Help on Dual Wan Fail Over

RouterOS Beginner Basics
1

Hello I am noob in networking and mikrotik configuring can some one help me why is my failover not working and I have lots of pocket loss when I ping google.com at an average of 20 - 25% pocket loss. By the way I have 2 Isp PLDT and GLOBE and using PPPoE configuration. Below is my configuration. Hope someone could enlighten me as I have hit brickwall. Thank you.

/interface ethernet

set [ find default-name=ether1 ] name=ISP1-PLDT

set [ find default-name=ether2 ] name=ISP2-GLOBE

set [ find default-name=ether3 ] name=LAN-ETH3

set [ find default-name=ether4 ] name=LAN-ETH4

set [ find default-name=ether5 ] comment=PPoE name=LAN-ETH5

set [ find default-name=ether6 ] name=LAN-ETH6

set [ find default-name=ether7 ] name=LAN-ETH7

set [ find default-name=ether8 ] name=MANAGEMENT

set [ find default-name=sfp-sfpplus1 ] comment=PPPoE

/ip pool

add name=dhcp_pool0 ranges=192.168.222.2-192.168.222.254

add name=pppoe-pool ranges=192.168.88.2-192.168.88.254

/ip dhcp-server

add address-pool=dhcp_pool0 interface=bridge-LAN name=dhcp1

/ppp profile

add local-address=192.168.88.1 name=ssv-20MB rate-limit=20M/20M remote-address=pppoe-pool

add dns-server=8.8.8.8 local-address=192.168.88.1 name=ssv-15mb rate-limit=15M/15M remote-address=pppoe-pool

/queue simple

add disabled=yes max-limit=900M/900M name=GLOBAL-CAP target=192.168.88.0/24

/queue tree

add max-limit=100M name=queue-voip packet-mark=voip parent=global priority=1

add max-limit=300M name=queue-web packet-mark=web parent=global priority=3

add max-limit=300M name=queue-bulk packet-mark=bulk parent=global priority=6

add max-limit=200M name=queue-default packet-mark=default parent=global

add max-limit=800M name=global-download parent=ISP1-PLDT

add max-limit=800M name=global-download2 parent=ISP2-GLOBE

add max-limit=800M name=upload-cap parent=bridge-LAN

/queue type

add kind=pcq name=default-down pcq-classifier=dst-address pcq-rate=80M

add kind=pcq name=default-up pcq-classifier=src-address pcq-rate=80M

/ppp profile

add local-address=192.168.88.1 name=ssv-def-80mb queue-type=default-up/default-down rate-limit=80M/80M remote-address=pppoe-pool

add local-address=192.168.88.1 name=ssv-50MB queue-type=default-up/default-down rate-limit=50M/50M remote-address=pppoe-pool

/routing table

add disabled=no fib name=to-ISP1-PLDT

add disabled=no fib name=to-ISP2-Globe

/interface bridge port

add bridge=bridge-LAN interface=LAN-ETH3

add bridge=bridge-LAN interface=LAN-ETH4

add bridge=bridge-LAN interface=LAN-ETH6

add bridge=bridge-LAN interface=LAN-ETH7

add bridge=bridge-LAN interface=MANAGEMENT

/interface pppoe-server server

add comment="PPPoE Server LAN-ETH5" default-profile=ssv-def-80mb disabled=no interface=LAN-ETH5 one-session-per-host=yes service-name="SSV-PPPoE-Server LAN5"

add comment="PPPoE Server SFP+" default-profile=ssv-def-80mb disabled=no interface=sfp-sfpplus1 one-session-per-host=yes service-name="SSV-PPPoE-Server SFP+"

/ip address

add address=192.168.222.1/24 interface=bridge-LAN network=192.168.222.0

add address=192.168.254.2/24 interface=ISP2-GLOBE network=192.168.254.0

add address=192.168.88.1/24 interface=LAN-ETH5 network=192.168.88.0

add address=192.168.88.1/24 interface=sfp-sfpplus1 network=192.168.88.0

/ip dhcp-client

add add-default-route=no interface=ISP1-PLDT

add add-default-route=no interface=ISP2-GLOBE

/ip dhcp-server network

add address=192.168.222.0/24 gateway=192.168.222.1

/ip dns

set allow-remote-requests=yes servers=8.8.8.8,1.1.1.1

/ip firewall mangle

add action=mark-connection chain=prerouting comment="# === FIREWALL MANGLE RULES (PCC on DHCP and PPPoE) ===" connection-mark=no-mark in-interface=bridge-LAN \

new-connection-mark=ISP1_conn per-connection-classifier=src-address:2/0

add action=mark-connection chain=prerouting connection-mark=no-mark in-interface=bridge-LAN new-connection-mark=ISP2_conn per-connection-classifier=src-address:2/1

add action=mark-routing chain=prerouting connection-mark=ISP1_conn in-interface=bridge-LAN new-routing-mark=to-ISP1-PLDT

add action=mark-routing chain=prerouting connection-mark=ISP2_conn in-interface=bridge-LAN new-routing-mark=to-ISP2-Globe

add action=mark-connection chain=prerouting connection-mark=no-mark in-interface=LAN-ETH5 new-connection-mark=ISP1_conn per-connection-classifier=src-address:2/0

add action=mark-connection chain=prerouting connection-mark=no-mark in-interface=LAN-ETH5 new-connection-mark=ISP2_conn per-connection-classifier=src-address:2/1

add action=mark-routing chain=prerouting connection-mark=ISP1_conn in-interface=LAN-ETH5 new-routing-mark=to-ISP1-PLDT

add action=mark-routing chain=prerouting connection-mark=ISP2_conn in-interface=LAN-ETH5 new-routing-mark=to-ISP2-Globe

add action=mark-connection chain=prerouting connection-mark=no-mark in-interface=sfp-sfpplus1 new-connection-mark=ISP1_conn per-connection-classifier=src-address:2/0

add action=mark-connection chain=prerouting connection-mark=no-mark in-interface=sfp-sfpplus1 new-connection-mark=ISP2_conn per-connection-classifier=src-address:2/1

add action=mark-routing chain=prerouting connection-mark=ISP1_conn in-interface=sfp-sfpplus1 new-routing-mark=to-ISP1-PLDT

add action=mark-routing chain=prerouting connection-mark=ISP2_conn in-interface=sfp-sfpplus1 new-routing-mark=to-ISP2-Globe

add action=mark-packet chain=forward comment="VoIP / Zoom" dst-port=3478-3481 new-packet-mark=voip protocol=udp

add action=mark-packet chain=forward comment="RTP audio" dst-port=5004-5010 new-packet-mark=voip protocol=udp

add action=mark-packet chain=forward comment="Web traffic" new-packet-mark=web port=80,443 protocol=tcp

add action=mark-packet chain=forward comment=Torrents new-packet-mark=bulk port=6881-6999 protocol=tcp

add action=mark-packet chain=forward comment=qBittorrent new-packet-mark=bulk port=51413 protocol=tcp

add action=mark-packet chain=forward comment="Everything else" new-packet-mark=default

add action=mark-packet chain=forward content=googlevideo.com new-packet-mark=pm_youtube port=443 protocol=tcp

add action=mark-packet chain=forward new-packet-mark=pm_voip port=5060-5061,10000-20000 protocol=udp

/ip firewall nat

add action=masquerade chain=srcnat out-interface=ISP1-PLDT

add action=masquerade chain=srcnat out-interface=ISP2-GLOBE

/ip route

add check-gateway=ping dst-address=0.0.0.0/0 gateway=192.168.1.1 routing-table=to-ISP1-PLDT

add check-gateway=ping dst-address=0.0.0.0/0 gateway=192.168.254.254 routing-table=to-ISP2-Globe

add check-gateway=ping distance=1 dst-address=0.0.0.0/0 gateway=192.168.1.1

add check-gateway=ping distance=2 dst-address=0.0.0.0/0 gateway=192.168.254.254

/ppp secret

add name=ssv-front1 profile=ssv-def-80mb service=pppoe

add name=ssv-back-office profile=ssv-def-80mb service=pppoe

add name=SSV-001 profile=ssv-def-80mb service=pppoe

2

Have no experience with WAN failover, but from the documentation (Failover (WAN Backup) - RouterOS - MikroTik Documentation) I would say:

/ip route
add check-gateway=ping dst-address=0.0.0.0/0 gateway=192.168.1.1 routing-table=to-ISP1-PLDT
add check-gateway=ping dst-address=0.0.0.0/0 gateway=192.168.254.254 routing-table=to-ISP2-Globe
add check-gateway=ping distance=1 dst-address=0.0.0.0/0 gateway=192.168.1.1
add check-gateway=ping distance=2 dst-address=0.0.0.0/0 gateway=192.168.254.254

Should be (something like):

/ip/route/
add distance=1 gateway=192.168.1.1 target-scope=11 check-gateway=ping
add distance=2 gateway=192.168.254.254 target-scope=11 check-gateway=ping
3

That depends on RouterOs version.

The way for v7.x is explained in this thread here:
Primary gateway with static ip address not activating
extremely simplified:
Primary gateway with static ip address not activating - #23 by jaclaz

Only as side note, if you have n ISP's, you actually need n-1 recursive routes, as when internet is not reachable on ALL your n-x routes and you reach the nth one, it's game over, no further possibilities left.

4

I am using the Router OS 7.19 version

5

The you need appropriate scope and target-scope settings, as seen in the given thread.

6

WHY?

He is not doing any recursive.
He separates WAN1 and WAN2 by distance.
The two other routes with special tables are not related.
The two other routes with special tables DO NOT NEED check-gateway=ping

aka I see nothing wrong with:

/ip route
add check-gateway=ping  dst-address=0.0.0.0/0 gateway=192.168.1.1 comment="Primary"
add  distance=2 dst-address=0.0.0.0/0 gateway=192.168.254.254  comment="Secondary"
add  dst-address=0.0.0.0/0 gateway=192.168.1.1 routing-table=to-ISP1-PLDT
add  dst-address=0.0.0.0/0 gateway=192.168.254.254 routing-table=to-ISP2-Globe

Note: There is no need for check-gateway=ping for Secondary WAN as there is no alternative option if WAN2 is also down. However, it woud make sense, if the OP has incoming traffic through WAN2 (port forwarding) or TO the router (like vpn on WAN2).

7

After reading the config, its clear that this TITLE is misleading. You are doing PCC Load balancing,
NOT DUAL WAN FAILOVER.

Make up your mind!!

8

If doing PCC Load balance then yes put the check-gateway=ping back in for the Second WAN.

However why are you doing PCC,,,,,,,,,,,, what are the throughputs of each WAN? If reasonably close simply use ECMP load balancing.

9

sorry for the misleading title. I am new to the terms of network in mikrotik. what I think was that, I am doing DUAL WAN FAILOVER and it doesnt work. That's why i am asking for help. My PCC Load balancing I know there's something wrong and it lost some packets during ping.

10

Thank you I will check-gateway=ping to the second WAN.

I am doing PCC the 1st ISP has 500mbps the 2nd ISP it says 1 gbps. But Isp1 has more throughput than Isp2.

11

Hello guys do i need to delete this and build a new one? What do I need to change over here? Thank you

12

You seem to be doing a whole hockey sock of other things in mangling etc..
So its too hazy at the moment.
Suggest you
a. identify all the user(s)/device(s) involved
b. identify all their traffic needs.
c. which wans they are coming in if not originating in the router
d. which LAN originating entities are not to be involved in pcc

13

than you for you suggestion... as of the moment it's working but my problem is in peak hours from 8pm onwards where i could experience 20-40% packet loss. is there a way i could prevent this?

14

no, PCC is abomination sorry for the lack of better word it chew CPU a lot of CPU cycles that can lead to packet loss from experience, use proper PBR and don't use mangle if you can.

15

I really dont care if things are working, I can only help when the requirements are clearly articulated, and then an optimal design can be brought forward.

Also there is a discrepancy, you pay for ISP1 to give you 500Mbps and you pay ISP2 to give you 1Gbps but you state that ISP1 actually gives you more??
Nice to know but you didnt state what you actually get for both...........again lacking facts.
Also, suggest you contact ISP2 and ask them why you are not getting what you pay for.

And no your mangling is partially okay but not complete...........
And yes often things can kinda work but if the config is not correct.........this is probably the case.

16

thank you for your response, I actually reconfigured this instead of pcc i used the PBR but i dont know if it is right as i have to test this one on peak hours. All i need is a realible internet connection for 60 household using pppoe. here is the reconfigured /ip firewall mangle and /ip routes maybe you can help me

/ip firewall mangle
add action=mark-routing chain=prerouting comment="PBR to ISP1" dst-address-list=!PrivateIP in-interface=LAN-ETH5 new-routing-mark=to-ISP1-PLDT passthrough=no \
    src-address-list=to-ISP1-PLDT
add action=mark-routing chain=prerouting comment="PBR to ISP2" dst-address-list=!PrivateIP in-interface=LAN-ETH5 new-routing-mark=to-ISP2-Globe passthrough=no \
    src-address-list=to-ISP2-GLOBE
add action=mark-connection chain=prerouting comment="Web(Http + Https)" dst-port=80,443 new-connection-mark=Web_Conn protocol=tcp
add action=mark-connection chain=prerouting dst-port=80,443 new-connection-mark=Web_Conn protocol=udp
add action=mark-packet chain=prerouting connection-mark=Web_Conn in-interface=LAN-ETH5 new-packet-mark=Web_Up passthrough=no
add action=mark-packet chain=prerouting connection-mark=Web_Conn in-interface=bridge-LAN new-packet-mark=Web_Up passthrough=no
add action=mark-packet chain=prerouting connection-mark=Web_Conn in-interface-list=WAN-LIST new-packet-mark=Web_Down passthrough=no
add action=mark-connection chain=prerouting comment="ICMP " new-connection-mark=ICMP_Conn protocol=icmp
add action=mark-packet chain=prerouting connection-mark=ICMP_Conn in-interface=LAN-ETH5 new-packet-mark=ICMP_Up passthrough=no
add action=mark-packet chain=prerouting connection-mark=ICMP_Conn in-interface=bridge-LAN new-packet-mark=ICMP_Up passthrough=no
add action=mark-connection chain=prerouting connection-mark=ICMP_Conn in-interface-list=WAN-LIST new-connection-mark=ICMP_Down passthrough=no
add action=mark-connection chain=prerouting comment=DNS dst-port=53 new-connection-mark=DNS_Conn protocol=tcp
add action=mark-connection chain=prerouting dst-port=53 new-connection-mark=DNS_Conn protocol=udp
add action=mark-packet chain=prerouting connection-mark=DNS_Conn in-interface=bridge-LAN new-packet-mark=DNS_Up passthrough=no
add action=mark-packet chain=prerouting connection-mark=DNS_Conn in-interface=LAN-ETH5 new-packet-mark=DNS_Up passthrough=no
add action=mark-packet chain=prerouting connection-mark=DNS_Conn in-interface-list=WAN-LIST new-packet-mark=DNS_Down passthrough=no

/ip firewall nat
add action=masquerade chain=srcnat comment="NAT Internet" out-interface-list=WAN-LIST

/ip route
add check-gateway=ping comment="PBR ISP 1" disabled=no distance=1 dst-address=0.0.0.0/0 gateway=192.168.1.1 routing-table=to-ISP1-PLDT scope=30 suppress-hw-offload=\
    no target-scope=10
add check-gateway=ping comment="Backup PBR ISP2" disabled=no distance=1 dst-address=0.0.0.0/0 gateway=192.168.1.1 routing-table=to-ISP2-Globe scope=30 \
    suppress-hw-offload=no target-scope=10
add check-gateway=ping comment="ISP PLDT (main)" disabled=no distance=1 dst-address=0.0.0.0/0 gateway=192.168.1.1 routing-table=main scope=10 suppress-hw-offload=no \
    target-scope=10
add check-gateway=ping comment="ISP Globe (main)" disabled=no distance=2 dst-address=0.0.0.0/0 gateway=192.168.254.254 routing-table=main scope=10 \
    suppress-hw-offload=no target-scope=10
add check-gateway=ping comment="Backup PBR ISP 1" disabled=no distance=2 dst-address=0.0.0.0/0 gateway=192.168.254.254 routing-table=to-ISP1-PLDT scope=30 \
    suppress-hw-offload=no target-scope=10
add check-gateway=ping comment="Recursive Check DNS ISP1" disabled=no distance=1 dst-address=8.8.4.4/32 gateway=192.168.1.1 routing-table=main scope=10 \
    suppress-hw-offload=no target-scope=10
add check-gateway=ping comment="Recursive Check DNS Isp 2" disabled=no distance=1 dst-address=8.8.8.8/32 gateway=192.168.254.254 routing-table=main scope=10 \
    suppress-hw-offload=no target-scope=10
add check-gateway=ping comment="PBR ISP 2" disabled=no distance=1 dst-address=0.0.0.0/0 gateway=192.168.254.254 routing-table=to-ISP2-Globe scope=30 \
    suppress-hw-offload=no target-scope=10
17

thank you for your response I change to PBR. Can you take a look

/ip firewall mangle
add action=mark-routing chain=prerouting comment="PBR to ISP1" dst-address-list=!PrivateIP in-interface=LAN-ETH5 new-routing-mark=to-ISP1-PLDT passthrough=no \
    src-address-list=to-ISP1-PLDT
add action=mark-routing chain=prerouting comment="PBR to ISP2" dst-address-list=!PrivateIP in-interface=LAN-ETH5 new-routing-mark=to-ISP2-Globe passthrough=no \
    src-address-list=to-ISP2-GLOBE
add action=mark-connection chain=prerouting comment="Web(Http + Https)" dst-port=80,443 new-connection-mark=Web_Conn protocol=tcp
add action=mark-connection chain=prerouting dst-port=80,443 new-connection-mark=Web_Conn protocol=udp
add action=mark-packet chain=prerouting connection-mark=Web_Conn in-interface=LAN-ETH5 new-packet-mark=Web_Up passthrough=no
add action=mark-packet chain=prerouting connection-mark=Web_Conn in-interface=bridge-LAN new-packet-mark=Web_Up passthrough=no
add action=mark-packet chain=prerouting connection-mark=Web_Conn in-interface-list=WAN-LIST new-packet-mark=Web_Down passthrough=no
add action=mark-connection chain=prerouting comment="ICMP " new-connection-mark=ICMP_Conn protocol=icmp
add action=mark-packet chain=prerouting connection-mark=ICMP_Conn in-interface=LAN-ETH5 new-packet-mark=ICMP_Up passthrough=no
add action=mark-packet chain=prerouting connection-mark=ICMP_Conn in-interface=bridge-LAN new-packet-mark=ICMP_Up passthrough=no
add action=mark-connection chain=prerouting connection-mark=ICMP_Conn in-interface-list=WAN-LIST new-connection-mark=ICMP_Down passthrough=no
add action=mark-connection chain=prerouting comment=DNS dst-port=53 new-connection-mark=DNS_Conn protocol=tcp
add action=mark-connection chain=prerouting dst-port=53 new-connection-mark=DNS_Conn protocol=udp
add action=mark-packet chain=prerouting connection-mark=DNS_Conn in-interface=bridge-LAN new-packet-mark=DNS_Up passthrough=no
add action=mark-packet chain=prerouting connection-mark=DNS_Conn in-interface=LAN-ETH5 new-packet-mark=DNS_Up passthrough=no
add action=mark-packet chain=prerouting connection-mark=DNS_Conn in-interface-list=WAN-LIST new-packet-mark=DNS_Down passthrough=no

/ip firewall nat
add action=masquerade chain=srcnat comment="NAT Internet" out-interface-list=WAN-LIST

/ip route
add check-gateway=ping comment="PBR ISP 1" disabled=no distance=1 dst-address=0.0.0.0/0 gateway=192.168.1.1 routing-table=to-ISP1-PLDT scope=30 suppress-hw-offload=\
    no target-scope=10
add check-gateway=ping comment="Backup PBR ISP2" disabled=no distance=1 dst-address=0.0.0.0/0 gateway=192.168.1.1 routing-table=to-ISP2-Globe scope=30 \
    suppress-hw-offload=no target-scope=10
add check-gateway=ping comment="ISP PLDT (main)" disabled=no distance=1 dst-address=0.0.0.0/0 gateway=192.168.1.1 routing-table=main scope=10 suppress-hw-offload=no \
    target-scope=10
add check-gateway=ping comment="ISP Globe (main)" disabled=no distance=2 dst-address=0.0.0.0/0 gateway=192.168.254.254 routing-table=main scope=10 \
    suppress-hw-offload=no target-scope=10
add check-gateway=ping comment="Backup PBR ISP 1" disabled=no distance=2 dst-address=0.0.0.0/0 gateway=192.168.254.254 routing-table=to-ISP1-PLDT scope=30 \
    suppress-hw-offload=no target-scope=10
add check-gateway=ping comment="Recursive Check DNS ISP1" disabled=no distance=1 dst-address=8.8.4.4/32 gateway=192.168.1.1 routing-table=main scope=10 \
    suppress-hw-offload=no target-scope=10
add check-gateway=ping comment="Recursive Check DNS Isp 2" disabled=no distance=1 dst-address=8.8.8.8/32 gateway=192.168.254.254 routing-table=main scope=10 \
    suppress-hw-offload=no target-scope=10
add check-gateway=ping comment="PBR ISP 2" disabled=no distance=1 dst-address=0.0.0.0/0 gateway=192.168.254.254 routing-table=to-ISP2-Globe scope=30 \
    suppress-hw-offload=no target-scope=10
18

Please read my post from the other thread. Especially the part that tells you that if you want to do mangling or routing manipulation with the traffic of your PPPoE clients, it is useless to have the rules acting on the ETHERNET interface below those PPPoE client connections. You keep putting LAN-ETH5 (and previously sfp-sfpplus1 too) in your rules, but that's not how you do it. Read my other post about modifying the PPP profiles so that the PPPoE clients are automatically added to an interface list, then use your rules on that interface list.

19

Do the continued confusion, please go back to basics.
a. provide a network diagram
b. (1) identify all the users/devices on the network.
(2) identify all the traffic they should accomplish including the admin
c. provide detail around the WAN connections,....

  • any port forwarding through them
  • any vpns to them
  • primary/failover or LB
  • which local sources are to use which WAN if any preferences

d. yet to answer the specific throughputs on the WANs...