RB 952Ui-xxxxx hAP ac, v 7.8 CPU usage <10%, 60% free memory
I set up policy routing in a dual WAN config and the connection initiation and packets in general via the route that matches policy seem to be slowed down in the router. For instance it can take several seconds or more to establish a ssh session with hosts on the route that matches policy and then once the session is established, it can take a few seconds to get what you entered in the console echoed back. Traffic is routing as desired and the traffic to the non-policy route is performing normally.
/routing/table print
D name="main" fib
name="ArouteTable" fib
/ip/firewall/mangle> print detail
;;; Mark A routing
chain=prerouting action=mark-routing new-routing-mark=ArouteTable passthrough=yes src-address-list="" dst-address-list=Alist
connection-mark="" in-interface-list=LAN log=no log-prefix=""
/ip route print detail
As dst-address=0.0.0.0/0 routing-table=main pref-src="" gateway=10.18.18.17 immediate-gw=10.18.18.17%ether5 distance=1 scope=30
target-scope=10 suppress-hw-offload=no
As dst-address=0.0.0.0/0 routing-table=ArouteTable pref-src="" gateway=192.168.0.1 immediate-gw=192.168.0.1%ether1 distance=1
scope=30 target-scope=10 suppress-hw-offload=no
If I add the following, traffic to 1.2.3.4 performs normally and the rest of the Alist host traffic continues to perform poorly.
Am I missing something in config? Am I expecting too much our of a tiny single-core processor? I really don’t want to add a rule for each entry in the Alist, that kind of obviates policy routing and might as well just add individual routes. I see nothing interesting in the logs. Ideas? Am I missing something or mis-interpreting documentation?
I pasted the part of the config to show what I had done in the specific areas, the problem was not that it was not working, it was not performing well. It turns out that the K2 “Destination Based” section found in this informative post is quite useful unlike some of the sparse v7 documentation:
@sbotnick Could you please share the exact rules you added, the linked thread is no longer accessible.
I ran into the exact same issue, same config as yours. With routing rule it works with no delay, but with mangle rule using an address list, I see 1-2s of delay. I am on an RB5009 running ROS 7.21.
You need to use the Wayback Machine to access an older version of the thread, because @anav removed many of his threads when he was unhappy with the forum's policy a couple of years ago
Anyway, the current idea to handle the incompatibility between mangle mark-routing and fasttrack is to:
Move most of the complex mangle conditions to mark-connection mangle rules, that set a connection mark.
The mark-routing mangle rules act on the connection-mark=xyz condition.
In the filter firewall rule, the existing action=fasttrack-connection rule is modified to have the additional condition connection-mark=no-mark.
This assures that everything that need mark-routing has a connection mark set. Which in turn makes them ineligible for the Fasttrack rule (because that rule requires that connection-mark=no-mark). Thus those packets will all bypass Fasttrack.
