Hi, I have issues with this configuration. I have configured it currently with PCC with Failover and Load Balancing. I have “error connection was reset” in browsers of clients and it’s really annoying. I’m trying to change config of my router. This configuration I’m trying to put, but it says it couldn’t find DNS address in browser. What is wrong? Thank you.
/interface list
add name=LANs
add name=WANs
/interface bridge
add arp=proxy-arp name=LAN-bridge
add bridge=LAN-bridge interface=ether3
add bridge=LAN-bridge interface=ether4
/ip neighbor discovery
set ether1 discover=no
set ether2 discover=no
set ether3 discover=no
set ether4 discover=no
set ether5 discover=no
set ether6 discover=no
set ether7 discover=no
set ether8 discover=no
set sfp-sfpplus1 discover=no
set sfp1 discover=no
set LAN-bridge discover=no
/interface vlan
add interface=LAN-bridge l2mtu=1574 name=EngeniusAP vlan-id=32
add interface=LAN-bridge l2mtu=1574 name=VLAN1 vlan-id=1
add interface=LAN-bridge l2mtu=1574 name=Management vlan-id=99
add interface=LAN-bridge l2mtu=1574 name=Work1 vlan-id=11
add interface=LAN-bridge l2mtu=1574 name=Work2 vlan-id=12
/interface list member
add interface=ether1 list=WANs
add interface=ether2 list=WANs
add interface=LAN-bridge list=LANs
add interface=EngeniusAP list=LANs
add interface=Work1 list=LANs
add interface=Work2 list=LANs
add interface=Management list=LANs
/ip neighbor discovery
set EngeniusAP discover=no
set VLAN1 discover=no
set Management discover=no
set Work1 discover=no
set Work2 discover=no
add name=Work1Pool ranges=192.168.11.100-192.168.11.254
add name=Work2Pool ranges=192.168.12.100-192.168.12.254
add name=VLAN1Pool ranges=“192.168.1.101-192.168.1.150, 192.168.1.171-192.168.1.199, 192.168.1.216-192.168.1.222, 192.168.1.230-192.168.1.235, 192.168.1.237-192.168.1.254”
add name=EngeniusPool ranges=192.168.32.101-192.168.35.254
add name=ManagementPool ranges=192.168.99.100-192.168.99.254
/ip dhcp-server
add address-pool= EngeniusPool disabled=no interface=EngeniusAP name=DHCPVLAN3
add address-pool= VLAN1Pool disabled=no interface=LAN-bridge name=DHCPVLAN1
add address-pool= Work1Pool disabled=no interface=Work1 name=DHCPVLAN11
add address-pool= Work2Pool disabled=no interface=Work2 name=DHCPVLAN12
/port
set 0 name=serial0
set 1 name=serial1
/ip settings
set rp-filter=strict tcp-syncookies=yes
/ip firewall connection tracking
set enabled=yes
/ip address
add address=A.A.A.A/30 interface=ether1 network=92.247.180.132
add address=B.B.B.B/27 interface=ether2 network=B.B.B.x
add address=192.168.1.1/24 interface=LAN-bridge network=192.168.1.0
add address=192.168.11.1/24 interface=Work1 network=192.168.11.0
add address=192.168.32.1/22 interface=EngeniusAP network=192.168.32.0
add address=192.168.12.1/24 interface=Work2 network=192.168.12.0
/ip dhcp-server network
add address=192.168.1.0/24 dns-server=192.168.1.1 gateway=192.168.1.1 netmask=24
add address=192.168.11.0/24 dns-server=192.168.11.1 gateway=192.168.11.1 netmask=24
add address=192.168.12.0/24 dns-server=192.168.12.1 gateway=192.168.12.1 netmask=24
add address=192.168.32.0/22 dns-server=192.168.32.1 gateway=192.168.32.1 netmask=22
/ip firewall address-list
add address=192.168.1.0/24 list=LANs
add address=192.168.11.0/24 list=LANs
add address=192.168.12.0/24 list=LANs
add address=192.168.32.0/22 list=LANs
add address=192.168.99.0/24 list=LANs
/ip firewall filter
add action=accept chain=input comment=“Allow established, related, untracked conn’s” connection-state=established,related,untracked
add action=drop chain=input comment=“Drop Invalid conn’s” connection-state=invalid
add action=add-src-to-address-list address-list=“DoS attack list” address-list-timeout=1h chain=input comment=“detect DoS attack” connection-limit=15,32 protocol=tcp
add action=tarpit chain=input comment=“suppress DoS attack” connection-limit=3,32 log=yes log-prefix=“dos attack input” protocol=tcp src-address-list=“DoS attack list”
add action=accept chain=input protocol=icmp comment=“Allow ICMP”
add action=accept chain=input comment=“Allow WinBOX from LANs” dst-port=8291 in-interface-list=!WANs protocol=tcp
add action=accept chain=input comment=“Allow lan interfaces” in-interface-list=LANs
add action=drop chain=input comment=“Deny everything else coming to router”
add action=accept chain=forward comment=“=====FORWARD===== Allow EstRelUnt conn” connection-state=established,related,untracked
add action=drop chain=forward comment=“Drop Invalid conn’s” connection-state=invalid
add action=accept chain=icmp comment=“allow icmp”
add action=drop chain=forward comment=“Drop not DSTN” connection-nat-state=!dstnat connection-state=new in-interface-list=WANs
/ip firewall mangle
add action=mark-connection chain=input in-interface=ether1 new-connection-mark=WAN1-conn
add action=mark-connection chain=input in-interface=ether2 new-connection-mark=WAN2-conn
add action=mark-routing chain=output connection-mark=WAN1-conn new-routing-mark=route_to_ISP1
add action=mark-routing chain=output connection-mark=WAN2-conn new-routing-mark=route_to_ISP2
add action=mark-connection chain=prerouting connection-state=new dst-address-type=!local in-interface=Work1 new-connection-mark=WAN1-conn per-connection-classifier=src-address:3/0
add action=mark-connection chain=prerouting connection-state=new dst-address-type=!local in-interface=Work1 new-connection-mark=WAN1-conn per-connection-classifier=src-address:3/1
add action=mark-connection chain=prerouting connection-state=new dst-address-type=!local in-interface=Work1 new-connection-mark=WAN2-conn per-connection-classifier=src-address:3/2
add action=mark-connection chain=prerouting connection-state=new dst-address-type=!local in-interface=EngeniusAP new-connection-mark=WAN1-conn per-connection-classifier=src-address:3/0
add action=mark-connection chain=prerouting connection-state=new dst-address-type=!local in-interface=EngeniusAP new-connection-mark=WAN1-conn per-connection-classifier=src-address:3/1
add action=mark-connection chain=prerouting connection-state=new dst-address-type=!local in-interface=EngeniusAP new-connection-mark=WAN2-conn per-connection-classifier=src-address:3/2
add action=mark-connection chain=prerouting connection-state=new dst-address-type=!local in-interface=Work2 new-connection-mark=WAN1-conn per-connection-classifier=src-address:3/0
add action=mark-connection chain=prerouting connection-state=new dst-address-type=!local in-interface=Work2 new-connection-mark=WAN1-conn per-connection-classifier=src-address:3/1
add action=mark-connection chain=prerouting connection-state=new dst-address-type=!local in-interface=Work2 new-connection-mark=WAN2-conn per-connection-classifier=src-address:3/2
add action=mark-connection chain=prerouting connection-state=new dst-address-type=!local in-interface=VLAN1 new-connection-mark=WAN1-conn per-connection-classifier=src-address:3/0
add action=mark-connection chain=prerouting connection-state=new dst-address-type=!local in-interface=VLAN1 new-connection-mark=WAN1-conn per-connection-classifier=src-address:3/1
add action=mark-connection chain=prerouting connection-state=new dst-address-type=!local in-interface=VLAN1 new-connection-mark=WAN2-conn per-connection-classifier=src-address:3/2
add action=mark-routing chain=prerouting connection-mark=WAN1-conn new-routing-mark=route_to_ISP1
add action=mark-routing chain=prerouting connection-mark=WAN2-conn new-routing-mark=route_to_ISP2
/ip firewall nat
add action=masquerade chain=srcnat out-interface-list=WANs src-address-list=LANs
/ip firewall raw
add action=drop chain=prerouting comment=DNS dst-port=53 in-interface-list=WANs protocol=udp
add action=drop chain=prerouting comment=DNS dst-port=53 in-interface-list=WANs protocol=tcp
/ip dns
set allow-remote-requests=yes cache-size=10240KiB servers=8.8.8.8,8.8.4.4,1.1.1.1
/ip route
add dst-address=1.1.1.1 gateway=A.A.A.1 scope=10 comment=WAN-ISP1
add dst-address=8.8.8.8 gateway=B.B.B.1 scope=10 comment=WAN-ISP2
add distance=1 gateway=1.1.1.1 routing-mark=route_to_ISP1 check-gateway=ping
add distance=2 gateway=8.8.8.8 routing-mark=route_to_ISP1 check-gateway=ping
add distance=1 gateway=8.8.8.8 routing-mark=route_to_ISP2 check-gateway=ping
add distance=2 gateway=1.1.1.1 routing-mark=route_to_ISP2 check-gateway=ping
add distance=1 gateway=1.1.1.1 check-gateway=ping
add distance=2 gateway=8.8.8.8 check-gateway=ping
add distance=1 gateway=8.8.8.8 check-gateway=ping
add distance=2 gateway=1.1.1.1 check-gateway=ping
add distance=3 gateway=A.A.A.1
add distance=4 gateway=B.B.B.1
/ip ssh
set allow-none-crypto=yes forwarding-enabled=remote host-key-size=4096 strong-crypto=yes
/tool bandwidth-server
set enabled=no
/ip service
set telnet disabled=yes
set ftp disabled=yes
set ssh disabled=yes
set api disabled=yes
set api-ssl disabled=yes
/lcd
set time-interval=daily
/system clock
set time-zone-name=Europe/Sofia
/system clock manual
set time-zone=+02:00
/system ntp client
set enabled=yes primary-ntp=87.97.157.120 secondary-ntp=77.85.205.151
/system routerboard settings
set cpu-frequency=1200MHz memory-frequency=1066DDR
/tool graphing interface
add
add interface=ether1
add interface=ether2
/tool mac-server
set [ find default=yes ] disabled=yes
/tool netwatch
/tool traffic-monitor
add disabled=yes interface=ether1 name=tmon1 threshold=0