Observations:
(1) First problem is your interface lists, there is no reason to have two separate WAN LISTS.
Should be just WAN and just LAN. Anything else only leads to confusion. The reason to create interface lists is when grouping of subnets makes sense for rules, OR you need to indicate a specific vlan is a managment interface.
/interface list
add comment=defconf name=WAN
add comment=defconf name=LAN
(2) Likewise please simplify your member list to the following:
/interface list member
add comment=defconf interface=bridge list=LAN
add interface=ether1 list=WAN
add interface=ether2 list=WAN
(3) Looks like ether1 (primary) is using DHCP client and ether2 (seconday is a static IP)
(4) What is the purpose of this UNSAFE SECURITY INFRACTION? One does not allow direct external access to the configuration of the router. LImiting to an exernal WANIP is wishful thinking.
add action=accept chain=input comment=“Remote access MEXUS” dst-port=8291
protocol=tcp src-address=213.91.171.181
Where is this external access coming from? Assuming the RB4011 is a home router?
If nothing else, use a simple wireguard connection to VPN into the router and from which you can easily configure the router and reach all the LAN devices as well.
(5) Recommend you change this default rule, not meant for more complex setups (especially the combo of dual wan and port forwarding) to three rules:
from
add action=drop chain=forward comment=
“defconf: drop all from WAN not DSTNATed” connection-nat-state=!dstnat
connection-state=new in-interface-list=WAN
TO:
add action=accept chain=forward comment=“internet” in-interface-list=LAN out-interface-list=WAN
add action=accept chain=forward comment=“port forwarding” connection-nat-state=dstnat
add action=drop chain=forward comment=“DROP ALL ELSE”
(6) SCRAP all your mangle rules as stated previously and replace with.
The first rule mark connections for all external traffic coming into the router on wan2 and the second rules ensure the traffic will be returned through the same WAN.
add chain=prerouting action=mark-connections connection-mark=no-mark
in-interface=ether2 new-connection-mark=incomingWAN2 passthrough=yes
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
add chain=prerouting action=mark-routing connection-mark=incomingWAN2
new-routing-mark= to_ether2 passthrough=no
What is important here too is that we ensure that the traffic does have the standard sourcenat rule to ensure the corrected traffic is given the correct WANIP, either using the default rule
add action=masquerade chain=srcnat out-interface-list=WAN
OR the WANs spelled out separately as YOU HAVE BELOW which is good!!!
add action=masquerade chain=srcnat comment=VIVACOM out-interface=ether1
add action=masquerade chain=srcnat comment=TEA out-interface=ether2
There is no further mangling required. I would add that since some of this traffic concerns return traffic from the LAN, that we modify the forward chain firewall rule accordingly:
add action=fasttrack-connection chain=forward comment=“defconf: fasttrack”
connection-state=established,related hw-offload=yes connection-mark=no-mark
(7) Now lets get to the Destination Nat rules…
a. why are you using RDP? Are you running and RDP server and if so WHY? RDP is no longer considered a secure protocol to use??
We can use Wireguard noted before to replace such requirements
b. The router has a built-in SSH capability, what is the purpose of setting up a separate SSH server on the LAN??
c. Why do you have an email server setup on port 25. This is also a large security risk!! I see you also have 465 which is much better.
d. Although I have no issue with tls secure port 465, port 587 is the officially recommended port ( personal pref, aka your choice ).
e. Port 143 is NOT SECURE and not a port you want to expose to the public and should be deleted as well. Believe you have 993 which is better.
f, PORT 8081 www, should be DISABLED as its not a secure access method!!
(8) Can you explain the purpose of this Dst Nat rules please…
add action=dst-nat chain=dstnat dst-address=!192.168.0.1 dst-address-type=local dst-port=9998 protocol=tcp to-addresses=192.168.0.111 to-ports=9998
(9) Can you explain the purpose of this srcnat rule please…
add action=masquerade chain=srcnat dst-address=!192.168.0.1 src-address=192.168.0.0/24
(10) Your IP routes are a bit funny, in that there is an inconsistency in the gateway IPs…!!
/ip route
add check-gateway=ping disabled=no distance=12 dst-address=0.0.0.0/0 gateway=
10.30.0.1 pref-src=“” routing-table=main scope=30 suppress-hw-offload=
no target-scope=10
add check-gateway=ping disabled=no distance=11 dst-address=0.0.0.0/0 gateway=
10.10.0.112 pref-src=“” routing-table=main scope=30
suppress-hw-offload=no target-scope=10
add check-gateway=ping disabled=no distance=1 dst-address=0.0.0.0/0 gateway=
212.5.152.1 pref-src=“” routing-table=to_ether1 scope=30
suppress-hw-offload=no target-scope=10
add check-gateway=ping disabled=no distance=1 dst-address=0.0.0.0/0 gateway=
10.10.0.112 pref-src=“” routing-table=to_ether2 scope=30
suppress-hw-offload=no target-scope=10
Further, you state that ether1 is the faster WAN1 and should be primary and ether2 (WAN2) should be secondary! Then you say all Servers should work from WAN2.
Quote: “I need WAN1 to have a lower routing distance and port forwards to work for both, since WAN1 is the new provider, has a lot faster connection, but all the services are configured (DNS) to the WAN2 IP.” unquote.
So look at the above config piece, 10.10.0.112 is associated with ETHER2 in the last line but has a lower distance in the second line. So this is wrong!!
Please confirm the following: Assuming you mean, all LAN users should use WAN1 and all servers should have incoming traffic from WAN on WAN2.
However,
–>if WAN1 fails, all users should be able to use WAN2
→ if WAN2 fails, all servers should be reachable via WAN1
