment="defconf: accept ICMP" disabled=yes protocol=icmp
add action=accept chain=input comment="defconf: accept to local loopback (for CAPsMAN)" dst-address=127.0.0.1
add action=drop chain=input comment="defconf: drop all not coming from LAN" in-interface-list=!LAN
add action=accept chain=forward comment="defconf: accept in ipsec policy" ipsec-policy=in,ipsec
add action=accept chain=forward comment="defconf: accept out ipsec policy" ipsec-policy=out,ipsec
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" connection-state=established,related hw-offload=yes
add action=accept chain=forward comment="defconf: accept established,related, untracked" connection-state=established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" connection-state=invalid
add action=drop chain=forward comment="defconf: drop all from WAN not DSTNATed" connection-nat-state=!dstnat connection-state=new in-interface-list=WAN
/ip firewall mangle
add action=accept chain=prerouting comment="Skip router-originated traffic" src-address-type=local
add action=accept chain=prerouting comment="Skip local traffic (LAN to router)" dst-address-type=local
add action=accept chain=prerouting comment="Do not balance LAN to LAN" dst-address-list=lan-interfaces src-address-list=lan-interfaces
add action=accept chain=prerouting comment="Allow acces to WAN Routers" dst-address-list=wan-interfaces
add action=mark-connection chain=input comment="COAX Input" in-interface=ether1::COAX new-connection-mark=COAX
add action=mark-connection chain=input comment="Fiber Input" in-interface=wan-fiber:FIBER new-connection-mark=FIBER
add action=mark-connection chain=prerouting comment="Connection Marking COAX" connection-mark=no-mark in-interface=ether1::COAX new-connection-mark=COAX-Mark
add action=mark-connection chain=prerouting comment="Connection Marking FIBER" connection-mark=no-mark in-interface=wan-fiber:FIBER new-connection-mark=FIBER-Mark
add action=mark-routing chain=output comment="Output Mark COAX" connection-mark=COAX-Mark new-routing-mark=COAXIAL passthrough=no
add action=mark-routing chain=output comment="Output Mark FIBER" connection-mark=FIBER-Mark new-routing-mark=FIBER passthrough=no
add action=accept chain=prerouting comment="Skip broadcast traffic" dst-address=255.255.255.255
add action=mark-connection chain=prerouting comment="PCC - COAX" connection-mark=no-mark dst-address-type=!local in-interface-list=LAN new-connection-mark=COAX-Mark \
    per-connection-classifier=both-addresses-and-ports:2/0
add action=mark-connection chain=prerouting comment="PCC - FIBER" connection-mark=no-mark dst-address-type=!local in-interface-list=LAN new-connection-mark=FIBER-Mark \
    per-connection-classifier=both-addresses-and-ports:2/1
add action=mark-routing chain=prerouting comment="Routing Mark LAN to COAX" connection-mark=COAX-Mark in-interface-list=LAN new-routing-mark=COAXIAL passthrough=no
add action=mark-routing chain=prerouting comment="Routing Mark LAN to FIBER" connection-mark=FIBER-Mark in-interface-list=LAN new-routing-mark=FIBER passthrough=no
/ip firewall nat
add action=masquerade chain=srcnat out-interface=ether1::COAX
add action=masquerade chain=srcnat out-interface=wan-fiber:FIBER
/ip firewall serREDDACTEDce-port
set ftp disabled=yes
set tftp disabled=yes
set h323 disabled=yes
set sip disabled=yes
set pptp disabled=yes
/ip route
add comment="COAX Route - Recursive" disabled=no distance=2 dst-address=8.8.8.8/32 gateway=172.16.1.1 routing-table=main scope=10 suppress-hw-offload=no target-scope=10
add check-gateway=ping comment="FIBER - Route Main GW2" disabled=no distance=2 dst-address=8.8.8.8/32 gateway=172.16.1.1 routing-table=main scope=11 suppress-hw-offload=\
    no target-scope=11
add comment="FIBER Route - Recursive" disabled=no distance=1 dst-address=8.8.8.8/32 gateway=wan-fiber:FIBER routing-table=main scope=10 suppress-hw-offload=no \
    target-scope=10
add check-gateway=ping comment="FIBER - Route Main GW1" disabled=no distance=1 dst-address=8.8.8.8/32 gateway=wan-fiber:FIBER routing-table=main scope=30 \
    suppress-hw-offload=no target-scope=11
add check-gateway=ping comment="Fiber - GW1" disabled=no distance=1 dst-address=0.0.0.0/0 gateway=wan-fiber:FIBER routing-table=FIBER scope=30 suppress-hw-offload=no \
    target-scope=11
add check-gateway=ping comment="FIBER - GW2" disabled=no distance=2 dst-address=0.0.0.0/0 gateway=ether1::COAX routing-table=FIBER scope=30 suppress-hw-offload=no \
    target-scope=11
add check-gateway=ping comment="COAX - GW1" disabled=no distance=1 dst-address=0.0.0.0/0 gateway=ether1::COAX routing-table=COAXIAL scope=30 suppress-hw-offload=no \
    target-scope=11
add check-gateway=ping comment="COAX - GW2" disabled=no distance=2 dst-address=0.0.0.0/0 gateway=172.16.1.1 routing-table=COAXIAL scope=30 suppress-hw-offload=no \
    target-scope=11
/ipv6 firewall address-list
REDDACTED
/ipv6 firewall filter
REDDACTED
/routing igmp-proxy mfc
add downstream-interfaces=bridge group=0.0.0.0 source=0.0.0.0 upstream-interface=ether1::COAX
/routing rule
add action=lookup comment=COAX-Rule disabled=no dst-address=8.8.8.8/32 src-address=ether1::COAX table=COAXIAL
add action=lookup comment=FIBER-Rule disabled=no dst-address=8.8.8.8/32 src-address=90.REDDACTED.182/32 table=FIBER
/system identity
set name=REDDACTED.home.arpa
/system ntp client
set enabled=yes
/system ntp server
set broadcast=yes enabled=yes
/system ntp client servers
add address=2.europe.pool.ntp.org
REDDACTED
/system routerboard settings
set auto-upgrade=yes
/tool mac-server
set allowed-interface-list=LAN
/tool mac-server mac-winbox
set allowed-interface-list=LAN
/user aaa
set accounting=no default-group=full
/user-manager
set certificate=*D require-message-auth=no
/user-manager router

Dartmaul · October 15, 2025, 4:35pm

Hi.

1st of all, you can’t have PBR with fail over, as PBR is static by definition. (You can however make a mixed config that employs both PBR and routing to achieve that)

2nd - load balancing can be done based on a whole lot of different factors, starting with just regular PCC, all the way to specific destinations, protocols, DSCP and whatever else you might think of. So you better clarify your request here.

In regards to DHCP/Static thing - DHCP client allows you to choose which routing table(s) (I see you already have one for each uplink) def gw should be installed, and with which distance.

unhuzpt · October 15, 2025, 4:46pm

Hey there Dartmaul

I can stick to PBR only and I was hoping my configuration would do a fail over if one of the GW are unreachable. But now, and for some reason i do not know, the routing table shows the FIBER gw as unreachable.

For load balancing I seek the simple way just using PCC. I also would like to implement a way to force a couple of source ips to use only the fiber WAN and make sure there is no asymmetric routing on that.

My routing setup aims to use both GW and auto swap if one is not available. But for now i am not sure it works - not tested yet - because I am still struggling to figure out why i have the situation as in the picture.

Dartmaul · October 15, 2025, 5:04pm

/ip firewall mangle
add action=jump chain=prerouting comment=dscp_to_pcc in-interface=Bridge_LAN jump-target=pcc_WAN
add action=mark-connection chain=pcc_WAN comment=Mark_to_COAXIAL connection-mark=no-mark new-connection-mark=COAXIAL per-connection-classifier=both-addresses:2/0
add action=mark-connection chain=pcc_WAN comment=Mark_to_FIBER connection-mark=no-mark new-connection-mark=FIBER per-connection-classifier=both-addresses:2/1
add action=mark-routing chain=pcc_WAN comment=Route_to_COAXIAL connection-mark=to_MF new-routing-mark=COAXIAL passthrough=no
add action=mark-routing chain=pcc_WAN comment=Route_to_FIBER connection-mark=to_PSK new-routing-mark=FIBER passthrough=no

That’ll be a regular PCC. It relies on per-ISP routing tables, assuming that each has default gateway towards required ISP.

Also,

why do you have all the ports bridged?
why are interface naming inconsistent? what wan-fiber:FIBER suppose to mean?

UPD you would probably need dst-address-type=!local for the 1st jump rule of just add action=accept chain=prerouting comment=to_self dst-address-type=local as your 1st rule (as I have) to prevent yourself from accidentally locking yourself out of the router itself.

unhuzpt · October 15, 2025, 5:33pm

I need to check the PCC you posted, thanks.

that is something I also think i should split by removing the 2 WAN interfaces from the bridge, i guess that is your question.
yeah the naming is not the best I agree fiber+fiber=just fiber

And yes, been there…. locked myself out of the router and had to reset so thanks for pointing that out as i forgot to account for it.

EDIT:

Also I think I am hitting some limit or wrong config as I am downloading LLM models and hitting 1Gbit speed, at the same time my CAPS all disconnect….

Dartmaul · October 15, 2025, 5:41pm

It looks like you went building a config right on top of the defaults, which might not always be the best way to go, especially if you’re planning something not entirely standard. I would recommend (maybe for the next time), resetting the config of your new deployment before you start.

That would not only give you a clean start, but also save you some time figuring out what part of the defaults is messing with what you’re up to (like that bridge part)

unhuzpt · October 15, 2025, 5:44pm

I think the bridge is saturated, did not catch the fiber WAN pushing as much as it was but was hitting +1200Mbit on the bridge a few seconds before.

Dartmaul · October 15, 2025, 6:03pm

If you haven’t yet removed WAN uplinks from your bridge, then you have interconnected your ISPs networks with your LAN, which may lead to a whole set of issues, such as concurrent DHCP servers, messed up ARP, lots of broadcast flood etc.

Your config is pretty messy in general so I would suggest you to do some clean up before you continue. It would not only potentially solve some of your problems, but also would give you a much better understanding about what’s going on in general.

Also, a few remarks about PCC:

Load balancing between multiple uplinks introduces IP flap issue, as different uplinks have different IPs.With that in mind, load balancing becomes a game of trade between gradually balance the traffic and facing IP flap. PCC config I posted above is based on both-addresses, which is usually considered to be a sweet spot for most (but not all) cases. Some applications are distributed across different IPs, but require clients to connect from the same address in order to operate.

Also, PCC has a lot to do with connection tracking, and you need to understand how those are related.

In regards to CAPS - the best practice would be to use a separate VLAN for that.

UPD In regards to your CAPS disconnect: assuming they are behind ether2 port, it might just be a congestion issue, as it seemingly reaches full capacity: CAPS packets might just be dropped. If so, you might also have to think about some QoS policy to address that.

unhuzpt · October 15, 2025, 6:53pm

Thank you for this response.

I have added, for now, these 2 rules on Mangle:

add chain=prerouting action=accept dst-address-type=local comment="do not lock out myself"

add chain=prerouting action=accept dst-address-type=broadcast comment="ignore broadcasts"

Then i need to review all I have done so far and as you said, cleanup and organize things so I achieve my goals, being not a network guy.

unhuzpt · October 15, 2025, 7:12pm

Now starts to look better

And WAN2 is out of the bridge.

Dartmaul · October 15, 2025, 7:20pm

add chain=prerouting action=accept dst-address-type=broadcast comment="ignore broadcasts"

Not sure what you’re intended to do with this one: as we’re talking about mangle, accept just means “proceed to the next chain” and is used to avoid certain traffic to be processed further through the given chain.

Generally, I believe you might want to return to drawing board and reflect on what’s on your mind for this project, as every proper operating network starts with proper planning.

unhuzpt · October 15, 2025, 7:28pm

You are correct.

This was left over of me seeing many broadcasts marked to WAN routing. It is removed now.

I am learning as I go with this double WAN setup. Not had experience with this and so far it hurts my head but having a fantastic time.

For sure many errors are being made

Dartmaul · October 15, 2025, 7:40pm

That’s one way to go (been there, did that), but it sure might take more time than you would expect, as there are a lot of hidden issues to unpack, especially related to dst-nat or inter-lan routing.

Also, your 8.8.8.8 routes won’t work as you expect: you don’t need 4 of them, just 2, and they have to be different GW same distance.

unhuzpt · October 16, 2025, 7:54am

Hey there!

So, after reading a lot, made some changes as below and tested disable each interface in the router and testing with a youtube video and there was no interruption. Let me know what you think about the changes!

anav · October 16, 2025, 8:17am

Post complete config as well as routes page for review
/export file=anynameyouwish ( minus router serial#, any public WANIP information, keys, dhcp lease lists )

What are the throughputs of both your ISPs?? ECMP load balancing is much simpler to to apply, than PCC If there are only a couple of IPs that need to go out a specific WAN, routing rules would be easier than mangling.

unhuzpt · October 16, 2025, 11:29am

The ISPs throughput are:

COAX - 1G/150M

FIBER - 500M/250M (soon to be 1G download)

The current config:

# model = RB5009UG+S+
/interface bridge
add admin-mac=78:9A:18:74:70:9A auto-mac=no comment=defconf name=bridge
/interface ethernet
set [ find default-name=ether1 ] comment="WAN1 COAX" name=ether1::COAX
set [ find default-name=ether2 ] name=ether2::LAN
set [ find default-name=ether3 ] name=ether3:LAN
set [ find default-name=ether4 ] name=ether4:LAN
set [ find default-name=ether5 ] name=ether5:LAN
set [ find default-name=ether6 ] comment="WAN2 FIBER" name=ether6::FIBER
set [ find default-name=ether7 ] name=ether7:LAN
set [ find default-name=ether8 ] name=ether8:LAN
/interface wireguard
add comment=back-to-home-vpn listen-port=REDDACTED mtu=1420 name=back-to-home-vpn
/interface vlan
add comment="REDDACTED VLAN" interface=ether2::LAN name=\
    vlan40-REDDACTED-REDDACTED vlan-id=40
add comment=ORANGE interface=ether6::FIBER name=wan2:FIBER vlan-id=35
/interface list
add comment=defconf name=WAN
add comment=defconf name=LAN
/ip pool
add name=dhcp ranges=192.168.178.10-192.168.178.150
/ip dhcp-server
add address-pool=dhcp comment="LAN DHCP" interface=bridge name=defconf
/routing table
add comment=COAXIAL-Table disabled=no fib name=COAXIAL
add comment=FIBER-Table disabled=no fib name=FIBER
/interface bridge port
add bridge=bridge comment=defconf interface=ether2::LAN
add bridge=bridge comment=defconf interface=ether3:LAN
add bridge=bridge comment=defconf interface=ether4:LAN
add bridge=bridge comment=defconf interface=ether5:LAN
add bridge=bridge comment=defconf interface=ether7:LAN
add bridge=bridge comment=defconf interface=ether8:LAN
add bridge=bridge comment=defconf interface=sfp-sfpplus1
/ip neighbor discovery-settings
set discover-interface-list=LAN
/ipv6 settings
set disable-ipv6=yes
/interface list member
add comment=defconf interface=bridge list=LAN
add comment=defconf interface=ether1::COAX list=WAN
add comment=Orange interface=wan2:FIBER list=WAN
/ip address
add address=192.168.178.1/24 comment=defconf interface=bridge network=\
    192.168.178.0
add address=172.16.1.2/30 comment="COAX REDDACTED" interface=ether1::COAX \
    network=172.16.1.0
/ip dhcp-client
add comment=defconf disabled=yes interface=ether1::COAX use-peer-dns=no
add comment=WAN2-FIBER default-route-tables=FIBER interface=wan2:FIBER \
    script="  " use-peer-dns=no use-peer-ntp=no
/ip dhcp-server network
add address=192.168.178.0/24 caps-manager=192.168.178.1 comment=defconf \
    dns-server=192.168.178.116 domain=home.arpa gateway=192.168.178.1 \
    netmask=24 ntp-server=192.168.178.1
/ip dns
set mdns-repeat-ifaces=bridge servers=172.16.1.1
/ip dns static
add address=192.168.178.1 comment=defconf name=router.lan type=A
/ip firewall address-list
add address=172.16.1.2 comment=Coaxial list=wan-interfaces
add address=90.REDDACTED/19 comment=FIber list=wan-interfaces
add address=192.168.178.0/24 comment=LAN list=lan-interfaces
/ip firewall filter
add action=accept chain=input comment=\
    "defconf: accept established,related,untracked" connection-state=\
    established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=\
    invalid log-prefix="rule 4 - "
add action=accept chain=input comment="defconf: accept ICMP" disabled=yes \
    protocol=icmp
add action=accept chain=input comment=\
    "defconf: accept to local loopback (for CAPsMAN)" dst-address=127.0.0.1
add action=drop chain=input comment="defconf: drop all not coming from LAN" \
    in-interface-list=!LAN log-prefix="rule 7 - "
add action=accept chain=forward comment="defconf: accept in ipsec policy" \
    ipsec-policy=in,ipsec
add action=accept chain=forward comment="defconf: accept out ipsec policy" \
    ipsec-policy=out,ipsec
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" \
    connection-state=established,related disabled=yes hw-offload=yes
add action=accept chain=forward comment=\
    "defconf: accept established,related, untracked" connection-state=\
    established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" \
    connection-state=invalid
add action=drop chain=forward comment=\
    "defconf: drop all from WAN not DSTNATed" connection-nat-state=!dstnat \
    connection-state=new in-interface-list=WAN
/ip firewall mangle
add action=accept chain=prerouting comment="do not lock out myself" \
    dst-address-type=local
add action=accept chain=prerouting comment="ignore broadcasts" \
    dst-address-type=broadcast
add action=mark-connection chain=input comment="COAX Input" in-interface=\
    ether1::COAX new-connection-mark=COAX
add action=mark-connection chain=input comment="FIBER Input" in-interface=\
    wan2:FIBER new-connection-mark=FIBER
add action=mark-connection chain=prerouting comment="Connection Marking COAX" \
    connection-mark=no-mark in-interface=ether1::COAX new-connection-mark=\
    COAX-Mark
add action=mark-connection chain=prerouting comment=\
    "Connection Marking FIBER" connection-mark=no-mark in-interface=\
    wan2:FIBER new-connection-mark=FIBER-Mark
add action=mark-routing chain=output comment="Output Mark COAX" \
    connection-mark=COAX-Mark new-routing-mark=COAXIAL passthrough=no
add action=mark-routing chain=output comment="Output Mark FIBER" \
    connection-mark=FIBER-Mark new-routing-mark=FIBER passthrough=no
add action=mark-connection chain=prerouting comment="PCC - COAX" \
    connection-mark=no-mark dst-address-type=!local in-interface-list=LAN \
    new-connection-mark=COAX-Mark per-connection-classifier=\
    both-addresses-and-ports:2/0
add action=mark-connection chain=prerouting comment="PCC - FIBER" \
    connection-mark=no-mark dst-address-type=!local in-interface-list=LAN \
    new-connection-mark=FIBER-Mark per-connection-classifier=\
    both-addresses-and-ports:2/1
add action=mark-routing chain=prerouting comment="Routing Mark LAN to COAX" \
    connection-mark=COAX-Mark in-interface-list=LAN new-routing-mark=COAXIAL \
    passthrough=no
add action=mark-routing chain=prerouting comment="Routing Mark LAN to FIBER" \
    connection-mark=FIBER-Mark in-interface-list=LAN new-routing-mark=FIBER \
    passthrough=no
/ip firewall nat
add action=masquerade chain=srcnat out-interface=ether1::COAX
add action=masquerade chain=srcnat out-interface=wan2:FIBER
/ip route
add comment="COAX Route - Recursive" disabled=no distance=1 dst-address=\
    8.8.8.8/32 gateway=172.16.1.1 routing-table=main scope=10 \
    suppress-hw-offload=no target-scope=10
add comment="FIBER Route - Recursive" disabled=no distance=1 dst-address=\
    8.8.8.8/32 gateway=90.REDDACTED.1 routing-table=main scope=10 \
    suppress-hw-offload=no target-scope=10
add check-gateway=ping comment="FIBER - GW2" disabled=no distance=2 \
    dst-address=0.0.0.0/0 gateway=172.16.1.1 routing-table=FIBER scope=30 \
    suppress-hw-offload=no target-scope=11
add check-gateway=ping comment="COAX - GW1" disabled=no distance=1 \
    dst-address=0.0.0.0/0 gateway=172.16.1.1 routing-table=COAXIAL scope=30 \
    suppress-hw-offload=no target-scope=11
add check-gateway=ping comment="COAX - GW2" disabled=no distance=2 \
    dst-address=0.0.0.0/0 gateway=90.REDDACTED.1 routing-table=COAXIAL scope=30 \
    suppress-hw-offload=no target-scope=11
/ip upnp
set enabled=yes
/ip upnp interfaces
add interface=bridge type=internal
add interface=ether1::COAX type=external
/routing igmp-proxy mfc
add downstream-interfaces=bridge group=0.0.0.0 source=0.0.0.0 \
    upstream-interface=ether1::COAX
/routing rule
add action=lookup comment="All traffic LAN and to Router" disabled=no table=\
    main
add action=lookup-only-in-table comment="Mangle mark to COAX" disabled=no \
    routing-mark=COAXIAL table=COAXIAL
add action=lookup-only-in-table comment="Mangle mark to FIBER" disabled=no \
    routing-mark=FIBER table=FIBER
/system clock
set time-zone-name=Europe/REDDACTED
/system identity
set name=REDDACTED.home.arpa
/system ntp client
set enabled=yes
/system ntp server
set broadcast=yes enabled=yes
/system ntp client servers
add address=pool.ntp.org
/system routerboard settings
set auto-upgrade=yes
/tool mac-server
set allowed-interface-list=LAN
/tool mac-server mac-winbox
set allowed-interface-list=LAN

Dartmaul · October 16, 2025, 12:22pm

Since you’re using upnp (which is a kind of dst-nat I mentioned before) you might need this one in your mangle

add action=mark-connection chain=postrouting comment=dst_natted connection-nat-state=dstnat new-connection-mark=dst_natted out-interface=bridge

CGGXANNX · October 16, 2025, 12:29pm

I don't think it's needed. Those DSTNAT'ed connections (UPnP automatically inserts dstnat rules) will be handled normally by:

The two mark-connection rules on chain prerouting that have the interface=ether1::COAX and in-interface=wan2:FIBER conditions.
The two mark-routing rules on chain prerouting at the bottom of the table.

So even if UPnP only puts the forwarded ports on ether1::COAX, the rules above will still ensure that the responses go out using the correct interface.

Dartmaul · October 16, 2025, 12:50pm

Yes, seems that you’re right.

I just copied that rule from my own router which has similar multi-wan config, but since I have both of my uplinks with static IPs, I don’t mark incoming traffic, and just use src-address for routing rules instead.

unhuzpt · October 16, 2025, 3:33pm

Do you think I am in the good path now?

Or still a mess?