From the wiki https://wiki.mikrotik.com/wiki/Manual:IP/Fasttrack and other topics we know that PBR does not play well with Fasttrack.
I also test it by www.speedtest.net, and it can’t complete the test.
But yesterday i found that if i delete the default route(0.0.0.0/0) from the main table, then for the lan client(means exclude the router itself), fasttrack works with policy based route.
The simple example can be found below:
Router:CCR1009-8G-1C-S+
ether5: to isp1 DL:200Mb/s UL:30Mb/s (in fact, it can achieve 230Mb/s~ dl，same as below)
ether6: to isp2 DL:200Mb/s UL:30Mb/s
ether7: to isp3 DL:200Mb/s UL:30Mb/s
ether8: to isp4 DL:200Mb/s UL:30Mb/s
ether4(lan): to lan
scripts:
/ip address
add address=192.168.12.33/24 interface=lan network=192.168.12.0
# set static dns server
/ip dns
set allow-remote-requests=yes servers=8.8.8.8
# be sure that there's no default route in the main tabble
/ip route
add distance=1 gateway=pppoe-wan1 routing-mark=rm_towan1
add distance=1 gateway=pppoe-wan2 routing-mark=rm_towan2
add distance=1 gateway=pppoe-wan3 routing-mark=rm_towan3
add distance=1 gateway=pppoe-wan4 routing-mark=rm_towan4
add distance=1 dst-address=8.8.8.8/32 gateway=pppoe-wan1 comment="the router needs access dns server, so add a static route."
# add pppoe client interface, no dns, no default route
/interface pppoe-client
add interface=ether5 name=pppoe-wan1 password=pw1 user=usr1
add interface=ether6 name=pppoe-wan2 password=pw1 user=usr1
add interface=ether7 name=pppoe-wan3 password=pw1 user=usr1
add interface=ether8 name=pppoe-wan4 password=pw1 user=usr1
/ip firewall nat
add action=masquerade chain=srcnat out-interface=pppoe-wan1
add action=masquerade chain=srcnat out-interface=pppoe-wan2
add action=masquerade chain=srcnat out-interface=pppoe-wan3
add action=masquerade chain=srcnat out-interface=pppoe-wan4
/ip firewall filter
add action=fasttrack-connection chain=forward connection-state=established,related comment="enable fasttrack"
add action=accept chain=forward connection-state=established,related
/ip firewall mangle
add action=accept chain=prerouting dst-address-type=local in-interface=lan comment="ignore the connection to the router"
add action=accept chain=prerouting dst-address=192.168.0.0/16 in-interface=lan comment="ignore the connection of lan<->lan"
# source in, source out
add action=mark-connection chain=prerouting in-interface=pppoe-wan1 new-connection-mark=cm_wan1 passthrough=no
add action=mark-connection chain=prerouting in-interface=pppoe-wan2 new-connection-mark=cm_wan2 passthrough=no
add action=mark-connection chain=prerouting in-interface=pppoe-wan3 new-connection-mark=cm_wan3 passthrough=no
add action=mark-connection chain=prerouting in-interface=pppoe-wan4 new-connection-mark=cm_wan4 passthrough=no
add action=mark-connection chain=prerouting connection-mark=no-mark \
in-interface=lan new-connection-mark=cm_wan1 passthrough=yes \
per-connection-classifier=both-addresses-and-ports:4/0
add action=mark-connection chain=prerouting connection-mark=no-mark \
in-interface=lan new-connection-mark=cm_wan2 passthrough=yes \
per-connection-classifier=both-addresses-and-ports:4/1
add action=mark-connection chain=prerouting connection-mark=no-mark \
in-interface=lan new-connection-mark=cm_wan3 passthrough=yes \
per-connection-classifier=both-addresses-and-ports:4/2
add action=mark-connection chain=prerouting connection-mark=no-mark \
in-interface=lan new-connection-mark=cm_wan4 passthrough=yes \
per-connection-classifier=both-addresses-and-ports:4/3
add action=mark-routing chain=prerouting connection-mark=cm_wan1 \
in-interface=lan new-routing-mark=rm_towan1 passthrough=yes
add action=mark-routing chain=prerouting connection-mark=cm_wan2 \
in-interface=lan new-routing-mark=rm_towan2 passthrough=yes
add action=mark-routing chain=prerouting connection-mark=cm_wan3 \
in-interface=lan new-routing-mark=rm_towan3 passthrough=yes
add action=mark-routing chain=prerouting connection-mark=cm_wan4 \
in-interface=lan new-routing-mark=rm_towan4 passthrough=yes
I did a test again with www.speedtest.net, and achieve 900Mb/s~ download speed with very low cpu utilization per core.
(I know ccr1009 is a powerful router, it can achieve the same speed with very low cpu utilization even without fasttrack for the example setting. But i can confirm that the fasttrack is working as ipv4 fasttrack packets in the /ip setting increased.)
attentions:
1.Because we delete the default route(0.0.0.0/0) for the main table, so for the internet connection, we need always do the connection mark & routing mark(except there exists a route for the dst address in the main table).
2.For the same reason as no.1, the router can’t access internet any more, as the result the router can’t be a dns server any more.(we assume that the router use public dns server as it’s upstream dns server)
I tried do the connection mark & routing mark in /ip firewall mangle’s output chain, but found that if there’s no default route in main table, then you have no chance to enter in the output chain.
Imperfect solution: add a route to the dns server in the main table. If there are other address the router need access, then add it one by one.
From the example, we can confirm that the connection mark and routeing mark still exist even after fasttrack begin work, so why it can’t work when the default route exists in the main table? Is it a bug?
Hope someone can explain it. And if there is a problem, please point out.
Thanks.