Hello !
i have 2 DSL Connection both are of 4mpbs i am trying to create a scenario for my network by making mikrotik as a gateway in a way that whenever any of my client uses port 80 then mikrotik immediately takes it to my DSL1 but when any thing else is used (involving any other port other then port 80 i.e. !80) it uses my DSL2.
can any body give me exact procedure on how to do so.
thanx in advance.
The below assumes the following: dsl1 is on ether1 and has IP address 1.1.1.2/30 (gateway is 1.1.1.1), dsl2 is on ether2 and has IP address 1.1.1.6/30 (gateway is 1.1.1.5). The LAN is behind ether3 and has IP address 192.168.1.0/24.
/ip address
add address=1.1.1.2/30 interface=ether1
add address=1.1.1.6/30 interface=ether2
add address=192.168.0.1/24 interface=ether3
Now mark all packets coming in from the LAN destined to tcp/80 for non-router owned IP addresses with routing marks:
/ip firewall mangle
add chain=prerouting in-interface=ether3 protocol=tcp dst-port=80 action=mark-routing new-routing-mark=to_dsl1 dst-address-type=!local
Install a route for that routing mark out dsl1, and a default route that everything without a routing marks fall through to going out dsl2:
/ip route
add dst-address=0.0.0.0/0 routing-mark=to_dsl1 gateway=1.1.1.1
add dst-address=0.0.0.0/0 gateway=1.1.1.5
And finally src NAT on the two DSL interfaces:
/ip firewall nat
add chain=srcnat action=masquerade out-interface=ether1
add chain=srcnat action=masquerade out-interface=ether2
Hi fewi
Please explain why you have to nat each interface and not just add 1 srcnat masqurade rule. I am also doing this type of setup and have been having issues and think this is my problem.
Thanks
If you don’t specify some qualifier on what traffic to src-nat all eligible traffic will be src-nat’d, including - for example - traffic from the Internet port forwarded to your mail server. All that traffic would appear to come from the router’s LAN IP, which would make logs useless. It would work to get clients behind the router on the Internet, though.
There’s different ways to approach this. You could also have one rule referring to src-addresses. But to me the clearest and most obvious way of stating what you want to happen is to simply refer to out-interfaces.
Thankx for helping me !
settings that you showed me worked but not quite the way i expected it to be.
before implementing your setup, my browsing was working fine but now it has become very slow and i have no idea what went wrong even though i’ve followed the same procedure you gave me.
I don’t know why that would be, sorry.