Marked routes break connections

RouterOS General
1

Hello,
I can not handle a simple task. I’ve broken my mind, can not understand, what’s wrong.

Conditions:

  1. Two WANs (LTE modems):
    ppp-megafon-1 - gateway dynamic, default distance = 3
    lte-beeline - gateway 192.168.8.1 (dynamic), default distance = 4 (4 to use it as reserved channel if the first one is down)
  2. Internal network: 192.168.88.0/24

Task:

  • to route dedicated internal client (192.168.88.117) via one of WANs (lte-beeline), all other clients - via another WAN (ppp-megafon-1).

The way:

  1. to mark a route
/ip firewall mangle add action=mark-routing chain=prerouting \
dst-address-list=!BOGONS new-routing-mark=to_isp2 \
passthrough=no src-address=192.168.88.117
  1. to add route based on routing mark
/ip route add distance=2 gateway=192.168.8.1 routing-mark=to_isp2

As simple as possible, but doesn’t work correctly:

  1. ping works ok, packets go through right WAN
  2. on client (192.168.88.117) I see broken connections, TCP retransmissions, lags and so on. Wireshark’s sceen follows.

It looks like a part of packets goes in another direction. I can not undestand why.
Some packets for those connections are not marked.

I’ve tried another way to solve a task

  1. to mark a connection based on src-address 192.168.88.117
  2. to make a routing-mark based on connection-mark
  3. to make a route based on routing-mark

Result is the same.

Also I’ve tried to make a routing-mark based on dst-address. The same - connections are broken.
But if I make a route based on dst-address (without rouing-mark) - it works perfect. But it can not handle my task :frowning:

WANs works correctly.
If I turn off WAN-1 (ppp-megafon-1), then internet works ok for all clients (including 192.168.88.117) via WAN-2 (lte-beeline).
If I remove route based on routing-mark, then dedicated client works ok via WAN-1 (ppp-megafon-1).
If I turn on the route - connections are broken.

I will be very appriciate, if you can pick me, what I’ve missed.

Thanks in advance.
1.png

2

Maybe change the RouterOS version to another and check again.
I use a way writed here: http://forum.mikrotik.com/t/moving-from-fail-over-to-using-both-wans/143145/2 - maybe you found some new info.
About check-gateway at lte1 … it’s works in reality just as interface status. The Recursive Route at dynamic interface not work :frowning: - best way is own script.

3

Maybe you not accept established&related packages ??? You should have that rule in input&output&forward chain

4

Ahhh!!! You completely right! I had these rules, but it were after drops in input chain. Modified firewall rules - it works now.
By the way, in your reply I found very good presentation about mangle and marking connections and routes - https://mum.mikrotik.com//presentations/US12/tomas.pdf
I’ve created a config based on this - I believe that it’s more universal.

Thanks a lot!

5

Yes, this is a proper way to do a MultiWan and when you have a Public IP from ISP then you can have a DNAT from both ISP to your machine. LoadBallance at Cloude for incomming traffic… and LB policy for your LANs outgoing policy give you a proper way to works with many ISP at the same time.