Below find config related to Mikrotik RB750G router, running 6.0rc9.
I am trying to configure ISP redundancy in load-balancing mode through a PCC article.
I have three connected interfaces, LAN, WAN and WAN2. The Primary and secondary WAN connections have different speed.
Issue is that after configuring the router, I get no traffic on one of the firewall>mangle prerouting chain rules (for WAN). The same applies when I disable the secondary interface (WAN2) there is no automatic changeover to the primary interface.
Some observations I’ve noted through WebFig are the following:
Interface>Interface – Ok, Traffic being Transmitted and Received on all three interfaces
Interface>Ethernet – Ok, Traffic being Transmitted and Received on all three interfaces
DNS – Four set, two for one ISP and two for the other ISP
Firewall>NAT – seems ok, traffic being transmitted and received on all interfaces
Firewall>Mangle – there seems to be an issue here since there is no packets (counter still at 0), are flowing for primary ISP network addresses.
Rule is as follows:
/ip firewall mangle
Add chain=prerouting dst-address=XXXX action=accept in-interface=LAN
—————–
Note that all seems ok with the remaining prerouting (mark connection and mark routing) rules, since traffic is flowing. This includes the prerouting rule for the other WAN link.
Routes>Primary ISP Gateway is unreachable for static routes
Routes>Nexthops
Primary and secondary gateways are reachable for both nexthops
Below I am including extracts of the config.
(Please note that IP addresses/MAC Addresses have been left out and replaced with Text).
Should you require further info please let me know
[admin@MikroTik] /interface> print
Flags: D – dynamic, X – disabled, R – running, S – slave
NAME TYPE MTU L2MTU MAX-L2MTU MAC-ADDRESS
0 R WAN ether 1500 1520 1520 –
1 R LAN ether 1500 1520 1520 -
2 R WAN2 ether 1500 1520 1520 -
3 XS ether4-slave-local ether 1500 1520 1520 -
4 XS ether5-slave-local ether 1500 1520 1520 -
—
[admin@MikroTik] /ip address> print
Flags: X – disabled, I – invalid, D – dynamic
ADDRESS NETWORK INTERFACE
0 ;;; default configuration
192.168.88.1/24 192.168.88.0 LAN
1 ;;; Internet Primary
ISP1 IP Address [ISP1 Network Address] WAN
2 ;;; Internet Secondary
ISP2 IP Address [ISP2 Network Address] WAN2
—
[admin@MikroTik] /ip firewall mangle> print
Flags: X – disabled, I – invalid, D – dynamic
0 chain=prerouting action=accept dst-address=[ISP1 Network Address] in-interface=LAN
1 chain=prerouting action=accept dst-address=[ISP2 Network Address] in-interface=LAN
2 chain=prerouting action=mark-connection new-connection-mark=WAN_conn passthrough=yes
in-interface=WAN connection-mark=no-mark
3 chain=prerouting action=mark-connection new-connection-mark=WAN2_conn passthrough=yes in-interface=WAN2 connection-mark=no-mark
4 chain=prerouting action=mark-connection new-connection-mark=WAN_conn passthrough=yes
dst-address-type=!local in-interface=LAN connection-mark=no-mark
per-connection-classifier=both-addresses:2/0
5 chain=prerouting action=mark-connection new-connection-mark=WAN2_conn passthrough=yes
dst-address-type=!local in-interface=LAN connection-mark=no-mark
per-connection-classifier=both-addresses:2/1
6 chain=prerouting action=mark-routing new-routing-mark=to_WAN passthrough=yes
in-interface=LAN connection-mark=WAN_conn
7 chain=prerouting action=mark-routing new-routing-mark=to_WAN2 passthrough=yes
in-interface=LAN connection-mark=WAN2_conn
8 chain=output action=mark-routing new-routing-mark=to_WAN passthrough=yes
connection-mark=WAN_conn
9 chain=output action=mark-routing new-routing-mark=to_WAN2 passthrough=yes connection-mark=WAN2_conn
————–
[admin@MikroTik] /ip firewall nat> print
Flags: X – disabled, I – invalid, D – dynamic
1 chain=srcnat action=masquerade out-interface=WAN
2 chain=srcnat action=masquerade out-interface=WAN2
————–
[admin@MikroTik] /ip route> print
Flags: X – disabled, A – active, D – dynamic, C – connect, S – static, r – rip, b – bgp, o – ospf, m – mme,
B – blackhole, U – unreachable, P – prohibit
DST-ADDRESS PREF-SRC GATEWAY DISTANCE
0 0.0.0.0/0 ISP1 Gateway 1
1 0.0.0.0/0 ISP2 Gateway 2
2 0.0.0.0/0 ISP1 Gateway 1 (routing mark to_WAN)
3 0.0.0.0/0 ISP2 Gateway 2 (routing mark to_WAN2)
4 ADC 192.168.88.0/24 192.168.88.1 LAN 0
5 ADC ISP1 Network Address ISP1 Static IP WAN 0
6 ADC ISP2 Network Address ISP2 Static IP WAN2 0