Dual WAN FTP Proble

RouterOS General
1

I Have dual wan setup with Load Balancing and FTP server on my local pc. When i try to access it from outside the router it doesnt work bbut as soon as i disable WAN1 everything works perfectly

/ip firewall mangle
add action=mark-connection chain=input in-interface=WAN1 new-connection-mark=\
    WAN1_conn
add action=mark-connection chain=input in-interface=WAN2 new-connection-mark=\
    WAN2_conn
add action=mark-routing chain=output connection-mark=WAN1_conn \
    new-routing-mark=to_WAN1
add action=mark-routing chain=output connection-mark=WAN2_conn \
    new-routing-mark=to_WAN2
add action=accept chain=prerouting dst-address=10.52.1.0/24 in-interface=Local
add action=accept chain=prerouting dst-address=45.116.3.0/24 in-interface=Local
add action=mark-connection chain=prerouting dst-address-type=!local \
    in-interface=Local new-connection-mark=WAN1_conn passthrough=yes \
    per-connection-classifier=both-addresses-and-ports:3/0
add action=mark-connection chain=prerouting dst-address-type=!local \
    in-interface=Local new-connection-mark=WAN2_conn passthrough=yes \
    per-connection-classifier=both-addresses-and-ports:3/1
add action=mark-connection chain=prerouting dst-address-type=!local \
    in-interface=Local new-connection-mark=WAN1_conn passthrough=yes \
    per-connection-classifier=both-addresses-and-ports:3/2
add action=mark-routing chain=prerouting connection-mark=WAN1_conn \
    in-interface=Local new-routing-mark=to_WAN1
add action=mark-routing chain=prerouting connection-mark=WAN2_conn \
    in-interface=Local new-routing-mark=to_WAN2
/ip firewall nat
add action=masquerade chain=srcnat out-interface=WAN1
add action=masquerade chain=srcnat out-interface=WAN2
add action=src-nat chain=srcnat disabled=yes src-address=192.168.0.11 \
    to-addresses=45.116.3.114
add action=src-nat chain=srcnat src-address=192.168.0.11 to-addresses=\
    10.52.1.69
add action=dst-nat chain=dstnat dst-address=10.52.1.69 to-addresses=\
    192.168.0.11
add action=dst-nat chain=dstnat disabled=yes dst-address=45.116.3.114 \
    to-addresses=192.168.0.11
/ip firewall service-port
set ftp ports=20,21
/ip route
add check-gateway=ping distance=1 gateway=45.116.3.113 routing-mark=to_WAN1
add check-gateway=ping distance=1 gateway=10.52.1.1 routing-mark=to_WAN2
add check-gateway=ping distance=1 gateway=45.116.3.113
add check-gateway=ping distance=2 gateway=10.52.1.1
2

Check your mangle rules. It should I believe look like this. Your mangle was missing forward chain.
Remember the order is important prerouting - input - forward - output

/ip firewall mangle
add action=mark-routing chain=prerouting connection-mark=WAN1_conn \
    in-interface=Local new-routing-mark=to_WAN1
add action=mark-routing chain=prerouting connection-mark=WAN2_conn \
    in-interface=Local new-routing-mark=to_WAN2
add action=accept chain=prerouting dst-address=10.52.1.0/24 in-interface=Local
add action=accept chain=prerouting dst-address=45.116.3.0/24 in-interface=Local
add action=mark-connection chain=prerouting dst-address-type=!local \
    in-interface=Local new-connection-mark=WAN1_conn passthrough=yes \
    per-connection-classifier=both-addresses-and-ports:3/0
add action=mark-connection chain=prerouting dst-address-type=!local \
    in-interface=Local new-connection-mark=WAN2_conn passthrough=yes \
    per-connection-classifier=both-addresses-and-ports:3/1
add action=mark-connection chain=prerouting dst-address-type=!local \
    in-interface=Local new-connection-mark=WAN1_conn passthrough=yes \
    per-connection-classifier=both-addresses-and-ports:3/2
add action=mark-connection chain=input in-interface=WAN1 new-connection-mark=\
    WAN1_conn
add action=mark-connection chain=input in-interface=WAN2 new-connection-mark=\
    WAN2_conn
add action=mark-connection chain=forward connection-state=new in-interface=WAN1 new-connection-mark=WAN1_conn passthrough=yes
add action=mark-connection chain=forward connection-state=new in-interface=WAN2 new-connection-mark=WAN2_conn passthrough=yes
add action=mark-routing chain=output connection-mark=WAN1_conn \
    new-routing-mark=to_WAN1
add action=mark-routing chain=output connection-mark=WAN2_conn \
    new-routing-mark=to_WAN2
3

I tried your solution but sadly same problem :frowning: someone please help me

4

I tried your solution but sadly same problem :frowning: someone please help me

5

Please post your updated nat mangle and routes.

6

FTP is not firewall-friendly by itself and adding two WANs does not help. What you need, if it’s server accessible using both WANs, and if it should work with all possible configurations, is close to impossible. With some compromises (e.g. server accessible only using one WAN, or just “good old” plaintext FTP without any encryption) it could be better.

True, order of rules is important, but not like this. Router processes only one table at the time, so if you have rules in tables A, B and C, the order or rules (as you see in WinBox/WebFig/CLI) can be “B1 A1 C1 C2 A2 B2 B3 C3” or “A1 A2 B1 B2 B3 C1 C2 C3” and it will make no difference. The latter is better only for user, because it’s more readable (IMHO). Also, packet will never take the path prerouting-input-forward-output. It will be either prerouting-forward-postrouting or prerouting-input for incoming ones, or output-postrouting for outgoing (plus src/dstnat for first packets of each connection).

7

@Sob i wouldn’t mind using WAN2 interface for FTP incoming can you suggest me how to do it

8

Can you try disable your PCC rules as these could be marking traffic incorrectly ie incoming traffic will not go out the same connection it came in on because the traffic is being marked before it reaches other rules.

add action=accept chain=prerouting dst-address=10.52.1.0/24 in-interface=Local
add action=accept chain=prerouting dst-address=45.116.3.0/24 in-interface=Local
add action=mark-connection chain=prerouting dst-address-type=!local \
    in-interface=Local new-connection-mark=WAN1_conn passthrough=yes \
    per-connection-classifier=both-addresses-and-ports:3/0
add action=mark-connection chain=prerouting dst-address-type=!local \
    in-interface=Local new-connection-mark=WAN2_conn passthrough=yes \
    per-connection-classifier=both-addresses-and-ports:3/1
add action=mark-connection chain=prerouting dst-address-type=!local \
    in-interface=Local new-connection-mark=WAN1_conn passthrough=yes \
    per-connection-classifier=both-addresses-and-ports:3/2
9

I wanted to do some tests, but I didn’t find time for it…

You need to start with marking incoming connections. You already do it for connections to router, but not for forwarded ones. Just move it from input to prerouting and it will cover both:

/ip firewall mangle
add action=mark-connection chain=prerouting in-interface=WAN1 connection-mark=no-mark new-connection-mark=WAN1_conn
add action=mark-connection chain=prerouting in-interface=WAN2 connection-mark=no-mark new-connection-mark=WAN2_conn

Then you need to make sure that your PCC rules won’t rewrite existing connection marks, so add connection-mark=no-mark to all of them. With these steps, the main control connection will work ok.

Next step is data connections. If you use unencrypted FTP (not the best idea), it might just work (I’m not sure, that’s what I wanted to test). Otherwise you need to identify data connections and send them the right way. I don’t think there’s a way to make it work with dual WANs without server specifically supporting that. So you need to put other rules before your PCC ones to mark FTP data connections:

  1. Active data connections from server to client should use source port 20:
/ip firewall mangle
add action=mark-connection chain=prerouting connection-mark=no-mark new-connection-mark=WAN2_conn passthrough=yes \
    protocol=tcp src-address=192.168.0.11 src-port=20
  1. Passive data connections don’t have any specific defining features. But they are generally more important, because they are better for clients. So you need manual config. Tell your server to only use selected port range and right public address (you need to set both somewhere in server config). Then forward required ports, e.g.:
/ip firewall nat
add action=dst-nat chain=dstnat dst-address=<public address> dst-port=60000-60100 protocol=tcp to-addresses=192.168.0.11
10

@sob Thank you so much! working perfectly now :slight_smile: