load balancing + hotspot + webproxy

RouterOS General
1

hello,
i have gone thru couple of posts here in forum but unable to get things working.
well i am already running hotspot (with webproxy) on x86 with v4.11 with 4mb dsl
now i have another 4mb dsl and want to setup load balancing. but the problem is that it is also from the same ISP (i.e. gateway is same). So, followed this wiki manual http://wiki.mikrotik.com/wiki/Manual:Load_balancing_multiple_same_subnet_links
but load balancing didn’t work, only WAN1 get the loads but WAN2 didn’t work at all.
also tried http://wiki.mikrotik.com/wiki/PCC#Application_Example_-_Load_Balancing
but same result, 2nd connection didn’t get the load. :confused:

any help would be grateful.

2

any one could help or guide please !!!

3

Running proxies and PCC on the same router as a Hotspot is very complicated and involved. You would be better off buying a second router to run PCC on. Then put the Hotspot router behind it, and don’t NAT on the Hotspot router.

4

thanks, i got your advice. would you please suggest routerboard to run PCC. as i am already running routeros on x86.waiting for reply.

5

For 8 megs, anything do. However, I’d get a 450G for the extended RAM and the console port.

6

thanks alot fewi. i will get back to this post after having new board installed and configured.

7

hello,
I have bought another RB493AH, and configured PCC on it. now how to combine it with (Hotspot + Webproxy box running on x86). please help.

8

It’s a stock PCC config. It’s irrelevant that there is another router behind it - the wiki manual applies in it’s entirety. The only caveat is that the source address is always going to be the other router when you’re proxying as the RouterOS cannot proxy transparently, which rules out the src-address classifier.

9

could you be more specific, as i didn’t get you. i tried alot but didn’t get it work.
here’s the sample setup:
Router1: running PCC, config from wiki.
Router2: running Hotspot and webproxy also DHCP and DNS running on this.

any suggestions / help please…

10

Configure one router with PCC as per the wiki manual: http://wiki.mikrotik.com/wiki/Manual:PCC

This router connects to your ISPs and balances load based on connections between the two. The wiki article is very thorough, if you need specific help with it you’ll have to post the details of your connection and what you’ve tried.

That PCC router will also have a port for the other router to connect to. You can use a /30 for that network. Let’s call that the internal port.

Then configure the other router with an uplink to the PCC router, assign the other IP from the /30, and add a static route through the other side. Now that router uses the PCC router for uplink, and the PCC router can balance its connection through the two ISPs. You then configure the proxy process on that second router and connect the end users to it.

That’s it.

11

Thanks alot fewi for you help. May be i am stuck with NAT rules.
Here are the config from PCC router1:


[admin@MikroTik] /ip address> pr

ADDRESS NETWORK BROADCAST INTERFACE

0 ;;; default configuration
192.168.101.9/29 192.168.101.8 192.168.101.15 Local
1 192.168.100.2/24 192.168.100.0 192.168.100.255 WAN1
2 192.168.102.2/24 192.168.102.0 192.168.102.255 WAN2
[admin@MikroTik] /ip route> pr

DST-ADDRESS PREF-SRC GATEWAY DISTANCE

0 A S 0.0.0.0/0 192.168.100.1 1
1 A S 0.0.0.0/0 192.168.102.1 1
2 A S 0.0.0.0/0 192.168.100.1 1
3 S 0.0.0.0/0 192.168.102.1 2
4 ADC 192.168.100.0/24 192.168.100.2 WAN1 0
5 ADC 192.168.102.0/24 192.168.102.2 WAN2 0
6 ADC 192.168.101.8/29 192.168.101.9 Local 0

[admin@MikroTik] /ip firewall> nat pr
Flags: X - disabled, I - invalid, D - dynamic
0 chain=srcnat action=masquerade out-interface=WAN1
1 chain=srcnat action=masquerade out-interface=WAN2

[admin@MikroTik] /ip firewall> mangle pr
Flags: X - disabled, I - invalid, D - dynamic
0 chain=prerouting action=accept dst-address=192.168.100.0/24
in-interface=Local

1 chain=prerouting action=accept dst-address=192.168.102.0/24
in-interface=Local

2 chain=prerouting action=mark-connection new-connection-mark=WAN1_conn
passthrough=yes in-interface=WAN1 connection-mark=no-mark

3 chain=prerouting action=mark-connection new-connection-mark=WAN2_conn
passthrough=yes in-interface=WAN2 connection-mark=no-mark

4 chain=prerouting action=mark-connection new-connection-mark=WAN1_conn
passthrough=yes dst-address-type=!local in-interface=Local
connection-mark=no-mark per-connection-classifier=both-addresses:2/0

5 chain=prerouting action=mark-connection new-connection-mark=WAN2_conn
passthrough=yes dst-address-type=!local in-interface=Local
connection-mark=no-mark per-connection-classifier=both-addresses:2/1

6 chain=prerouting action=mark-routing new-routing-mark=to_WAN1
passthrough=yes in-interface=Local connection-mark=WAN1_conn

7 chain=prerouting action=mark-routing new-routing-mark=to_WAN2
passthrough=yes in-interface=Local connection-mark=WAN2_conn

8 chain=output action=mark-routing new-routing-mark=to_WAN1 passthrough=yes
connection-mark=WAN1_conn

9 chain=output action=mark-routing new-routing-mark=to_WAN2 passthrough=yes
connection-mark=WAN2_conn


and this is config from Hotspot router2:

[admin@mikrotik] /ip address> pr

ADDRESS NETWORK BROADCAST INTERFACE

0 ;;; LOCAL
192.168.1.5/24 192.168.1.0 192.168.1.255 Local
1 ;;; Internal
192.168.101.10/29 192.168.101.8 192.168.101.15 Internal

[admin@mikrotik] > ip route pr

DST-ADDRESS PREF-SRC GATEWAY DISTANCE

0 A S 0.0.0.0/0 192.168.101.9 1
1 ADC 192.168.1.0/24 192.168.1.5 Local 0
2 ADC 192.168.101.8/29 192.168.101.10 Internal 0

[admin@mikrotik] /ip firewall> nat pr
5 ;;; masquerade hotspot network
chain=srcnat action=masquerade src-address=192.168.1.0/24
out-interface=Local
6 chain=dstnat action=redirect to-ports=8080 protocol=tcp
src-address=192.168.1.0/24 in-interface=Local dst-port=80

[admin@mikrotik] > ip fire mang pr
Flags: X - disabled, I - invalid, D - dynamic
0 ;;; Hit Traffic from Proxy
chain=output action=mark-packet new-packet-mark=Proxy-Hit passthrough=no
out-interface=Local dscp=4

1 ;;; Up Traffic
chain=prerouting action=mark-packet new-packet-mark=test-up
passthrough=no src-address=192.168.1.0/24 in-interface=Local

2 ;;; Conn Mark
chain=forward action=mark-connection new-connection-mark=test-conn
passthrough=yes src-address=192.168.1.0/24

3 ;;; Down Direct Connection
chain=forward action=mark-packet new-packet-mark=test-down
passthrough=no in-interface=Local connection-mark=test-conn

4 ;;; Down Via Proxy
chain=output action=mark-packet new-packet-mark=test-down passthrough=no
dst-address=192.168.1.0/24 out-interface=Local


also DHCP and DNS configured on this 2nd router.

12

well its working with above config, but slow browsing is observed and some times there is no browsing. Moreover i can’t access router2(Hotspot) from router1 (PCC).
is there any thing required to be changed in above config ? any ideas…

13

I’m getting slow browsing with the above config.
any suggestion or help please to improve the config for faster browsing…
fewi can you help me please…

14

Ditch the mangle rules on the proxy router. They don’t do you any good.

[admin@MikroTik] /ip address> pr

ADDRESS NETWORK BROADCAST INTERFACE

0 ;;; default configuration
192.168.101.9/29 192.168.101.8 192.168.101.15 Local
1 192.168.100.2/24 192.168.100.0 192.168.100.255 WAN1
2 192.168.102.2/24 192.168.102.0 192.168.102.255 WAN2
[admin@MikroTik] /ip route> pr

DST-ADDRESS PREF-SRC GATEWAY DISTANCE

0 A S 0.0.0.0/0 192.168.100.1 1
1 A S 0.0.0.0/0 192.168.102.1 1
2 A S 0.0.0.0/0 192.168.100.1 1
3 S 0.0.0.0/0 192.168.102.1 2
4 ADC 192.168.15.0/24 192.168.100.2 WAN1 0
5 ADC 192.168.16.0/24 192.168.102.2 WAN2 0
6 ADC 192.168.101.8/29 192.168.101.9 Local 0

That’s from the PCC router. That makes no sense. Your distances appear to be wrong, but more alarmingly your IP addresses and directly connected routes are either from different points in time, or completely and utterly wrong (which would be shocking given that I’m talking about the dynamic routes that are created by merit of IP addresses existing on the router).

Please post the output of “/ip route print detail”, “/ip route export”, “/ip address print detail”, and “/ip address export” from the PCC router. Please wrap the output in

 tags so it stays readable.
15

i have dumped the mangle rules on proxy router.

and here is the output of ip route and ip address:

[admin@MikroTik] > ip route pr detail
Flags: X - disabled, A - active, D - dynamic, C - connect, S - static, r - rip, b - bgp, o - ospf, m - mme, 
B - blackhole, U - unreachable, P - prohibit 
 0 A S  dst-address=0.0.0.0/0 gateway=192.168.100.1 gateway-status=192.168.100.1 reachable WAN1 check-gateway=ping distance=1 
        scope=30 target-scope=10 routing-mark=to_WAN1 

 1 A S  dst-address=0.0.0.0/0 gateway=192.168.102.1 gateway-status=192.168.102.1 reachable WAN2 check-gateway=ping distance=1 
        scope=30 target-scope=10 routing-mark=to_WAN2 

 2 A S  dst-address=0.0.0.0/0 gateway=192.168.100.1 gateway-status=192.168.100.1 reachable WAN1 check-gateway=ping distance=1 
        scope=30 target-scope=10 

 3   S  dst-address=0.0.0.0/0 gateway=192.168.102.1 gateway-status=192.168.102.1 reachable WAN2 check-gateway=ping distance=2 
        scope=30 target-scope=10 

 4 ADC  dst-address=192.168.100.0/24 pref-src=192.168.100.2 gateway=WAN1 gateway-status=WAN1 reachable distance=0 scope=10 

 5 ADC  dst-address=192.168.102.0/24 pref-src=192.168.102.2 gateway=WAN2 gateway-status=WAN2 reachable distance=0 scope=10 

 6 ADC  dst-address=192.168.101.8/29 pref-src=192.168.101.9 gateway=Local gateway-status=Local reachable distance=0 
        scope=10 

[admin@MikroTik] > ip route export
/ip route
add check-gateway=ping disabled=no distance=1 dst-address=0.0.0.0/0 gateway=192.168.100.1 routing-mark=to_WAN1 scope=30 \
    target-scope=10
add check-gateway=ping disabled=no distance=1 dst-address=0.0.0.0/0 gateway=192.168.102.1 routing-mark=to_WAN2 scope=30 \
    target-scope=10
add check-gateway=ping disabled=no distance=1 dst-address=0.0.0.0/0 gateway=192.168.100.1 scope=30 target-scope=10
add check-gateway=ping disabled=no distance=2 dst-address=0.0.0.0/0 gateway=192.168.102.1 scope=30 target-scope=10

[admin@MikroTik] > ip address pr detail
Flags: X - disabled, I - invalid, D - dynamic 
 0   ;;; default configuration
     address=192.168.101.9/29 network=192.168.101.8 broadcast=192.168.101.15 interface=Local actual-interface=Local 

 1   address=192.168.100.2/24 network=192.168.100.0 broadcast=192.168.100.255 interface=WAN1 actual-interface=WAN1 

 2   address=192.168.102.2/24 network=192.168.102.0 broadcast=192.168.102.255 interface=WAN2 actual-interface=WAN2 

[admin@MikroTik] > ip address export
/ip address
add address=192.168.101.9/29 broadcast=192.168.101.15 comment="default configuration" disabled=no interface=Local \
    network=192.168.101.8
add address=192.168.100.2/24 broadcast=192.168.100.255 comment="" disabled=no interface=WAN1 network=192.168.100.0
add address=192.168.102.2/24 broadcast=192.168.102.255 comment="" disabled=no interface=WAN2 network=192.168.102.0
16

Looks OK now.

17

thanks a lot fewi for your help and support. one more problem related to browsing, initially it works with charm but after few minutes, there is no browsing at all. any ideas whats wrong in the config.

18

I do not. Like I said, the configuration looks good to me.

19

well, thanks a lot for all your help fewi. now its working great. karma to you Sir.
lil bit problem with IMs (MSN, Skype etc), trying to implement policy based routing. hopefully it will resolve issues.
now planning to add 3rd WAN. :slight_smile:

20

Hello all,
Can someone help me with this issue.

I have hotspot on my Mikrotik, but it seems the network is getting slower irrespective of the people browsing the internet, it is just a cafe. The owner said he want me to enable web proxy in the mirotik as well. I want to ask if it is possible to have web proxy and hotspot in mikrotik at the same box and time.

How will the traffic then be cached as you have to login at hotspot page before you brows, and while browsing, the web proxy to cache the content.

I need explanations plz.