Mangle and VPN

RouterOS General
1

Hi all.
I need help for point in right direction and have some suggest in a non simple environment.
RB1100 with 2 different “LAN” on ether2 and ether3 and 4 different ISP on ether6 ether7 ether8 ether9

I start use RB1100, make my 2 LAN surf and connect 3 gre tunnel and 1 IPSec tunnel on only 1 isp (ether7).
The second step, that i can configure, is mangle all ether3 connection and make it out from ether6 … all other still works on ether7 provider

Now, i desire make other 2 changes:

  1. have the 3 gre tunnel and the 1 IPSec tunnel stay UP through ether7
  2. use ether8 and ether9 like load balancing / fault tollerance isp for ether2

I read many in forum and search many in the net, but i can’t figure a right way. Expecially: how can i “mangle” all ether3 LAN trafic and use ether8 and ether9 but exclude for this “mangle” the VPN trafic originated from (and for) ether3?

Thanks for help.
Mauro.

2

The mangle rules can use the same match conditions like filter rules, so excluding the destination IP address ranges/subnets which are reachable through the VPN from mangling, or mangle them with different connection-mark or routing-mark than other traffic from ether3, should not be a complicated task.

3

Thanks Sindy.
You point me in the right direction, and i will try (i just create mangle rule, with an Address List destination exclusion for all VPN GRE and IpSec IP class, but i can active and try all in another moment).
But .. what about L2TP Vpn?
In case i’ve some user that use roadwarrior L2TP vpn for occasionally connet they own device at the LAN, how i can discriminate this traffic and mangle in the correct way?
Thanks.
Mauro.

4

Extensive facilities allowing to treat l2tp clients in a specific way are available via /ppp profile. There, you can specify an interface list to which the ppp interface dynamically created when that client connects will be added, and/or an address-list to which the IP address assigned to the client will be added when that client connects. Exclusively for L2TP, another possibility exists - to specify a static interface name associated to a particular /ppp secret.