Hello,
Is it possible to use source based routing without Mangle and marking?
I just need to add a field “Src.Address” to the standard Route form:
Yes, look at /ip route rule. Assigning routing-mark (aliased to table here) this way can even coexist with fasttracking.
Mikrotik Wiki do not have information about “Rules” tab settings for unknown reasons (https://wiki.mikrotik.com/wiki/Manual:IP/Route)
can you give more information?
Yes i think you can do it with /ip route rules and add a rule there.
Type Src Address:
Type Dst Address:
action: lookup
table: your routing-mark name
It is true that route rules are just briefly mentioned in the documentation, even the new one at https://help.mikrotik.com/docs/display/ROS/How+Packets+Are+Routed.
In these cases, the help system on the command line and some common sense based guessing and experiments creating an experience are necessary:
- type /ip route rule add and then press the [Tab] key, the Command Line context help will suggest you all the possible parameters of the command:
[me@myTik] > ip route rule add
action comment copy-from disabled dst-address interface place-before routing-mark src-address table
Out of those, the ones specific for /ip route rule rows have the following meaning:
- action - an instruction what should happen if the packet matches all the match conditions
- dst-address, src-address - match conditions for the destination and source addresses of the packet. The value must be a single prefix (an individual address or a subnet) for each of these parameters, no ranges or references to address list names are allowed. The default value is 0.0.0.0/0 (any address matches) for each.
- interface - a match condition for the interface through which the packet got in. Only actual IP interfaces may be used as values - no interface lists or meta-interfaces like all-ppp etc. By default this parameter is empty, i.e. all packets, including locally-originated ones, match.
- routing-mark - a match condition for the routing-mark value already assigned to the packet in previous handling stages - by a mangle rule with action=mark-routing or by VRF (based on the interface through which the packet got in).
- table - an additional parameter of action - where applicable, it specifies the new routing-mark value to be used, which is the same as the name of the routing table to be used - a routing table is a collection of routes marked with the same routing-mark. There is no default value.
- to learn the possible values of action, use the [Tab] key after typing the parameter name:
[me@myTik] > /ip route rule add action=
drop lookup lookup-only-in-table unreachable
or use a question mark instead to get the same in a slightly different form:
[me@myTik] > ip route rule add action=
Action ::= drop | lookup | lookup-only-in-table | unreachable
The meanings are:
- drop - silently drop the packet (no feedback to the sender)
unreachable - drop the packet and send an ICMP “destination unreachable” notification to the sender
lookup, lookup-only-in-table - use the specified routing table (identified by the routing-mark) to route the packet. The difference between the two is that lookup-only-in-table disables the fallback mechanism, which routes the packet using routing table main (consisting of routes with no routing-mark specified and those explicitly marked with routing-mark=main) if no matching route can be found in the routing table specified in the table parameter. With lookup-only-in-table, the packet is silently dropped in such case.
The /ip route rule rows are evaluated in the same manner like firewall rules in a chain, IPsec policies, or rules in /routing filter - first to last (top to bottom) until the first one matches. No “best match” can be used here, as multiple parameters are evaluated for each rule so best matching is in general impossible. This is a difference to plain routes, where only the dst-address is a match criteria, so the best (longest) match is an unambiguous sorter.
but routing rule doesn’t work as expected with the default route (dst.address=0.0.0.0/0).
I expected to see specific routes (in Routes tab in main table) first, and only if no specific route is found will the default route rule be used.
but this rule sends absolutely all packets from 192.168.0.1 to the default route, regardless of specific routes in Routes tab in main table:
It appears to be doing exactly what you told it to do??
see my first message with image - I need default route with source based routing.
It is a misconception. dst-address in the routing rule and dst-address on the route are not the same thing.
Your sample route rule says “use solely routing table to_ISP3 for all packets from 192.168.0.1 to any destination (dst-address=0.0.0.0/0), do not fall back to routing table main no matter what (lookup-only-in-table)”. What routes the routing table to_ISP3 actually contains is not a business of the routing rule, it is a matter of your configuration (or of dynamic routing protocol updating that table).
So you need a default route in each routing table (one approach), or, if you need source-based routes only for some specific destinations and the rest should use one common default route regardless the source address, you can use routing rules to choose specific routing tables only for those destinations. What won’t match any routing rule will be handled by table main.
in this case, the use of Route Rules is not suitable, and I am forced to use the mangle.
Write here the routing table (without routing-mark) the way you would configure it if no routing marks were available but the src-address property of a route was. It’s only a matter of perspective. If only addresses matter, not protocols/ports, connection-marks etc., you can do using route rules what you can do using mangle rules.
I already wrote what I want - I need the default route for packets from 192.168.0.1
The real issue is you are asking to configure a standard routing setup in such a way that is not feasible.
Sindy showed you an accurate response to the basic question of , I have a standard setup, now I want this subnet or this user etc, to use a different routing then the main table.
Since you didnt publish your current config, we have nothing to work from in terms of understanding what the normal config accomplishes.
Suggest posting it would be helpful.
/export hide-sensitive file=anynameyouwish
You’re funny. You ask for an advice, you don’t understand how to use the answer, and when I ask you to give a detailed description of your required configuration because you seem to need a particular example for your particular situation, you react as if it was me who is asking you for a favor.
But the point is that I am not a Mikrotik staff member, this is a forum of peer users.
An own/private/dedicated default route for 192.168.0.1 consists of two parts:
- /ip route add routing-mark=for-this-src gateway=some-gateway - this is the default route in table for-this-src
- /ip route rule add src-address=192.168.0.1 action=lookup-only-in-table table=for-this-src - this is the /ip route rule which makes packets from 192.168.0.1 use that table instead of main
That /ip route rule substitutes an /ip firewall mangle rule chain=prerouting src-address=192.168.0.1 action=mark-routing new-routing-mark=for-this-src.
Packets from all other source addresses than 192.168.0.1 will not match any /ip route rule, hence they will use whatever is in routing table main.
But the problem is that from your brief formulation I don’t get whether this is what you really want.
Now I’m using this Mangle rule:
add action=mark-routing chain=prerouting dst-address-list=!LAN_private new-routing-mark=to_ISP3 passthrough=no src-address=192.168.0.1
/export hide-sensitive file=anynameyouwish
Without seeing complete config, makes this a guessing game. It also provides way better communication tool…
You’ll need multiple /ip route rule rows to substitute this single mangle rule. Whether the resulting throughput will be faster or slower than with that single mangle rule depends on other factors, especially whether substitution of mangle rules by route rules allows you to use fasttracking. But even without fasttracking, matching a single prefix may be faster than matching an address-list.
/ip route rule
add src-address=192.168.0.1 dst-address=lan-subnet-1/mask action=lookup table=main
…
add src-address=192.168.0.1 dst-address=lan-subnet-n/mask action=lookup table=main
add src-address=192.168.0.1 action=lookup-only-in-table table=table=for-this-src
Depending on your overall environment, it may be possible to use a single exception rule with dst-address=192.168.0.0/16, and it may not be necessary to match on src-address in the exception rules.