Low internet speed when we did PCC load balancing and connecting 2 ISPs on Mikrotik

RouterOS Beginner Basics
1

Hello Team,

I am new to Mikrotik routers. I have a router RB5009UG+S+IN. We have multiple WAN connections and we needed to do load balancing so that the 2 ISPs will be getting distributed for the connections.

I have done the configuration based on the tech video from Mikrotik: https://www.youtube.com/watch?v=nlb7XAv57tw&t=858s

The load balancing is working fine. When I check the firewall connections, I can see that connections are distributed between ISP1 and ISP2.

But the problem is when both WAN links are connected to the router, the internet speed becomes drastically slow. Even I won't be able to browse to YouTube or any other websites. If I disconnect 1 WAN link from the router, then the speed will be getting increased.

I will list what all troubleshooting steps which I did so far.

Tried to connect 1 ISP to the router at a time and the speed was good at that time. When both ISPs are connected, speed becomes extremely slow.
Checked the internet speed on both WAN links bypassing the router and the speed was good.
Tried to configure the WAN link to the different interface, but the issue was still the same.

I also came across a forum link where I think the user was similar issue and updated my mangle rules based on the solved comment. But still even after those changes the internet speed is still very slow.

Kindly help me with this issue as I need to get this load balancing working as soon as possible since the internet speed is causing issue for our Cloud Software.

I will share the running configuration below. Note that I have removed 2 default routes with the distance value of 1, since adding that route was slowing down the internet speed.

Also, 4 mangle rules on top were disabled since I am not doing the load balancing now.

Hope someone will be able to check the configuration and help me with what is missing from my end.

Thank you in advance.

\

[admin@MikroTik] > export
# jan/09/2025 15:08:55 by RouterOS 7.8
# software id = 0I4U-6WY6
#
# model = RB5009UPr+S+
# serial number = ****
/interface bridge
add admin-mac=78:9A:18:95:0B:93 auto-mac=no comment=defconf name=bridge
/interface ethernet
set [ find default-name=ether2 ] name=ISP1
set [ find default-name=ether5 ] name=ISP2
/interface list
add comment=defconf name=WAN
add comment=defconf name=LAN
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
/ip pool
add name=default-dhcp ranges=192.168.88.20-192.168.88.254
/ip dhcp-server
add address-pool=default-dhcp interface=bridge lease-time=12h name=defconf
/routing table
add disabled=no fib name=To-ISP1
add disabled=no fib name=To-ISP2
/interface bridge port
add bridge=bridge comment=defconf interface=ether3
add bridge=bridge comment=defconf interface=ether4
add bridge=bridge comment=defconf interface=ether6
add bridge=bridge comment=defconf interface=ether7
add bridge=bridge comment=defconf interface=ether8
add bridge=bridge comment=defconf interface=sfp-sfpplus1
/ip neighbor discovery-settings
set discover-interface-list=LAN
/interface list member
add comment=defconf interface=bridge list=LAN
add comment=defconf interface=ether1 list=WAN
/ip address
add address=192.168.88.1/24 comment=defconf interface=bridge network=\
    192.168.88.0
/ip dhcp-client
add add-default-route=no interface=ISP1
add add-default-route=no interface=ISP2
/ip dhcp-server network
add address=192.168.88.0/24 comment=defconf dns-server=1.1.1.1,8.8.8.8 gateway=\
    192.168.88.1
/ip dns
set allow-remote-requests=yes
/ip dns static
add address=192.168.88.1 comment=defconf name=router.lan
/ip firewall filter
add action=accept chain=input comment=\
    "defconf: accept established,related,untracked" connection-state=\
    established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=\
    invalid
add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp
add action=accept chain=input comment=\
    "defconf: accept to local loopback (for CAPsMAN)" dst-address=127.0.0.1
add action=drop chain=input comment="defconf: drop all not coming from LAN" \
    in-interface-list=!LAN
add action=accept chain=forward comment="defconf: accept in ipsec policy" \
    ipsec-policy=in,ipsec
add action=accept chain=forward comment="defconf: accept out ipsec policy" \
    ipsec-policy=out,ipsec
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" \
    connection-state=established,related hw-offload=yes
add action=accept chain=forward comment=\
    "defconf: accept established,related, untracked" connection-state=\
    established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" connection-state=\
    invalid
add action=drop chain=forward comment="defconf: drop all from WAN not DSTNATed" \
    connection-nat-state=!dstnat connection-state=new in-interface-list=WAN
/ip firewall mangle
add action=accept chain=prerouting disabled=yes dst-address=192.168.8.0/24
add action=accept chain=prerouting disabled=yes dst-address=192.168.0.0/24
add action=mark-connection chain=prerouting connection-mark=no-mark disabled=yes \
    dst-address-type=!local in-interface=bridge new-connection-mark=ISP1-Conn \
    passthrough=yes per-connection-classifier=both-addresses:2/0
add action=mark-connection chain=prerouting connection-mark=no-mark disabled=yes \
    dst-address-type=!local in-interface=bridge new-connection-mark=ISP2-Conn \
    passthrough=yes per-connection-classifier=both-addresses:2/1
add action=mark-routing chain=prerouting connection-mark=ISP1-Conn in-interface=\
    bridge new-routing-mark=To-ISP1 passthrough=yes
add action=mark-routing chain=prerouting connection-mark=ISP2-Conn in-interface=\
    bridge new-routing-mark=To-ISP2 passthrough=yes
add action=mark-routing chain=output connection-mark=ISP1-Conn new-routing-mark=\
    To-ISP1 passthrough=yes
add action=mark-routing chain=output connection-mark=ISP2-Conn new-routing-mark=\
    To-ISP2 passthrough=yes
add action=mark-connection chain=prerouting connection-mark=no-mark \
    in-interface=ISP1 new-connection-mark=ISP1-Conn passthrough=yes
add action=mark-connection chain=prerouting connection-mark=no-mark \
    in-interface=ISP2 new-connection-mark=ISP2-Conn passthrough=yes
/ip firewall nat
add action=masquerade chain=srcnat comment="defconf: masquerade" ipsec-policy=\
    out,none out-interface-list=WAN
add action=masquerade chain=srcnat out-interface=ISP1
add action=masquerade chain=srcnat out-interface=ISP2
/ip route
add check-gateway=ping disabled=no distance=1 dst-address=0.0.0.0/0 gateway=\
    192.168.8.1 pref-src="" routing-table=main scope=30 suppress-hw-offload=no \
    target-scope=10
add check-gateway=ping disabled=no distance=2 dst-address=0.0.0.0/0 gateway=\
    192.168.0.1 pref-src="" routing-table=main scope=30 suppress-hw-offload=no \
    target-scope=10
/ipv6 firewall address-list
add address=::/128 comment="defconf: unspecified address" list=bad_ipv6
add address=::1/128 comment="defconf: lo" list=bad_ipv6
add address=fec0::/10 comment="defconf: site-local" list=bad_ipv6
add address=::ffff:0.0.0.0/96 comment="defconf: ipv4-mapped" list=bad_ipv6
add address=::/96 comment="defconf: ipv4 compat" list=bad_ipv6
add address=100::/64 comment="defconf: discard only " list=bad_ipv6
add address=2001:db8::/32 comment="defconf: documentation" list=bad_ipv6
add address=2001:10::/28 comment="defconf: ORCHID" list=bad_ipv6
add address=3ffe::/16 comment="defconf: 6bone" list=bad_ipv6
/ipv6 firewall filter
add action=accept chain=input comment=\
    "defconf: accept established,related,untracked" connection-state=\
    established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=\
    invalid
add action=accept chain=input comment="defconf: accept ICMPv6" protocol=icmpv6
add action=accept chain=input comment="defconf: accept UDP traceroute" port=\
    33434-33534 protocol=udp
add action=accept chain=input comment=\
    "defconf: accept DHCPv6-Client prefix delegation." dst-port=546 protocol=udp \
    src-address=fe80::/10
add action=accept chain=input comment="defconf: accept IKE" dst-port=500,4500 \
    protocol=udp
add action=accept chain=input comment="defconf: accept ipsec AH" protocol=\
    ipsec-ah
add action=accept chain=input comment="defconf: accept ipsec ESP" protocol=\
    ipsec-esp
add action=accept chain=input comment=\
    "defconf: accept all that matches ipsec policy" ipsec-policy=in,ipsec
add action=drop chain=input comment=\
    "defconf: drop everything else not coming from LAN" in-interface-list=!LAN
add action=accept chain=forward comment=\
    "defconf: accept established,related,untracked" connection-state=\
    established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" connection-state=\
    invalid
add action=drop chain=forward comment="defconf: drop packets with bad src ipv6" \
    src-address-list=bad_ipv6
add action=drop chain=forward comment="defconf: drop packets with bad dst ipv6" \
    dst-address-list=bad_ipv6
add action=drop chain=forward comment="defconf: rfc4890 drop hop-limit=1" \
    hop-limit=equal:1 protocol=icmpv6
add action=accept chain=forward comment="defconf: accept ICMPv6" protocol=icmpv6
add action=accept chain=forward comment="defconf: accept HIP" protocol=139
add action=accept chain=forward comment="defconf: accept IKE" dst-port=500,4500 \
    protocol=udp
add action=accept chain=forward comment="defconf: accept ipsec AH" protocol=\
    ipsec-ah
add action=accept chain=forward comment="defconf: accept ipsec ESP" protocol=\
    ipsec-esp
add action=accept chain=forward comment=\
    "defconf: accept all that matches ipsec policy" ipsec-policy=in,ipsec
add action=drop chain=forward comment=\
    "defconf: drop everything else not coming from LAN" in-interface-list=!LAN
/system clock
set time-zone-name=Asia/Riyadh
/tool mac-server
set allowed-interface-list=LAN
/tool mac-server mac-winbox
set allowed-interface-list=LAN
[admin@MikroTik] >

==========================================================================

2

Please remeber to remove serial numbers from config and use < / > code tags to show the code.

3

Forum link which I followed: http://forum.mikrotik.com/t/load-balancing-slow-loading-of-websites-and-more/153639/1

4

Well, that thread is from 2021, and it is about RouterOS 6.49.1.
You are running 7.8 (which is in itself really old).
Something may well have changed in the meantime.
Even if you don’t want to upgrade to latest-latest (that would be 7.16.2) you should IMHO at least upgrade to 7.12.1 (to which you have to upgrade anyway to be able to get later versions, now or in the future).

Your configuration seems a bit confused, particularly the mangle rules.
In the /ip route table there are no routes in tables To-ISP1 and To-ISP2?

Maybe you want to review your setup getting inspiration from this thread:
http://forum.mikrotik.com/t/pcc-on-ros-7-8/165613/1

5

Thank you for your response.

The /ip route to the tables “To-ISP1” and “To-ISP2” with the distance value 1 were removed due to the internet getting slower with that enabled. I should have just disabled those routes instead of removing. This was mentioned in my original post.

Apart from the firmware upgrade, does the mangle rule position and configurations fine?

6

I don’t know.

Maybe you should recreate the exact configuration that creates the slowdown and post that one.

It is harder to read a configuration where something has been removed (or disabled) as you never know if it is missing or is a leftover from another attempt.

7

Concur with jaclaz, its a waste of time for us to chase what ifs.
Post your latest config that is not working, then we will provide suggestions.
If that doesnt work, post that config with the latest config and we will work from that.

We can best work from accurate facts presented… and after recommended changes are made.

8

Thank you for your responses @jaclaz and @anav.

As suggested I have upgraded the firmware to the lates one. Also, I have done some troubleshooting from my end and tried the suggested steps in Mikrotik articles and tech videos. But when we are enabling the load balancing, we are still facing very slow internet speed.

Please find the non-working configuration.

</[admin@MikroTik] > export

2025-01-18 14:11:09 by RouterOS 7.17

software id = 0I4U-6WY6

model = RB5009UPr+S+

serial number = ******

/interface bridge
add admin-mac=78:9A:18:95:0B:93 auto-mac=no comment=defconf name=bridge
port-cost-mode=short
/interface ethernet

poe-out status: short_circuit

set [ find default-name=ether2 ] name=ISP1

poe-out status: short_circuit

set [ find default-name=ether5 ] name=ISP2
/interface list
add comment=defconf name=WAN
add comment=defconf name=LAN
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
/ip pool
add name=default-dhcp ranges=192.168.88.20-192.168.88.254
/ip dhcp-server
add address-pool=default-dhcp interface=bridge lease-time=12h name=defconf
/ip smb users
set [ find default=yes ] disabled=yes
/routing table
add disabled=no fib name=To-ISP1
add disabled=no fib name=To-ISP2
/interface bridge port
add bridge=bridge comment=defconf interface=ether3 internal-path-cost=10
path-cost=10
add bridge=bridge comment=defconf interface=ether4 internal-path-cost=10
path-cost=10
add bridge=bridge comment=defconf interface=ether6 internal-path-cost=10
path-cost=10
add bridge=bridge comment=defconf interface=ether7 internal-path-cost=10
path-cost=10
add bridge=bridge comment=defconf interface=ether8 internal-path-cost=10
path-cost=10
add bridge=bridge comment=defconf interface=sfp-sfpplus1 internal-path-cost=10
path-cost=10
/ip firewall connection tracking
set udp-timeout=10s
/ip neighbor discovery-settings
set discover-interface-list=LAN
/interface list member
add comment=defconf interface=bridge list=LAN
add comment=defconf interface=ether1 list=WAN
/interface ovpn-server server
add mac-address=FE:4B:0E:95:06:E2 name=ovpn-server1
/ip address
add address=192.168.88.1/24 comment=defconf interface=bridge network=
192.168.88.0
/ip dhcp-client
add add-default-route=no interface=ISP1
add add-default-route=no interface=ISP2
/ip dhcp-server network
add address=192.168.88.0/24 comment=defconf dns-server=1.1.1.1,8.8.8.8 gateway=
192.168.88.1
/ip dns
set allow-remote-requests=yes
/ip dns static
add address=192.168.88.1 comment=defconf name=router.lan type=A
/ip firewall filter
add action=accept chain=input comment=
"defconf: accept established,related,untracked" connection-state=
established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=
invalid
add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp
add action=accept chain=input comment=
"defconf: accept to local loopback (for CAPsMAN)" dst-address=127.0.0.1
add action=drop chain=input comment="defconf: drop all not coming from LAN"
in-interface-list=!LAN
add action=accept chain=forward comment="defconf: accept in ipsec policy"
ipsec-policy=in,ipsec
add action=accept chain=forward comment="defconf: accept out ipsec policy"
ipsec-policy=out,ipsec
add action=fasttrack-connection chain=forward comment="defconf: fasttrack"
connection-state=established,related hw-offload=yes
add action=accept chain=forward comment=
"defconf: accept established,related, untracked" connection-state=
established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" connection-state=
invalid
add action=drop chain=forward comment="defconf: drop all from WAN not DSTNATed"
connection-nat-state=!dstnat connection-state=new in-interface-list=WAN
/ip firewall mangle
add action=accept chain=prerouting disabled=yes dst-address=192.168.8.0/24
add action=accept chain=prerouting disabled=yes dst-address=192.168.0.0/24
add action=mark-connection chain=prerouting connection-mark=no-mark
dst-address-type=!local in-interface=bridge new-connection-mark=ISP1-Conn
per-connection-classifier=dst-address:2/0
add action=mark-connection chain=prerouting connection-mark=no-mark
dst-address-type=!local in-interface=bridge new-connection-mark=ISP2-Conn
per-connection-classifier=dst-address:2/1
add action=mark-routing chain=prerouting connection-mark=ISP1-Conn in-interface=
bridge new-routing-mark=To-ISP1
add action=mark-routing chain=prerouting connection-mark=ISP2-Conn in-interface=
bridge new-routing-mark=To-ISP2
add action=mark-routing chain=output connection-mark=ISP1-Conn new-routing-mark=
To-ISP1
add action=mark-routing chain=output connection-mark=ISP2-Conn new-routing-mark=
To-ISP2
add action=mark-connection chain=prerouting connection-mark=no-mark
in-interface=ISP1 new-connection-mark=ISP1-Conn
add action=mark-connection chain=prerouting connection-mark=no-mark
in-interface=ISP2 new-connection-mark=ISP2-Conn
/ip firewall nat
add action=masquerade chain=srcnat comment="defconf: masquerade" ipsec-policy=
out,none out-interface-list=WAN
add action=masquerade chain=srcnat out-interface=ISP1
add action=masquerade chain=srcnat out-interface=ISP2
/ip hotspot profile
set [ find default=yes ] html-directory=hotspot
/ip ipsec profile
set [ find default=yes ] dpd-interval=2m dpd-maximum-failures=5
/ip route
add check-gateway=ping disabled=no distance=1 dst-address=0.0.0.0/0 gateway=
192.168.8.1 pref-src="" routing-table=main scope=30 suppress-hw-offload=no
target-scope=10
add check-gateway=ping disabled=no distance=1 dst-address=0.0.0.0/0 gateway=
192.168.0.1 pref-src="" routing-table=main scope=30 suppress-hw-offload=no
target-scope=10
add check-gateway=ping disabled=no distance=1 dst-address=0.0.0.0/0 gateway=
192.168.8.1 pref-src="" routing-table=To-ISP1 scope=30 suppress-hw-offload=
no target-scope=10
add disabled=no distance=1 dst-address=0.0.0.0/0 gateway=192.168.0.1 pref-src=""
routing-table=To-ISP2 scope=30 suppress-hw-offload=no target-scope=10
/ip smb shares
set [ find default=yes ] directory=/pub
/ipv6 firewall address-list
add address=::/128 comment="defconf: unspecified address" list=bad_ipv6
add address=::1/128 comment="defconf: lo" list=bad_ipv6
add address=fec0::/10 comment="defconf: site-local" list=bad_ipv6
add address=::ffff:0.0.0.0/96 comment="defconf: ipv4-mapped" list=bad_ipv6
add address=::/96 comment="defconf: ipv4 compat" list=bad_ipv6
add address=100::/64 comment="defconf: discard only " list=bad_ipv6
add address=2001:db8::/32 comment="defconf: documentation" list=bad_ipv6
add address=2001:10::/28 comment="defconf: ORCHID" list=bad_ipv6
add address=3ffe::/16 comment="defconf: 6bone" list=bad_ipv6
/ipv6 firewall filter
add action=accept chain=input comment=
"defconf: accept established,related,untracked" connection-state=
established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=
invalid
add action=accept chain=input comment="defconf: accept ICMPv6" protocol=icmpv6
add action=accept chain=input comment="defconf: accept UDP traceroute" port=
33434-33534 protocol=udp
add action=accept chain=input comment=
"defconf: accept DHCPv6-Client prefix delegation." dst-port=546 protocol=udp
src-address=fe80::/10
add action=accept chain=input comment="defconf: accept IKE" dst-port=500,4500
protocol=udp
add action=accept chain=input comment="defconf: accept ipsec AH" protocol=
ipsec-ah
add action=accept chain=input comment="defconf: accept ipsec ESP" protocol=
ipsec-esp
add action=accept chain=input comment=
"defconf: accept all that matches ipsec policy" ipsec-policy=in,ipsec
add action=drop chain=input comment=
"defconf: drop everything else not coming from LAN" in-interface-list=!LAN
add action=accept chain=forward comment=
"defconf: accept established,related,untracked" connection-state=
established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" connection-state=
invalid
add action=drop chain=forward comment="defconf: drop packets with bad src ipv6"
src-address-list=bad_ipv6
add action=drop chain=forward comment="defconf: drop packets with bad dst ipv6"
dst-address-list=bad_ipv6
add action=drop chain=forward comment="defconf: rfc4890 drop hop-limit=1"
hop-limit=equal:1 protocol=icmpv6
add action=accept chain=forward comment="defconf: accept ICMPv6" protocol=icmpv6
add action=accept chain=forward comment="defconf: accept HIP" protocol=139
add action=accept chain=forward comment="defconf: accept IKE" dst-port=500,4500
protocol=udp
add action=accept chain=forward comment="defconf: accept ipsec AH" protocol=
ipsec-ah
add action=accept chain=forward comment="defconf: accept ipsec ESP" protocol=
ipsec-esp
add action=accept chain=forward comment=
"defconf: accept all that matches ipsec policy" ipsec-policy=in,ipsec
add action=drop chain=forward comment=
"defconf: drop everything else not coming from LAN" in-interface-list=!LAN
/system clock
set time-zone-name=Asia/Riyadh
/system note
set show-at-login=no
/tool mac-server
set allowed-interface-list=LAN
/tool mac-server mac-winbox
set allowed-interface-list=LAN
[admin@MikroTik] > >


Kindly let me know know if there are any suggestions for the changes.

I even tried to open a support ticket (SUP-175809) but the experience is really bad. Case was opened more than 10 days ago and still not a single response.

9

Support tickets are for bugs in the software mostly, and for suggestions… It is not designed to help with peoples configs.
If we cannot find a source for your issues, after resolving any config issues, then a supout and bug are probably appropriate.

This is very simple load balancing so it should not take long to fix. You do not have an VPNs in the mix or port forwarding etc…

  1. One interface list member is Wrongly identified and the other is Missing! .
    From:
    /interface list member
    add comment=defconf interface=bridge list=LAN
    add comment=defconf interface=ether1 list=WAN
    TO:
    /interface list member
    add comment=defconf interface=bridge list=LAN
    add interface=ISP1 list=WAN
    add interface=ISP2 list=WAN

  2. Mangles adjusted: Minor change… from in-interface=bridge to in-interface-list=LAN / added passthrough indications / mark connections done on forward chain ( prerouting works but forward is more accurate ) / do NOT required identifying the in-interface on routing rule its done on the mark connection rule already (redundant)
    ip firewall mangle
    add action=mark-connection chain**=forward** connection-mark=no-mark
    dst-address-type=!local in-interface-list=LAN new-connection-mark=ISP1-Conn
    per-connection-classifier=dst-address:2/0 passthrough=yes
    add action=mark-connection chain=forward connection-mark=no-mark
    dst-address-type=!local in-interface-list=LAN new-connection-mark=ISP2-Conn
    per-connection-classifier=dst-address:2/1 passthrough=yes
    add action=mark-routing chain=prerouting connection-mark=ISP1-Conn
    new-routing-mark=To-ISP1 passthrough=no
    add action=mark-routing chain=prerouting connection-mark=ISP2-Conn
    new-routing-mark=To-ISP2 passthrough=no

The output associated mangles you had, serve NO function in your setup and were incorrect anyway. These should be removed!
add action=mark-routing chain=output connection-mark=ISP1-Conn new-routing-mark=To-ISP1
add action=mark-routing chain=output connection-mark=ISP2-Conn new-routing-mark=To-ISP2
add action=mark-connection chain=prerouting connection-mark=no-mark in-interface=ISP1 new-connection-mark=ISP1-Conn
add action=mark-connection chain=prerouting connection-mark=no-mark in-interface=ISP2 new-connection-mark=ISP2-Conn

  1. Sourcenat rules, you can use either the first rule ( after ensuring ISP2 is part of WAN interface list) or the two rules following. No need to keep all three.

  2. Routes - slight modifications…
    From:
    /ip route
    add check-gateway=ping distance=1 dst-address=0.0.0.0/0 gateway=192.168.8.1 routing-table=main scope=30
    add check-gateway=ping distance=1 dst-address=0.0.0.0/0 gateway=192.168.0.1
    add check-gateway=ping distance=1 dst-address=0.0.0.0/0 gateway=192.168.8.1 routing-table=To-ISP1
    add distance=1 dst-address=0.0.0.0/0 gateway=192.168.0.1 routing-table=To-ISP2

To:
{ main routes }
add check-gateway=ping dst-address=0.0.0.0/0 gateway=192.168.8.1
add distance=2 check-gateway=ping dst-address=0.0.0.0/0 gateway=192.168.0.1
{ special routes }
add check-gateway=ping dst-address=0.0.0.0/0 gateway=192.168.8.1 routing-table=To-ISP1
add distance=2 dst-address=0.0.0.0/0 gateway=192.168.0.1 routing-table=To-ISP1 comment=“fail-over pcc traffic aimed at wan1 will still get out via WAN2”
add check-gateway=ping dst-address=0.0.0.0/0 gateway=192.168.0.1 routing-table=To-ISP2
add distance=2 dst-address=0.0.0.0/0 gateway=192.168.8.1 routing-table=To-ISP2 comment=“failover - pcc traffic aimed at wan2 will still get out via WAN1”[/i]


I personally prefer to at least add recursive routing ( to ensure not only connectivity to ISP, but connectivity from ISP to www)
If interested let me know.

  1. mac-server is not secure so set to none.
    /tool mac-server
    set allowed-interface-list=LAN
    /tool mac-server mac-winbox
    set allowed-interface-list=LAN
10

Fasttrack is not compatible with mangle, disable or remove the fasttrack-connection firewall rule.

11

Accurate but avoidable, I missed this when looking at firewall rules.
There is a purpose to using no-track in mangling, which is an aide in discriminating which traffic to identity. but also to KEEP fastrack and not cause any slowdown.

From:
add action=fasttrack-connection chain=forward comment=“defconf: fasttrack”
connection-state=established,related hw-offload=yes

TO:
add action=fasttrack-connection chain=forward comment=“defconf: fasttrack”
connection-state=established,related hw-offload=yes connection-mark=no-mark

In your case there is no other traffic and thus the above works, but you can also disable or remove the rule as tdw noted.

12

Thank you for the responses. Could you please share the configuration for the recursive routing as well? What additional steps needs to be done in the below routing configuration?

/ip route
add check-gateway=ping disabled=no distance=1 dst-address=0.0.0.0/0 gateway=
192.168.8.1 pref-src=“” routing-table=main scope=30 suppress-hw-offload=no
target-scope=10
add check-gateway=ping disabled=no distance=1 dst-address=0.0.0.0/0 gateway=
192.168.0.1 pref-src=“” routing-table=main scope=30 suppress-hw-offload=no
target-scope=10
add check-gateway=ping disabled=no distance=1 dst-address=0.0.0.0/0 gateway=
192.168.8.1 pref-src=“” routing-table=To-ISP1 scope=30 suppress-hw-offload=
no target-scope=10
add disabled=no distance=1 dst-address=0.0.0.0/0 gateway=192.168.0.1 pref-src=“”
routing-table=To-ISP2 scope=30 suppress-hw-offload=no target-scope=10




Thank you in advance.

13

I cannot help, I recommended a different solution for IP routes as noted above,
You have provided a routing that is already load balanced based on ECMP and thus is nonsensical.

Since you didnt except that change, my providing of recursive wont work either as it wont relate to your current settings.