Hello
I am going to the point:
I want that one IPs go throught wan1(default) others wan2. These Ips are clients IP which get Ip from pppoe server.
I search in mikrotik wiki and forum. Theoricaly, it is easy: only mark connections and route and create route with mark route…I must be the most stupid of the group. I have not gotten it to work.
Initially I thought my situation was simpler … wrong
What happen? When I mark IPs to go out through wan2 those IPs do not get out internet connection
My simplified code:
Previous note: wan2 is ether11 with the IP 192.168.1.200, wan1 is a vlan
ONLY I created a routing mark to wan2, wan1 without routing mark (maybe does it the problem?)
I disabled all drop firewall rules
/ip settings
set rp-filter=strict tcp-syncookies=yes
/ip firewall nat
add action=src-nat chain=srcnat comment=“WAN2” out-interface=ether11 to-addresses=192.168.1.200Has the same thing happened to someone?
I appreciate any help.
I’m not sure that “rp-filter” would be the issue: it would only impact routing if asymmetric routing would be involved. This doesn’t sound to be the case.
List your full config (/export hide-sensitive) and clarify network setup.
Thank you Sub and Sebastia.
I change rp-filter=loose and it works!
…But Why? I thought the same as Sebastia.
True that initially I did not put all the information because I wanted to solve things step by step
Topology:
CCR1 with pppoe_server --------------------CCR2 with pppoe_server ----WAN1 y WAN2
(10.200.237.0/24) ----------------------------(150.2.2.135-150.2.2.191)
When I change in CCR2 rp-filter=loose the IPs 150.X.X.X do what I wanted: all go out throught WAN2 but If I tried to do the same with the internal IPs of the clients from CCR1 all wrong again
I thought I understood in mikrotik routing … I’m definitely very clumsy with routing
I attached my config (I recognize that it is somewhat messy) maybe it can help someone and and I can add light to what happens to me.
/interface bridge
add fast-forward=no name=bridge_pppoe
add name=lobridge
add name=publicbridge
/interface ethernet
set [ find default-name=ether11 ] comment=WAN2
set [ find default-name=ether12 ] comment=WAN
/interface pppoe-server
add name=1285 service=ServerAIR user=1285
add name=1323 service=ServerAIR user=1323
add name=1438 service=ServerAIR user=1438
add name=1558 service=ServerAIR user=1558
add name=cata service=PTP user=cata
I’ll be honest, I just remember that rp-filter=strict doesn’t go well with multi-WAN configs.
My super-fast “research” says that how it works is that system takes source and destination addresses from incoming packet, swaps them and checks where it would route such packet. If it’s via different interface than incoming, filter drops it. And since routing marks are not taken in account, it will fail for any other incoming interface than the one with default route in main routing table.
It also looks like rp-filter=loose might be useless for common scenarios:
I’m not exactly sure about “even a default route, if applicable” part, and I can’t properly test it now. But if only mere presence of default route (which is good for any destination) is enough, then it basically does nothing, because what device doesn’t have default route?
I don’t think I understand. CCR1 is internal machine with only one upstream connection, or not?
Yes, only one wireless upstream connection.
I chose to have two pppoe servers with local authentication. Now I am thinking of migrating everything to a radius system, I think radsec would be very useful to have radius servers in the cloud.
