Hello,
Can some please explain what is this below lines mean and what it does?
add chain=prerouting connection-mark=ISP1_conn in-interface=LAN action=mark-routing
From what i think, the first two lines wants to mark the routing as “to_ISP1” and “to_ISP2” so that the last two lines can link “ISP1_conn” and “ISP2_conn” to “to_ISP1” and “to_ISP2” and finally we can use it here for IP Route below:
add dst-address=0.0.0.0/0 gateway=10.111.0.1 routing-mark=to_ISP1 check-gateway=ping
Thanks!Below is original:
/ ip address
/ ip firewall mangle
/ ip route
/ ip firewall nat
Hi, this is a Dual wan Bandwidth with failover .
Could you please explain this four lines. I would like to understand it and use this for future use.
add chain=prerouting connection-mark=ISP1_conn in-interface=LAN action=mark-routing
Discmandj:
Hi, this is a Dual wan Bandwidth with failover .
Could someone please help to explain.
Thank you.
In english, the first two rules say this:
Before making a routing decision… (prerouting chain)
rules 3 and 4 say the same thing, but are in the OUTPUT chain. PREROUTING only affects traffic originating outside the router (whether it’s going to be forwarded or else processed locally). If the router generates packets itself - say the router is going to ping some remote host to test gateway reachability… those don’t go through PREROUTING. They go through OUTPUT. You need all 4 of these rules so that all traffic follows a consistent policy.
There must be other rules elsewhere which assign connection marks because these rules don’t create the connection marks - they just use them as the decision-making point.
Thank you so much for the explanation.
ZeroByte:
In english, the first two rules say this:
Before making a routing decision… (prerouting chain)
rules 3 and 4 say the same thing, but are in the OUTPUT chain. PREROUTING only affects traffic originating outside the router (whether it’s going to be forwarded or else processed locally). If the router generates packets itself - say the router is going to ping some remote host to test gateway reachability… those don’t go through PREROUTING. They go through OUTPUT. You need all 4 of these rules so that all traffic follows a consistent policy.
There must be other rules elsewhere which assign connection marks because these rules don’t create the connection marks - they just use them as the decision-making point.
Dear ZeroByte,
Could you please tell me if my understanding is rigth.
Below this - the 4 lines here is just mark the routing path. And not make it route yet. Correct?
add chain=prerouting connection-mark=ISP1_conn in-interface=LAN action=mark-routing
/ ip firewall mangle
/ ip route
/ ip firewall nat
ZeroByte:
In english, the first two rules say this:
Before making a routing decision… (prerouting chain)
rules 3 and 4 say the same thing, but are in the OUTPUT chain. PREROUTING only affects traffic originating outside the router (whether it’s going to be forwarded or else processed locally). If the router generates packets itself - say the router is going to ping some remote host to test gateway reachability… those don’t go through PREROUTING. They go through OUTPUT. You need all 4 of these rules so that all traffic follows a consistent policy.
There must be other rules elsewhere which assign connection marks because these rules don’t create the connection marks - they just use them as the decision-making point.