Hello. I'm trying to migrate my config of address list-based routing from RouterOS v6 to RouterOS v7. Here's my RouterOS v6 config: /ip/firewall/address-list> add list block_bypass /ip/firewall/address-list> add address=example.org list=block_bypass /ip/firewall/mangle> add action=mark-routing ch…

Most of the extra firewall rules people put in are not required. What are you experiencing that forces you to adopt ‘extra’ rules? Do you have many servers open to the public??

I’m not sure it your firewall config. Although hard to know from just the snippet - it’s does have the right pieces… Perhaps not, but this sounds like an MTU problem… (e.g. working but slow and TCP retransmissions…) Is icmp allowed in the firewall? Is the MTU for the VPN interface “right”? e.g.…

When TCP connections are taking long or even not complete then think of MTU problems. For that I have the following rule in Mange: add action=change-mss chain=forward comment="WireGuard & IKEv2 Sync" in-interface-list=PMTU-IN log-prefix=MSS new-mss=clamp-to-pmtu \ passthrough=yes protocol=tcp t…

When TCP connections are taking long or even not complete then think of MTU problems. For that I have the following rule in Mange: add action=change-mss chain=forward comment="WireGuard & IKEv2 Sync" in-interface-list=PMTU-IN log-prefix=MSS new-mss=clamp-to-pmtu \ passthrough=yes protocol=tcp…

Keep in mind, changing MTU may not have an immediate effect… Connections are tracked and devices have caches of PMTUD. And also setting too low have introduce new problems. But with @msatter this sounds like MTU issue, someplace… Might want to post your full config. Still could be firewall, but…

P.S. I am still open to suggestions how to solve this “address list-based routing” task more efficiently. I’d say using /routing/rules instead of address-list. But if what you had was working in V6, be easier to figure out the likely one thing that didn’t convert from V6 right, than redo the c…

Keep in mind, changing MTU may not have an immediate effect… Connections are tracked and devices have caches of PMTUD. And also setting too low have introduce new problems. But with @msatter this sounds like MTU issue, someplace… Might want to post your full config. Still could be firewall, b…

Hard to know, snippets really do NOT tell us much. e.g. Is the VPN also in the main routing table as well, or is just in the new route-table? When you “tried changing the MTU”, what exact did you try? Did you do ping test to verify the actual MTU? My concern is the default MTU may be differen…

You state re-transmissions then the question is your network sending out the request, or the other side because it did not got an acknowledgement from you? Secondly did you see any traffic hitting the MTU rule I gave? With this one you don’t need to state a wished MTU and it will adapt to the MTU s…

You state re-transmissions then the question is your network sending out the request, or the other side because it did not got an acknowledgement from you? Secondly did you see any traffic hitting the MTU rule I gave? With this one you don’t need to state a wished MTU and it will adapt to the MTU…

Implementing address list-based routing with RouterOS v7

RouterOS General

medvm August 4, 2023, 4:11pm 14

I was just about to write that I solved the problem by disabling fasttrack. Here's the solution Static Default Route - I'm missing something - #9 by sindy