Load Balancing [HELP]

Hello guys good day. i have a small problem with my configuration i have i have 2 ISP witch has 500MBPS both and i have configured it in PCC Method
below is my configuration..my problem is that every time i run a speed test it only gives me 100MB..

/ip firewall mangle
add action=accept chain=prerouting comment=“ACCEPT IP ADDRESSES”
dst-address-list=myip
add action=mark-connection chain=input comment=“Marking ISP” in-interface=
“ether1-ISP1” new-connection-mark=ISP1 passthrough=yes
add action=mark-connection chain=input in-interface=“ether2-ISP2”
new-connection-mark=ISP2 passthrough=yes
add action=mark-connection chain=prerouting comment=“LOCAL PCC”
connection-mark=no-mark dst-address-type=!local in-interface-list=LAN
new-connection-mark=ISP2 passthrough=yes per-connection-classifier=
both-addresses:2/0
add action=mark-connection chain=prerouting connection-mark=no-mark
dst-address-type=!local in-interface-list=LAN new-connection-mark=ISP1
passthrough=yes per-connection-classifier=both-addresses:2/1
add action=mark-routing chain=prerouting comment=“marking conn”
connection-mark=ISP1 in-interface-list=LAN new-routing-mark=to-WAN1
passthrough=yes
add action=mark-routing chain=prerouting connection-mark=ISP2
in-interface-list=LAN new-routing-mark=to-WAN2 passthrough=yes
add action=mark-routing chain=prerouting connection-mark=ISP3 disabled=yes
in-interface-list=LAN new-routing-mark=to-WAN3 passthrough=yes
add action=mark-routing chain=output comment=output connection-mark=ISP1
new-routing-mark=to-WAN1 passthrough=yes
add action=mark-routing chain=output connection-mark=ISP2 new-routing-mark=
to-WAN2 passthrough=yes
add action=mark-routing chain=output connection-mark=ISP3 disabled=yes
new-routing-mark=to-WAN3 passthrough=yes


/ip route
add check-gateway=ping comment=ISP1_TAB disabled=no distance=1 dst-address=
0.0.0.0/0 gateway=192.168.254.254 pref-src=“” routing-table=to-WAN2
scope=30 suppress-hw-offload=no target-scope=10"
add check-gateway=ping comment=ISP2_TAB disabled=no distance=1 dst-address=
0.0.0.0/0 gateway=192.168.1.1 pref-src=“” routing-table=to-WAN1 scope=30
suppress-hw-offload=no target-scope=10
add comment=ISP1 disabled=no distance=2 dst-address=0.0.0.0/0 gateway=
192.168.1.1 pref-src=“” routing-table=main scope=30 suppress-hw-offload=
no target-scope=10
add comment=ISP2 disabled=no distance=1 dst-address=0.0.0.0/0 gateway=
192.168.254.254 pref-src=“” routing-table=main scope=30
suppress-hw-offload=no target-scope=10"

You should check when you have to many connections running. Speed test will create a connection from your computer to 1 server. PCC - Per Connection Classifier, so if you have 1 connection it will go only from 1 ISP.

I have a similar setup, but I seem to have lost the feature of combined download bandwidth, however the upload remains.
So I have a WAN1 via 3rd party DSL modem and a WAN2 via 3rd party 4G router.
I used to be able to go on speedtest.net and whilst testing I was looking a the traffic graph for both WAN interfaces and I could see them maxed out on both download and upload.
Now it seems this is no longer applicable for download ONLY after a reboot/update?
The only thing I done since last time I tested was to add a mangle rule to force a specific LAN client (172.16.11.41) constantly on the same WAN (DSL) and some tinkering with the oVPN address and profile.
Any views, please?

Here’s my config, relevant to this topic:

# may/30/2022 18:09:23 by RouterOS 6.49
# software id = SJ6W-GLAW
#
# model = 850Gx2
# serial number = 4BF104******
/interface bridge
add arp=proxy-arp name=BRIDGE
/interface ethernet
set [ find default-name=ether1 ] name="eth1 - LAN (PC)"
set [ find default-name=ether2 ] name="eth2 - LAN (LACP1)"
set [ find default-name=ether3 ] name="eth3 - LAN (LACP2)"
set [ find default-name=ether4 ] name="eth4 - WAN1 (DSL)"
set [ find default-name=ether5 ] name="eth5 - WAN2 (4G)"
/interface pppoe-client
add disabled=no interface="eth4 - WAN1 (DSL)" name="PPPoE - ZEN" password=************ user=************
/interface bonding
add lacp-rate=1sec mode=802.3ad name="LACP 2 C2960X" slaves="eth2 - LAN (LACP1),eth3 - LAN (LACP2)" transmit-hash-policy=layer-2-and-3
/ip pool
add name=oVPN-pool ranges=192.168.11.2-192.168.11.254
/ppp profile
add local-address=192.168.11.1 name="Brian ovpn" remote-address=oVPN-pool
/interface bridge port
add bridge=BRIDGE interface="eth1 - LAN (PC)"
add bridge=BRIDGE interface="LACP 2 C2960X"
/interface ovpn-server server
set auth=sha1 certificate=server cipher=aes256 enabled=yes netmask=23 require-client-certificate=yes
/ip address
add address=192.168.88.1/24 disabled=yes interface="eth1 - LAN (PC)" network=192.168.88.0
add address=172.16.11.1/23 interface=BRIDGE network=172.16.10.0
add address=10.1.1.2/28 interface="eth5 - WAN2 (4G)" network=10.1.1.0
/ip dns
set servers=8.8.8.8,8.8.4.4
/ip firewall address-list
add address=172.16.10.0/24 list="INet subnet block"
add address=172.16.11.41 list=IntelNUC
/ip firewall filter
add action=drop chain=forward comment="INet subnet block" src-address-list="INet subnet block"
/ip firewall mangle
add action=accept chain=prerouting dst-address=*public-IP* in-interface=BRIDGE
add action=accept chain=prerouting dst-address=10.1.1.0/28 in-interface=BRIDGE
add action=mark-connection chain=prerouting in-interface=BRIDGE new-connection-mark=WAN01 passthrough=yes src-address=172.16.11.41
add action=mark-connection chain=prerouting connection-mark=no-mark in-interface="PPPoE - ZEN" new-connection-mark=WAN01 passthrough=yes
add action=mark-connection chain=prerouting connection-mark=no-mark in-interface="eth5 - WAN2 (4G)" new-connection-mark=WAN02 passthrough=yes
add action=mark-connection chain=prerouting connection-mark=no-mark dst-address-type=!local in-interface=BRIDGE new-connection-mark=WAN01 passthrough=yes per-connection-classifier=both-addresses-and-ports:2/0
add action=mark-connection chain=prerouting connection-mark=no-mark dst-address-type=!local in-interface=BRIDGE new-connection-mark=WAN02 passthrough=yes per-connection-classifier=both-addresses-and-ports:2/1
add action=mark-routing chain=prerouting connection-mark=WAN01 in-interface=BRIDGE new-routing-mark=to_WAN01 passthrough=yes
add action=mark-routing chain=prerouting connection-mark=WAN02 in-interface=BRIDGE new-routing-mark=to_WAN02 passthrough=yes
add action=mark-routing chain=output connection-mark=WAN01 new-routing-mark=to_WAN01 passthrough=yes
add action=mark-routing chain=output connection-mark=WAN02 new-routing-mark=to_WAN02 passthrough=yes
/ip firewall nat
add action=masquerade chain=srcnat out-interface="PPPoE - ZEN"
add action=masquerade chain=srcnat out-interface="eth5 - WAN2 (4G)"
add action=masquerade chain=srcnat comment="oVPN NAT" log=yes src-address=192.168.11.0/24
/ip firewall service-port
set ftp disabled=yes
set irc disabled=yes
/ip route
add check-gateway=ping distance=1 gateway="PPPoE - ZEN" routing-mark=to_WAN01 scope=255
add check-gateway=ping distance=1 gateway=10.1.1.1 routing-mark=to_WAN02 scope=255
add check-gateway=ping comment="Primary gateway" distance=1 gateway="PPPoE - ZEN" scope=255
add check-gateway=ping comment="Seconary gateway" distance=2 gateway=10.1.1.1 scope=255
/ppp secret
add name=*user* password=************ profile="Brian ovpn" service=ovpn
/system clock
set time-zone-name=Europe/London
/system ntp client
set enabled=yes primary-ntp=162.159.200.123 server-dns-names=uk.pool.ntp.org,pool.ntp.org

Beter make this both-addresses:2/0 and both-addresses:2/1 also include the dst-port and src-port. Then both ISP being used is more likely and also check if you have enabled fasttracking also.

Ingdaka is also refering to plitting the connections.

thanks @msatter for the prompt response.
I have applied your change and it actually didn’t have the desired result, in fact the Upload was no longer benefiting from the merged bandwidth either.
However I reverted the change back to both-addresses-and-ports:2/0 and both-addresses-and-ports:2/1 and now the download is working as expected, where it is merging bandwidth from both WANs.

Regarding Fasttracking, I’m not sure about it, not used it before, can it be implemented at this stage?

plitting”, sounds like some deviant sex terminology msatter ;-PP

Hi sir I just have a handful of connections running I just used /28 for my route to OSPF in 2 ports for DHCP port ROUTE and DHCP and group in Interface LIST which is the LAN on the configuration

Hi, sir thnx for the response… have you tried on testing to change the Per Connection Classifier

Hi, Sir thnx for the response. Well, I have checked the configuration but I haven’t tried the Fastrack for Both ISP. does it need to be fast track

@clinttt, let’s start from the basics - without any load balancing configuration, and with the action=fasttrack-connection rule disabled in /ip firewall filter, does your router manage the 500 Mbit/s over the primary WAN? You haven’t shown what router model you have, and 500 Mbit/s throughput is far beyond the capabilities of many SOHO models, let alone the full 1 Gbit/s.

@msatter, did you indeed mean to enable fasttracking? Since any kind of load distribution except the ECMP one depends on mangle, you can not permit fasttracking for all the traffic, at best it can be permitted for traffic going through one of the WANs.

hi sir @sindy thanx for the response. Well with regards to direct speed of the ISP we’ve tried several Test like Direct speed test from Modem to PC and speed test from MT to PC. and yes we have reach the said speed test with 500mbps per modem. by the way we are using RB5009 as our CORE Router. So far we are not encountering problems yet since we just have a handful of clients as of this moment. we are just preparing just for the worst. and also I don’t have fasttrack in my Filter Rules

For a 5009, two 500 Mbit/s uplinks should not be an issue even with mangling. As you don’t use fasttracking, and as hardware-offloaded routing cannot interfere with mangle because it is not supported on RB5009, the speed limitation cannot be caused by some packets to bypass mangling and end up on the wrong WAN.

Are the mangle rules you’ve shown the only ones you use? I can see nothing wrong about them alone, nor about the routes, everything is as it should be for a 1:1 load distribution.

While running the speedtests, could you watch the actual bandwidth occupation on the WANs (/interface/monitor-traffic etherX,etherY)?

This is the images that I set

Filter Rules = I put this because to not let my client access my isp MODEM or allow then to tracerrout
Filter Rule.PNG
NAT Rule


Mangle Rules

Interface

ISP Port Traffic
NAT Rule.PNG

Well, the order of the mangle rules could be optimized a little bit, but that still doesn’t explain the throughput limitation. Anything configured in queues?

Thats why I am very confused right now and I don’t have a queues. Well, there is one that I haven’t tried. do I need to bridge mode the modem?

This is really confusing now…
…so I noticed something interesting… if I test speed via Ookla (speedtest.net) I seem to be utilising both WANs on upload and download, but I also noticed whilst one of the LAN clients was downloading a big update file this was coming down only on WAN1, so no combined bandwidth. See the attached graphs for the client updating and the speedtest…
update.png
speedtest.png

Maybe your trying to combine the speed…because load balancing it just trying to split the traffic. my case is different to yours because I have set the firewall but I cant get the speed test correctly.
can you post your script so that we can exchange idea?

If the modem itself can deal with the 500 Mbit/s, there is no point in moving the PPPoE client processing from the modem to the 5009, unless the modem has a public IP address on it and you want to use that address directly on the 5009. Otherwise, running the PPPoE client(s) on the 5009 would just add more load to the CPU and bring no benefits.

Sorry, from your description of the tests “without load distribution” it wasnt’ completely clear to me what exactly you did. So let’s put it another way, what is the result of the speedtest if you test the same way like you do with load distribution, but with all the mangle rules in chain prerouting disabled? This will tell us whether the mangle rules or something else is the reason of the low speed, as the hardware topology will be the same for both scenarios (with and without load distribution).

I didn’t know which router was used having low speeds, is often due to not enabling fasttracking on slower routers. Enabling it on a pure routing config, indeed it- breaks the traffic flow. That why I first always connection-mark and then based on that mark, set the routing-mark. This to be able to also re-mark the correct routing-mark for later traffic coming back from the clients.

General warning, not all dst-addresses support multiple connections. This forum, for example does not support that. You can test that when you write a posting and press preview and nothing happen or with a delay.

That is the correct working. You have one target and the client uses one connection.

When the client and the server support concurrent connections, then the downloaded file is split in parts and downloaded parallel. Look for IDM which does that for you,

https://www.internetdownloadmanager.com