L009UiGS-2HaxD with 2 WANS

brusuillis · October 1, 2025, 2:32pm

Hello,
I have a L009UiGS-2HaxD with various VLANs that is now working (let's say happily) with this configuration:

# 2025-09-30 17:00:10 by RouterOS 7.19.6
# software id = 4XEW-ZHE1
#
# model = L009UiGS-2HaxD
/interface bridge
add name=BR1 port-cost-mode=short protocol-mode=none vlan-filtering=yes
/interface ethernet
set [ find default-name=ether1 ] comment=WAN1
set [ find default-name=ether2 ] comment=WAN2
set [ find default-name=ether3 ] comment="Switch Guardaroba"
set [ find default-name=ether4 ] comment="Switch Taverna"
set [ find default-name=ether5 ] comment="AP Corridoio"
set [ find default-name=ether6 ] comment="AP Sala"
set [ find default-name=ether7 ] comment="HUB Ufficio Interno"
set [ find default-name=ether8 ] comment=--BASE--
set [ find default-name=sfp1 ] comment=--TRUNK--
/interface wireguard
add listen-port=13331 mtu=1420 name=wireguard1
/interface vlan
add comment="Network MGMT" interface=BR1 name=BASE_VLAN vlan-id=99
add comment=IoT interface=BR1 name=BLUE_VLAN vlan-id=10
add comment=Home interface=BR1 name=GREEN_VLAN vlan-id=20
add comment=WAN1 interface=ether1 name=ISP1_VLAN vlan-id=100
add comment=Office interface=BR1 name=RED_VLAN vlan-id=30
/interface pppoe-client
add add-default-route=yes comment=Eolo disabled=no interface=ISP1_VLAN name=\
    pppoe-wan1 user=myuser
/interface list
add name=WAN
add name=HOUSE
add name=BASE
add name=LAN
add name=LOCAL
/interface wifi security
add authentication-types=wpa2-psk,wpa3-psk disabled=no name=default
/interface wifi
set [ find default-name=wifi1 ] configuration.hide-ssid=yes .mode=ap .ssid=\
    mySSID1 disabled=no security=default security.authentication-types=\
    wpa2-psk,wpa3-psk
/ip pool
add name=BLUE_POOL ranges=192.168.3.2-192.168.3.254
add name=GREEN_POOL ranges=192.168.203.2-192.168.203.254
add name=BASE_POOL ranges=10.3.99.10-10.3.99.30
add name=RED_POOL ranges=10.3.30.10-10.3.30.254
/ip dhcp-server
add address-pool=BLUE_POOL interface=BLUE_VLAN lease-time=1d name=BLUE_DHCP
add address-pool=GREEN_POOL interface=GREEN_VLAN lease-time=1d name=\
    GREEN_DHCP
add address-pool=BASE_POOL interface=BASE_VLAN lease-time=5d name=BASE_DHCP
add address-pool=RED_POOL interface=RED_VLAN lease-time=1d name=RED_DHCP
/ip smb users
set [ find default=yes ] disabled=yes
/port
set 0 name=serial0
/certificate settings
set builtin-trust-anchors=not-trusted
/interface bridge port
add bridge=BR1 comment="TRUNK Switch Guardaroba" interface=ether3 \
    internal-path-cost=10 path-cost=10 pvid=10
add bridge=BR1 comment="BASE WLAN" interface=wifi1 internal-path-cost=10 \
    path-cost=10 pvid=99
add bridge=BR1 comment="TRUNK Switch Taverna" interface=ether4 \
    internal-path-cost=10 path-cost=10 pvid=10
add bridge=BR1 comment="TRUNK AP Corridoio" interface=ether5 \
    internal-path-cost=10 path-cost=10 pvid=10
add bridge=BR1 comment="TRUNK AP Sala" interface=ether6 internal-path-cost=10 \
    path-cost=10 pvid=10
add bridge=BR1 comment=--BASE-- interface=ether8 internal-path-cost=10 \
    path-cost=10 pvid=99
add bridge=BR1 comment=--BLUE-- interface=ether7 internal-path-cost=10 \
    path-cost=10 pvid=30
/ip firewall connection tracking
set udp-timeout=10s
/ip neighbor discovery-settings
set discover-interface-list=BASE
/interface bridge vlan
add bridge=BR1 comment=GREEN_VLAN tagged=BR1,ether3,ether4,ether5,ether6 \
    vlan-ids=20
add bridge=BR1 comment=BLUE_VLAN tagged=BR1,ether3,ether4,ether5,ether6 \
    vlan-ids=10
add bridge=BR1 comment=BASE_VLAN tagged=BR1,ether3,ether4,ether5,ether6 \
    untagged=ether8,wifi1 vlan-ids=99
add bridge=BR1 comment=RED_VLAN tagged=BR1,ether3,ether4,ether5,ether6 \
    untagged=ether7 vlan-ids=30
/interface detect-internet
set internet-interface-list=WAN
/interface list member
add interface=BLUE_VLAN list=HOUSE
add interface=GREEN_VLAN list=HOUSE
add interface=BASE_VLAN list=BASE
add interface=BR1 list=LAN
add interface=pppoe-wan1 list=WAN
add interface=ether8 list=BASE
add interface=wireguard1 list=HOUSE
add interface=wireguard1 list=BASE
add interface=ether2 list=WAN
add interface=ether1 list=WAN
add interface=GREEN_VLAN list=LOCAL
add interface=BLUE_VLAN list=LOCAL
add interface=RED_VLAN list=LOCAL
add interface=BASE_VLAN list=LOCAL
add interface=wireguard1 list=LOCAL
/interface ovpn-server server
add mac-address=FE:5B:85:57:14:47 name=ovpn-server1
/ip address
add address=10.3.0.1/24 interface=BR1 network=10.3.0.0
add address=192.168.3.1/24 interface=BLUE_VLAN network=192.168.3.0
add address=192.168.203.1/24 interface=GREEN_VLAN network=192.168.203.0
add address=10.3.99.1/24 interface=BASE_VLAN network=10.3.99.0
add address=192.168.103.1/24 interface=wireguard1 network=192.168.103.0
add address=10.3.30.1/24 interface=RED_VLAN network=10.3.30.0
/ip cloud
set ddns-enabled=yes ddns-update-interval=1m
/ip dhcp-client
add comment=Eolo interface=ether1
# Interface not active
add comment=Aruba interface=ether2
/ip dhcp-server network
add address=10.3.30.0/24 comment=RED dns-server=9.9.9.9,8.8.8.8 gateway=\
    10.3.30.1
add address=10.3.99.0/24 comment=BASE dns-server=9.9.9.9,8.8.8.8 gateway=\
    10.3.99.1
add address=192.168.3.0/24 comment=BLUE dns-server=\
    88.149.128.12,88.149.128.22 gateway=192.168.3.1
add address=192.168.203.0/24 comment=GREEN dns-server=\
    88.149.128.12,88.149.128.22 gateway=192.168.203.1
/ip dns
set allow-remote-requests=yes servers=9.9.9.9
/ip firewall filter
add action=accept chain=input comment="allow WireGuard" dst-port=13331 \
    log-prefix=wireguard protocol=udp
add action=accept chain=input comment="allow WireGuard traffic" in-interface=\
    wireguard1
add action=accept chain=input comment=\
    "defconf: accept established,related,untracked" connection-state=\
    established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=\
    invalid
add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp
add action=accept chain=input dst-port=53 in-interface-list=HOUSE protocol=\
    tcp
add action=accept chain=input in-interface-list=BASE
add action=accept chain=input dst-port=53 in-interface-list=HOUSE protocol=\
    udp
add action=drop chain=input comment="drop everything else" log-prefix=dropped
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" \
    connection-state=established,related hw-offload=yes
add action=accept chain=forward comment="allow printing to Office from local" \
    dst-address=10.3.30.10 in-interface-list=LOCAL
add action=accept chain=forward comment=\
    "defconf: accept established,related, untracked" connection-state=\
    established,related,untracked
add action=accept chain=forward comment="allow internet traffic from local" \
    in-interface-list=LOCAL log-prefix=internetGuard out-interface-list=WAN
add action=accept chain=forward comment="allow port forwarding" \
    connection-nat-state=dstnat
add action=accept chain=forward comment="enable BASE control everywhere" \
    in-interface-list=BASE out-interface-list=LOCAL
add action=drop chain=forward comment="defconf: drop invalid" \
    connection-state=invalid
/ip firewall nat
add action=masquerade chain=srcnat comment="defconf: masquerade" \
    out-interface-list=WAN
/ip ipsec profile
set [ find default=yes ] dpd-interval=2m dpd-maximum-failures=5
/ip smb shares
set [ find default=yes ] directory=/pub
/ip traffic-flow
set cache-entries=64k
/ip upnp
set enabled=yes
/system clock
set time-zone-name=Europe/Rome
/system identity
set name=MyName
/system routerboard settings
set enter-setup-on=delete-key
/tool graphing interface
add
/tool mac-server mac-winbox
set allowed-interface-list=BASE

On ether1 I have the actual ISP1 (Eolo), that provide internet through a pppoe-client connection.
On ether2 I want to connect to an ADSL router providing an local IP (internet managed by the ISP router).

I tried the PCC Load Balancing howto available on the Mikrotik KB, but is stops connections for all clients, and had to rollback to my previous (shown) setup.

Any help? Is PPPOE + LAN double WAN possible at all?

Thanks for any direction...

CGGXANNX · October 1, 2025, 3:34pm

If you use PCC, you must exclude the PCC connections from the fasttrack-connection rule. If you followed the PCC examples from here:

Per connection classifier - RouterOS - MikroTik Documentation

Then you'll also need to modify the rule with the comment "defconf: fasttrack" and add an extra condition connection-mark=no-mark.

However doing so will exclude all "PCC load-balanced" connections from Fasttrack. And your L009 can't handle high throughput when Fasttrack cannot be used. If your total available WAN throughput is > 250Mbps, you might consider other "load-balancing" options that are compatible with Fasttrack, such as ECMP (plus routing rules).

anav · October 1, 2025, 5:40pm

Hi there, I see some simplification is possible in firewall rules and interface lists items, I also see confusion in your setup. You have a base VLAN ( missing ip dhcp-server setting??) but its not quite right, and some other vlan discrepancies. For example all your bridge ports are with PVID, so no trunk ports indicated and yet you state sfp is a trunk and its missing in action on /interface bridge port.

Further although one would think that switch G, switch T, AP-C, AP-S, Hub-Interno, are smart devices, you have a PVID setting to all of them. Can we assume they are all ubiquiti devices that expect the untagged vlan to the management vlan and the rest of the data vlans as tagged vlans???

In other words, unable to assess further until there is further clarity. What is connected to each port.....
and need to assess whether its a trunk port, an access port or a hybrid port.

For ether8, I would go with an off bridge port as if there is a hiccup with the vlan bridge side of the configuration that port will not help if attached to the bridge.

Other Comments follow:

The detect internet is a problematic setting in that it is known to cause issues, most of us disable it by selecting none.

/interface detect-internet
set internet-interface-list=none

Nice to see mac-Winbox set to BASE, and lthough not shown assuming this ( just mac-server) is also set to none.

/tool mac-server
set allowed-interface-list=none
/tool mac-server mac-winbox
set allowed-interface-list=BASE

Do you need upnp? Purpose?
As far as using both connections at the same time, good idea. The question is what are the two throughputs provided by your ISP and that is just the beginning. Asking a general question is not sufficient for MT configs. One has to know the requirements.

do some users need to go out a specific WAN
do you have servers on the LAN ( internal or external users ) and how do user point to servers?
do you have any external VPNs going to the router (wg so yes).

brusuillis · October 2, 2025, 10:24am

ISP1 is 100/20Mbps and ISP2 is 200/30Mbps (max).

brusuillis · October 2, 2025, 10:50am

You have a base VLAN ( missing ip dhcp-server setting??)

Maye I have misunderstood it, but BASE_VLAN has its own dhcp server and pool (ranges=10.3.99.10-10.3.99.30). It only has ether8 and MT Wireless in it. I use it connecting my laptop locally when need to interact with router.

vlan discrepancies

Building is an HOUSE with a small OFFICE attached. HOUSE has a BLUE (IoT, limited) and a GREEN VLANs(family devices, common use) that are part of HOUSE list along with wireguard (used by me to support and by some clients to VPN in for domotics and TVCC). OFFICE has only RED VLAN. BASE VLAN is for management (and several network devices). ALL those are in LOCAL list, versus WAN.

I agree it could be simple, but it grew in time, so I need time, relax and confidence to redesign it eventually.

you state sfp is a trunk and its missing in action on /interface bridge port

currently NOT used.

one would think that switch G, switch T, AP-C, AP-S, Hub-Interno, are smart devices, you have a PVID setting to all of them

Switch G is a Zyxel GS1920-24HP attached to ether3. ALL VLANs pass through this connection and get then divided on the switch for access devices: if I connect a PC to a GREEN port of the switch, I get a 192.168.203.0/24 address and so on..
Switch T, the same on ether4, but HP brand…
AP Corridoio and AP Sala are Netgears AP that provide BASE and GREEN on different SSIDs (they support multiple VLANs)
ether7 and ether8 are usually empty

For ether8, I would go with an off bridge port

Thanks for the suggestion. Having it in the bridge let me “cross” VLANs while there, but you are surely right, it is safer in your way (I could eventually replicate the ACTUAL mode of ether8 on ether7 and leave ether8 off the bridge)

/interface detect-internet set internet-interface-list=none

Again, point taken, thanks

mac-server) is also set to none

yes, cleaned the cfg manually and overisghtly dropped that line..

Do you need upnp? Purpose?

erhhh… honestly? Don’t know. Will disable it and check…

brusuillis · October 2, 2025, 10:55am

what are the two throughputs provided by your ISP

ISP1 is 100/20Mbps and ISP2 is 200/30Mbps (max).

do some users need to go out a specific WAN

not at all. both connections have public and fixed IPv4 address.

do you have servers on the LAN ( internal or external users ) and how do user point to servers

a couple of NAS and a network printer. Users point to them only from LOCAL. The TVCC NAS has a dynamic dns client, so if it keeps the route, there should be no problem

do you have any external VPNs going to the router (wg so yes)

Yes, the wireguard as above

PS: THANKS for you time and patience

anav · October 2, 2025, 3:42pm

No worries, will try ECMP first. Yes my bad, misread dhcp-server……….. argg
The tricky part is we will have to use Lurkers/CGGXs trickery to massage the wireguard traffic to ensure it goes into WAN1 and then back out WAN1 ( to quote a wise bird: we need to decouple the wireguard routing stack from the actual routing stack )

Note to ensure wireguard can work, you will need to one of two things.
Create a second wireguard interface ( best for site to site connections) or if just clients, then simply have two client profiles, one for WAN1 and one for WAN2 ( two diff endpoint addresses)

Feel free to ask questions, not many changes on the confgig.

```
/interface bridge
add name=BR1 port-cost-mode=short protocol-mode=none vlan-filtering=yes { add frame-types=admit-only-vlan-tagged at very end }
/interface ethernet
set [ find default-name=ether1 ] comment=”WAN1 - PPOE - EOLO”
set [ find default-name=ether2 ] comment=WAN2 - ADSL - ARUBA”
set [ find default-name=ether3 ] comment="Switch Guardaroba"
set [ find default-name=ether4 ] comment="Switch Taverna"
set [ find default-name=ether5 ] comment="AP Corridoio"
set [ find default-name=ether6 ] comment="AP Sala"
set [ find default-name=ether7 ] comment="HUB Ufficio Interno"
set [ find default-name=ether8 ] name=OffBridge8
set [ find default-name=sfp1 ] comment=”Not used”
/interface wireguard
add listen-port=13331 mtu=1420 name=wireguard1
/interface vlan
add comment=WAN1 interface=ether1 name=ISP1_VLAN vlan-id=100
add comment=IoT interface=BR1 name=BLUE_VLAN vlan-id=10
add comment=Home interface=BR1 name=GREEN_VLAN vlan-id=20
add comment=Office interface=BR1 name=RED_VLAN vlan-id=30
add comment="Network MGMT" interface=BR1 name=BASE_VLAN vlan-id=99
/interface pppoe-client
add add-default-route=no comment=Eolo disabled=no interface=ISP1_VLAN \
name=pppoe-wan1 user=myuser
/interface list
add name=WAN
add name=LAN
add name=BASE
/routing table
add fib name=useWG1
add fib name=useWG2
/interface wifi security
add authentication-types=wpa2-psk,wpa3-psk disabled=no name=default
/interface wifi
set [ find default-name=wifi1 ] configuration.hide-ssid=yes .mode=ap .ssid=
mySSID1 disabled=no security=default security.authentication-types=
wpa2-psk,wpa3-psk
/ip pool
add name=BLUE_POOL ranges=192.168.3.2-192.168.3.254
add name=GREEN_POOL ranges=192.168.203.2-192.168.203.254
add name=RED_POOL ranges=10.3.30.10-10.3.30.254
add name=BASE_POOL ranges=10.3.99.10-10.3.99.30
/ip dhcp-server
add address-pool=BLUE_POOL interface=BLUE_VLAN lease-time=1d name=BLUE_DHCP
add address-pool=GREEN_POOL interface=GREEN_VLAN lease-time=1d name=
GREEN_DHCP
add address-pool=RED_POOL interface=RED_VLAN lease-time=1d name=RED_DHCP
add address-pool=BASE_POOL interface=BASE_VLAN lease-time=5d name=BASE_DHCP
/ip smb users
set [ find default=yes ] disabled=yes
/ipv6 settings
disabled=yes
/port
set 0 name=serial0
/certificate settings
set builtin-trust-anchors=not-trusted
/interface bridge port
add bridge=BR1 comment="SW Guard” frame-types=admit-only-vlan-tagged interface=ether3
add bridge=BR1 comment="SW Tav” frame-types=admit-only-vlan-tagged interface=ether4
add bridge=BR1 comment="AP Corr” frame-types=admit-only-vlan-tagged interface=ether5
add bridge=BR1 comment="AP Sala" frame-types=admit-only-vlan-tagged interface=ether6
add bridge=BR1 comment=”"Hub Officina” frame-types=admit-priority-and-untagged \
interface=ether7 pvid=30
add bridge=BR1 comment="BASE WLAN" frame-types=admit-priority-and-untagged \
interface=wifi1 pvid=99
/ip firewall connection tracking
set udp-timeout=10s
/ip neighbor discovery-settings
set discover-interface-list=BASE
/interface bridge vlan
add bridge=BR1 tagged=BR1,ether3,ether4,ether5,ether6 vlan-ids=10,20
add bridge=BR1 tagged=BR1,ether3,ether4,ether5,ether6 untagged=ether7 vlan-ids=30
add bridge=BR1 tagged=BR1,ether3,ether4,ether5,ether6 untagged=wifi1 vlan-ids=99
/interface detect-internet
set internet-interface-list=none
/interface list member
add interface=pppoe-wan1 list=WAN
add interface=ether2 list=WAN
add interface=BLUE_VLAN list=LAN
add interface=GREEN_VLAN list=LAN
add interface=RED_VLAN list=LAN
add interface=BASE_VLAN list=LAN
add interface=wireguard1 list=LAN
add interface=OffBridge8 list=LAN
add interface=BASE_VLAN list=BASE
add interface=wireguard1 list=BASE
add interface=OffBridge8 list=BASE
/interface ovpn-server server
add mac-address=FE:5B:85:57:14:47 name=ovpn-server1 disabled=yes
/ip address
add address=192.168.3.1/24 interface=BLUE_VLAN network=192.168.3.0
add address=192.168.203.1/24 interface=GREEN_VLAN network=192.168.203.0
add address=10.3.30.1/24 interface=RED_VLAN network=10.3.30.0
add address=10.3.99.1/24 interface=BASE_VLAN network=10.3.99.0
add address=192.168.103.1/24 interface=wireguard1 network=192.168.103.0
add address=10.10.8.1/30 interface=OffBridge8 network=10.10.8.0
add address=10.20.30.40 interface=lo network=10.20.30.40 comment=”Using an existing \
and permanent interface to use as a faux post office for wireguard traffic”
add address=10.20.50.40 interface=lo network=10.20.50.40
/ip cloud
set ddns-enabled=yes ddns-update-interval=1m
/ip dhcp-client
add comment=Eolo interface=ether1 disabled=yes
add comment=Aruba interface=ether2 default-route=no
/ip dhcp-server network
add address=192.168.3.0/24 comment=BLUE dns-server=88.149.128.12,88.149.128.22 \
gateway=192.168.3.1
add address=192.168.203.0/24 comment=GREEN dns-server=
88.149.128.12,88.149.128.22 gateway=192.168.203.1add address=10.3.30.0/24 \
comment=RED dns-server=9.9.9.9,8.8.8.8 gateway=10.3.30.1
add address=10.3.99.0/24 comment=BASE dns-server=9.9.9.9,8.8.8.8 gateway=10.3.99.1
/ip dns
set allow-remote-requests=yes servers=9.9.9.9
/ip firewall filter
{ default rules to keep, order is important }
add action=accept chain=input connection-state=established,related,untracked
add action=drop chain=input connection-state=invalid
add action=accept chain=input protocol=icmp
add action=accept chain=input dst-address=127.0.0.1
{ admin rules }
add action=accept chain=input comment="allow WireGuard" dst-port=13331
log-prefix=wireguard protocol=udp
add action=accept chain=input comment="admin access” in-interface-list=BASE
add action=accept chain=input comment=”users to services” in-interface-list=LAN \
dst-port=53,123 protocol=udp
add action=accept chain=input comment=”users to services” in-interface-list=LAN \
dst-port=53 protocol=tcp
add action=drop chain=input comment="drop everything else" { do not log noise }
++++++++++++++++++++++++++++++++++++
{ default rules to keep }
add action=fasttrack-connection chain=forward connection-state=established,related \
connection-mark=no-mark
add action=accept chain=forward connection-state=established,related,untracked
add action=drop chain=forward connection-state=invalid
{ admin rules }
add action=accept chain=forward comment="internet traffic” in-interface-list=LAN \
out-interface-list=WAN
add action=accept chain=forward comment="All users to printer” in-interface-list=LAN \
out-interface=RED_VLAN dst-address=10.3.30.10
add action=accept chain=forward comment="port forwarding" connection-nat-state=dstnat
add action=accept chain=forward comment="admin access” in-interface-list=BASE \
out-interface-list=LAN
add action=drop chain=forward comment=”drop all else”
/ip firewall nat
add action=masquerade chain=srcnat comment="defconf: masquerade"
out-interface-list=WAN
add action=dst-nat chain=dstnat connection-mark=WG-traffic1 to-addresses=10.20.30.40
add action=src-nat chain=input connection-mark=WG-traffic1 to-addresses=10.20.30.40
add action=dst-nat chain=dstnat connection-mark=WG-traffic2 to-addresses=10.20.50.40 add action=src-nat chain=input connection-mark=WG-traffic2 to-addresses=10.20.50.40
/ip firewall mangle
{ to ensure wireguard traffic going to WANX goes back out WANX }
add chain=input action=mark-connection connection-mark=no-mark dst-port=13331 \
in-interface=pppoe-1 new-connection-mark=WG-traffic1 passthrough=yes
add chain=output action=mark-routing connection-mark=WG-traffic1 \
new-routing-mark=useWG1 passthrough=no
add chain=input action=mark-connection connection-mark=no-mark dst-port=13331 \
in-interface=ether2 new-connection-mark=WG-traffic2 passthrough=yes
add chain=output action=mark-routing connection-mark=WG-traffic2 \
new-routing-mark=useWG2 passthrough=no
/ip route
add check-gateway=ping dst-address=0.0.0.0/0 gateway=pppoe-wan1 routing-table=main
add check-gateway=ping dst-address=0.0.0.0/0 gateway=ether2 routing-table=main
add dst-address=0.0.0.0/0 gateway=pppoe-wan1 routing-table=useWG1
add dst-address=0.0.0.0/0 gateway=ether2 routing-table=useWG2
/ip ipsec profile
set [ find default=yes ] dpd-interval=2m dpd-maximum-failures=5
/ip smb shares
set [ find default=yes ] directory=/pub
/ip traffic-flow
set cache-entries=64k
/ip upnp
set enabled=no
/system clock
set time-zone-name=Europe/Rome
/system identity
set name=MyName
/system routerboard settings
set enter-setup-on=delete-key
/tool graphing interface
/system ntp client
set enabled=yes mode unicast
/system ntp server
set enabled=yes manycast=yes
/system ntp client servers
add address=localworldTimeserver1?
add address=localworldTimeserver2?
/system scheduler
/tool mac-server
set allowed-interface-list=none
/tool mac-server mac-winbox
set allowed-interface-list=BASE
```

I would be interested to know if you can setup two client profiles on a device and see if they both work after the config is modified.

brusuillis · October 5, 2025, 7:29pm

Hello, sorry for the late reply bu as I’m connecting to it remotely, I’m doing few changes at a time and wait for monitoring.
a couple of doubts:

I’m using the DDNS embedded in MT to “find” the Wireguard endpoint: having 2 different connections, shouldn’t create continuous changes in IP? (as further thought, maybe that’s why you suggested to create 2 client configs, pointing directly to IP addresses, right?)
I cannot see in your reply the part that should “distribute” the connections between WAN1 and WAN2, apart from the ones for wireguard (mangles). Or is it ALL in the “ip route” part, last 4 lines??

anav · October 5, 2025, 10:14pm

Correct ECMP is used automatically between the two WANS, when they have equal distance in the main routing table.

Well after some thought, you should be able to use the single router dyndns url, 28272mynetname.net and just confirm what it resolved to on the router.
Check
by using ip firewall address list
add address=28272mynetname.net list=MYWAN

and after you do it, you should see a second entry under that on the config with a resolved IP.
It shoujld be either wan1 or wan2.......
In any case confirm on your smartphone with a single profile, using endpoint addresss of 28272mynetname.net

It should work and if the wan being identified by ip cloud is not available it should switch to the available and WAN and work.

brusuillis · October 12, 2025, 7:08pm

Hi @anav , somehow I cut me out of the router and had to reset it. Now I’m recovering gradually the changes step by step, so please don’t take my silence as a disappearing, I’ll be back

anav · October 12, 2025, 9:07pm

Well seeing as you had an off bridge setup, a burp in the bridge would have not been the case, I can only think that you messed up the input chain rule that gave you access to the router. Not going anywhere LOL

One thing to do is use safe mode for all changes. Envoke safe mode, make changes, wait, if no cutoff, remove safe mode to actually make the changes permanent and then re invoke safe mode and work like this until the config is stable.