help with mangle

RouterOS General
1

Hi,

Long time browsing the forum, first time posting. I have a lot more experience with cisco than mikrotik, but i find mikrotik to be very interesting and i have few devices to work with now.
My biggest issue is with mangle (at least i think so), im using RB1100. I will try to explain my problem in details (unable to post configuration for privacy reasons, client requires it…)
I’m happy to listen to any suggestion.

Situation is as follows:

On RB1100 on interface (interface 6) which is addressed 192.168.1.1/24 they have connected their switches and the rest of their network, they have their windows server as DHCP.
For this network they have two mangle rules (both prerouting, mark routing, passtrough) one is marked server communication and the other one client communication. They also have two routes one for each mangle rule, route is 0.0.0.0/0 with interface 5 as gateway (Interface 5 is WAN). They also use masquarade.
And everything is working peachy…

This is where it gets complicated (for me)
They made new VLAN on mikrotik with new mangle rule (also prerouting, mark routing, passtrough) and new routing mark - wifivlan, for that VLAN mikrotik is DHCP, address is 192.168.200.1/24. There is also new route 0.0.0.0/0 with routing mark wifivlan, gateway is also interface 5 (WAN).

So communication in network 192.168.1.0 is ok, communication in network 192.168.200.0 is also ok, but these two networks cant communicate between each other and they have resources on network 1.0 which they need to access from theri wifi → network 200.0…

I have tried:
Creating new mangle rule and putting it on top (rule was: prerouting, accept, dst and src networks were the networks in question)
Creating ip route rule with action lookup only in table main

Any suggestions?
Thanks in advance :slight_smile:

mangle problem
2

When a packet has got a routing-mark, it gets routed by the best matching route marked with that routing-mark, so unless you’ve manually added routes marked with wifivlan to the other subnets, the packets for them are sent elsewhere. The routes to connected subnets are only dynamically added to the routing table main (which contains routes without any routing-mark).

So you have to either prevent the routing-mark from being assigned to packets for other local subnets (by adding dst-address-list=!local-subnets to the mangle rule which assigns the routing-mark, and populating the address-list with the proper contents), or you can use /ip route rule to override the routing-mark, something like

/ip route rule add
src-address=192.168.0.0/16 dst-address=192.168.0.0/16 action=lookup-only-in-table table=main

As you cannot post the actual configuration, you’ll have to analyse your particular situation and choose the better approach. Routing rules are less flexible than the firewall but have their advantages.

3

I’ll try to do this as soon as possible and post if i were successful for anyone else having similar problems.
Thank you for your help.