Loadbalance PCC in Ros7 HOTSPOT

RouterOS General
1

Hello,
I implemented PCC load balancing on Mikrotik rOS version 7.

However, I'm having problems with the Mikrotik hotspot login page not appearing.

And when I try to separate the source IP address to a specific ISP using routing police, it doesn't work.

Can you please explain what the problem is?

I previously implemented it on Mikrotik rOS V6, and it worked fine.

Here's my configuration on Mikrotik V7.

###############################################################
# Load Balance Per Connection Clasifier (LB PCC) Script Generator
# Date/Time: 05/09/2026, 00:05:02 AM
# Created by: hosmon.net.com
# Load Balance Method -> PCC (PER CONNECTION CLASIFIER)
###############################################################
/ip firewall address-list
add address=10.0.0.0/8 list=ip-local comment="LB PCC by hosmon.net"
add address=172.16.0.0/12 list=ip-local comment="LB PCC by hosmon.net"
add address=192.168.0.0/16 list=ip-local comment="LB PCC by hosmon.net"
/ip firewall nat
add chain=srcnat out-interface="ether1" action=masquerade comment="LB PCC by hosmon.net"
add chain=srcnat out-interface="ether2" action=masquerade comment="LB PCC by hosmon.net"
add chain=srcnat out-interface="ether3" action=masquerade comment="LB PCC by hosmon.net"
/routing table
add name="to-ISP1" fib comment="LB PCC by hosmon.net"
add name="to-ISP2" fib comment="LB PCC by hosmon.net"
add name="to-ISP3" fib comment="LB PCC by hosmon.net"
/ip route
add check-gateway=ping distance=1 gateway="192.168.1.1" routing-table="to-ISP1" comment="LB PCC by hosmon.net"
add check-gateway=ping distance=1 gateway="192.168.2.1" routing-table="to-ISP2" comment="LB PCC by hosmon.net"
add check-gateway=ping distance=1 gateway="192.168.3.1" routing-table="to-ISP3" comment="LB PCC by hosmon.net"
add check-gateway=ping distance=1 gateway="192.168.1.1" comment="LB PCC by hosmon.net"
add check-gateway=ping distance=2 gateway="192.168.2.1" comment="LB PCC by hosmon.net"
/ip firewall mangle
add action=accept chain=prerouting dst-address-list=ip-local src-address-list=ip-local comment="LB PCC by hosmon.net"
add action=accept chain=postrouting dst-address-list=ip-local src-address-list=ip-local comment="LB PCC by hosmon.net"
add action=accept chain=forward dst-address-list=ip-local src-address-list=ip-local comment="LB PCC by hosmon.net"
add action=accept chain=input dst-address-list=ip-local src-address-list=ip-local comment="LB PCC by hosmon.net"
add action=accept chain=output dst-address-list=ip-local src-address-list=ip-local comment="LB PCC by hosmon.net"
add action=mark-connection chain=input in-interface="ether1" new-connection-mark="cm-ISP1" passthrough=yes comment="LB PCC by hosmon.net"
add action=mark-connection chain=input in-interface="ether2" new-connection-mark="cm-ISP2" passthrough=yes comment="LB PCC by hosmon.net"
add action=mark-connection chain=input in-interface="ether3" new-connection-mark="cm-ISP3" passthrough=yes comment="LB PCC by hosmon.net"
add action=mark-routing chain=output connection-mark="cm-ISP1" new-routing-mark="to-ISP1" passthrough=yes comment="LB PCC by hosmon.net"
add action=mark-routing chain=output connection-mark="cm-ISP2" new-routing-mark="to-ISP2" passthrough=yes comment="LB PCC by hosmon.net"
add action=mark-routing chain=output connection-mark="cm-ISP3" new-routing-mark="to-ISP3" passthrough=yes comment="LB PCC by hosmon.net"
add action=mark-connection chain=prerouting dst-address-type=!local new-connection-mark="cm-ISP1" passthrough=yes per-connection-classifier=both-addresses-and-ports:3/0 dst-address-list=!ip-local src-address-list=ip-local comment="LB PCC by hosmon.net"
add action=mark-connection chain=prerouting dst-address-type=!local new-connection-mark="cm-ISP2" passthrough=yes per-connection-classifier=both-addresses-and-ports:3/1 dst-address-list=!ip-local src-address-list=ip-local comment="LB PCC by hosmon.net"
add action=mark-connection chain=prerouting dst-address-type=!local new-connection-mark="cm-ISP3" passthrough=yes per-connection-classifier=both-addresses-and-ports:3/2 dst-address-list=!ip-local src-address-list=ip-local comment="LB PCC by hosmon.net"
add action=mark-routing chain=prerouting connection-mark="cm-ISP1" new-routing-mark="to-ISP1" passthrough=yes dst-address-list=!ip-local src-address-list=ip-local comment="LB PCC by hosmon.net"
add action=mark-routing chain=prerouting connection-mark="cm-ISP2" new-routing-mark="to-ISP2" passthrough=yes dst-address-list=!ip-local src-address-list=ip-local comment="LB PCC by hosmon.net"
add action=mark-routing chain=prerouting connection-mark="cm-ISP3" new-routing-mark="to-ISP3" passthrough=yes dst-address-list=!ip-local src-address-list=ip-local comment="LB PCC by hosmon.net"
2

No it isn't.
That is the small part of the configuration that you believe is relevant.

"LB PCC by hosmon.net"

???

3

BOY I WISH THAT THIS WAS A THING

4

Yep, routing police may be more effective than routing policy, but in some cases It may happen that It becomes affected by corruption ...

5

Did you call Znevna ?? I even have a whistle

6

What is the correct way on rOs V7 to loadbalance PCC with network distribution for hotspots?

Policy Based Routing

yeah, I get this script configures from this site :slight_smile:

7

"I?"
Sorry, "you" just copied and pasted a script from another site,
so ask that site for help.

Easy, right?

Who better to help you than the person who wrote the script?
Or do you think there are scriptcheckers here on the forum, scripts from other forums or sites or made with Artificial Deficiency?

If you want help from the people on the forum, first start with the default and sketch out how things are and how you want them to be.

Example of Artificial Deficiency at work:

[...]
/ip firewall address-list
[...]
add address=192.168.0.0/16 list=ip-local comment="LB PCC by hosmon.net"
[...]
/ip route
add check-gateway=ping distance=1 gateway="192.168.1.1" routing-table="to-ISP1" comment="LB PCC by hosmon.net"
[...]

The IP is in both WAN and LAN.

8

Anyway, no matter who/what has devised the snippet that was posted, it remains a snippet.

You say that hotspot doesn't show the login page, but in what you posted there is NOTHING connected to hotspot, then you talk of policy routing, but what you posted is using only mangle.

IF you post the COMPLETE configuration you are having trouble with AND a description of your setup/network topology and what is actually your goal, THEN MAYBE someone will be able to help you or at least give you some hints.

9

I agree with what you said,

but here I'm just presenting my problem.

On my Mikrotik router, I set up PCC load balancing using the script.

However, the hotspot connection doesn't automatically display the login page.

I have to manually type the gateway IP address in a browser like Chrome.

I'm actually just asking if the configuration, as per this script, is correct or if it's not recommended for hotspot networks since ROS V7.

10

I think my MikroTik configuration is all summarized in the script above.

My only problem is with the router itself, which is breaking all connections.

11

I'm sure there's someone that can help you with your issue nearby https://mikrotik.com/consultants

12

This is a good thing :slightly_smiling_face: , everyone is free to think whatever they want.

I think - instead - that what you posted is a minimal part of the needed configuration, and that FULL, COMPLETE configuration according to:
Forum rules - #5 by gigabyte091
is the MINIMUM needed, and ANYTHING DIFFERENT from that will either give you no answers or botched attempts, see also:
https://jdebp.uk/FGA/problem-report-standard-litany.html
AND:
https://jdebp.uk/FGA/put-down-the-chocolate-covered-banana.html

13

If you know everything, aka dismissing what some very knowledgeable experts are saying, then why are you here asking for help???

Drop the arrogance ( or whatever else is blocking your cooperation ) and please provide the full config.

/export file=anynameyouwish ( minus router serial number, any public WANIP information, keys, dhcp lease lists ).

14

Hi,
Sorry if I didn't convey my message correctly,
but I actually created this thread to ask for expert opinions on whether any of you have implemented PCC load balancing for hotspot network distribution on rOSv7.

I have configured PCC load balancing, and it previously worked without any issues on rOS version 6. However, when I replaced or upgraded my router, which came from the factory with only rOS v7 (RB4011),

I thought creating this thread would suffice to show the mangle and route configurations.

I apologize in advance for using Google Translate in my English.

15

So you have no other needs then that may need to be taken into consideration???>>

It would appear all three WANIPs are private static Ips then.
There are no other traffic flows that may have to be taken into account??
( such as a server and port forwarding, VPN to the router etc etc.. )
Is there any other LAN traffic or only hotspot traffic Assuming you have a LAN for regular use.
You have identified a wide range of addresses in address list but didnt identify to us or in the config what is the address or subnet of your hotspot, its missing in the mangle rules altogether ???

What is your plan for rest of traffic, use wan1 as primary, wan2 as secondary wan3 as tertiary??
OR ecmp load balancing ???

You dont put gateways in quotes???
Putting anything in quotes other then comments is just bad and confusing.
All you comments are identical and thus useless.

Will assume gateways for isp1/2/3 is 192.168.1.1/2.1/3.1
Will assume ECMP load balancing for rest of traffic.

/ip firewall address-list
add address=10.0.0.0/8 list=ip-local
add address=172.16.0.0/12 list=ip-local
add address=192.168.0.0/16 list=ip-local
/ip firewall nat
add chain=srcnat out-interface=ether1 action=masquerade
add chain=srcnat out-interface=ether2 action=masquerade
add chain=srcnat out-interface=ether3 action=masquerade
/routing table
add fib name=to-ISP1
add fib name=to-ISP2
add fib name=to-ISP3
/ip route
{ECMP load balance main routes for rest of traffic}
add check-gateway=ping dst-address=0.0.0.0 gateway=1.1.1.1 scope=30 target-scope=12
add check-gateway=ping dst-address=0.0.0.0 gateway=8.8.4.4 scope=30 target-scope=12
add check-gateway=ping dst-address=0.0.0.0 gateway=9.9.9.9 scope=30 target-scope=12
add dst-address=1.1.1.2/32 gateway=192.168.1.1 scope=12 target-scope=11
add dst-address=8.8.4.4/32 gateway=192.168.2.1 scope=12 target-scope=11
add dst-address=9.9.9.9/32 gateway=192.168.3.1 scope=2 target-scope=11
{special routes for PCC}
add check-gateway=ping distance=1 gateway=192.168.1.1 routing-table=to-ISP1
add check-gateway=ping distance=2 gateway=192.168.2.1 routing-table=to-ISP1
add distance=3 gateway=192.168.3.1 routing-table=to-ISP1
++++++++++++++++++
add check-gateway=ping distance=1 gateway=192.168.2.1 routing-table=to-ISP2
add check-gateway=ping distance=2 gateway=192.168.1.1 routing-table=to-ISP2
add distance=3 gateway=192.168.3.1 routing-table=to-ISP2
++++++++++++++++++
add check-gateway=ping distance=1 gateway=192.168.3.1 routing-table=to-ISP3
add check-gateway=ping distance=2 gateway=192.168.1.1 routing-table=to-ISP3
add distance=3 gateway=192.168.2.1 routing-table=to-ISP3
/ip firewall mangle
{ENSURE local connected traffic not trapped by later mangles}
add action=accept chain=prerouting dst-address-list=ip-local src-address-list=ip-local
{Mangles for PCC}
add action=mark-connection chain=forward dst-address-type=!local passthrough=yes \
connection-mark=no-mark new-connection-mark=cm-ISP1 source-address=hotspotSUBNET \
per-connection-classifier=both-addresses-and-ports:3/0
add action=mark-connection chain=forward dst-address-type=!local passthrough=yes \
connection-mark=no-mark new-connection-mark=cm-ISP2 source-address=hotspotSUBNET \
per-connection-classifier=both-addresses-and-ports:3/1
add action=mark-connection chain=forward dst-address-type=!local passthrough=yes \
connection-mark=no-mark new-connection-mark=cm-ISP3 source-address=hotspotSUBNET \
per-connection-classifier=both-addresses-and-ports:3/2
add action=mark-routing chain=prerouting connection-mark=cm-ISP1 \
new-routing-mark=to-ISP1 passthrough**=no**
add action=mark-routing chain=prerouting connection-mark=cm-ISP2 \
new-routing-mark=to-ISP2 passthrough=no
add action=mark-routing chain=prerouting connection-mark=cm-ISP3 \
new-routing-mark=to-ISP2 passthrough=no

**Note: Ensure on the forward chain firewall filter rules you make this addition to the first rule:
add chain=forward action=fasttrack-connection connection-state=established,related \
connection-mark=no-mark

16

Opinion: The only thing people like you can do is hire a consultant.

It's clear to everyone that if you can't tell the difference between a script downloaded from a website and your current router configuration, and the insistence that just looking at that shi~~y script someone will help you, well, I won't waste any more time on you.