I kindly ask for your help, as I have been struggling with an issue for several days now.
I am using Mikrotik 4011 and have two ISP connections:
Main PPPoE GPON with a dynamic external IP address (83.x.x.x),
ETTH connection with a static external IP address via DHCP (178.x.x.x).
My LAN network uses the 10.10.0.0/24 range. I have multiple VPN servers – WireGuard, IPsec IKE, SSTP, L2TP – operating through connection 2. In the LAN, I also have a NAS server (10.10.0.3). Is it possible to configure the router so that all traffic to the VPN servers and the NAS server is routed through connection 2, while the rest of the LAN clients (10.10.0.4–10.10.0.253) use connection 1?
I tried to solve the issue using appropriate NAT configuration and address lists, but without success.
Is it possible to use just one LAN subnet?
It will be a complicated setup but assuming you have port forwarding to servers on WAN2 and VPNS coming into WAN2,
Simply make two routes,
WAN1 PRIMARY
WAN2 Secondary
Mangle traffic to the router, ( vpns )
Mangle traffic through the router ( port forwarding )
Send all return traffic back out WAN2 that came in on WAN2.
Special case for wireguard as the protocol is not quite behaving properly in mangling for WAN2 situations.
++++++++++++++++++++++++++++++++++++++++++++++++
To be sure, it would be much easier if you put the NAS on its own subnet which is very easy to do.
In this setup connection is working
10.10.0.0/24-> ISP1
10.11.0.0/24-> ISP2
Main problem at this moment is no communication between subnets(PCs, server)
10.10.0.253 can ping 10.11.0.1(gateway) but not server 10.11.0.3 ( no icmp no access SMB/www/etc)
The first thing to do in mangling is to ensure traffic heading for WAN2 is sent back out via WAN2.
This should direct all VPNs coming on WAN2 to go back out WAN2.
Of course one must have standard sourcenat rule in place as well
Your wireguard rule seems to be deleted not sure why… in anycase
will call the interrface wg-vpn and the port being used 15667
Currently one needs to add some trickery for wireguard as it doesnt play nice and will respond to initial handshake incorrectly via WAN1despite the mangling.
This can be overcome by adding a NAT rule. add action=dst-nat chain=dst-nat dst-address-type=local in-interface=ether9 dst-port=15667 protocol=udp to-addresses=fixedWAN2-IPaddress
This basically tricks the router into undestinatting any wireguard traffic back through WAN2.
NEXT we mangle for all LAN TRAFFIC GOING OUT WAN2… /ip mangle
add action=mark-connections chain=forward in-interface-list=LAN src-address=10.11.0.0/24
dst-address-type=!local connection-mark=no-mark new-connection-mark=from-LAN2 passthrough=yes
{ route the traffic out the special table for WAN2 } add action=mark-routing chain=prerouting connection-mark=from-LAN2
new-routing-mark=ISP_VIA_ETTH passthrough=no
Note: To ensure normal traffic going out WAN is not affected in terms of fastrack rule in the forward chain ensure you add to the fastrack rule: connection-mark=no-mark
+++++++++++++++++++++++++++++++++++++++++++++++
Then we can deal with routes…
I am going to assume that there is no real backup mode, aka WAN1 users should not go to WAN2 and WAN2 user should not go to WAN1 if the respective internet is not working, or more clearly you didnt state requirements for such, and thus not entertained. The only real difference here is that I have used distance to ensure that The main gateway is the default gateway that all users will be pointed towards, and that will be used to ensure your normal LAN uses WAN1. We use mangling to force the NAS lan to use WAN2.
We use check-gateway=ping to ensure that when the internet comes back up the router keeps checking to see when it does and enables it for use.
Now by default all users will use WAN1 for internet and if its unavailable, will be sent to black hole aka nowhere
Next we ensure that NAS subnet users that are captured by our mangling get routed out WAN21.
CHANGE THIS TO
/ip settings
set max-neighbor-entries=8192 rp-filter=loose
DECIDE!!! Either use IP DHCP client for ether9 OR assign an IP address but not both !!!
Since its a static IP, setting the IP address makes sense and I ssuspect you just entered a generic representative entry ( but get rid of client )
(also confusing as you use an address that is markedly different from its gateway in your routes… not a big deal…)
Firewall rules need work, simplify and add…
/ip firewall filter
{ default rules to keep } add action=accept chain=input connection-state=established,related,untracked
add action=drop chain=input connection-state=invalid
add action=accept chain=input protocol=icmp
{ admin rules} add action=accept chain=input comment=“wireguard handshake” dst-port=15667 protocol=udp
{ ADD ALL SIMILAR NEEDED RULES FOR OTHER VPNS} add action=accept chain=input comment=“admin access only” src-address-list=TRUSTED
add action=accept chain=input comment=“users to services” in-interface-list=LAN dst-port=53,123 protocol=udp
add action=accept chain=input comment=“users to services” in-interface-list=LAN dst-port=53protocol=tcp
add action=drop chain=input comment="drop all else" { add this rule last or you could lock yourself out }
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
{default rules to keep} add action=fasttrack-connection chain=forward connection-state=established,related connection-mark=no-mark
add action=accept chain=forward connection-state=established,related,untracked
add action=drop chain=forward connection-state=invalid
{admin rules} add action=accept chain=forward comment=“internet” in-interface-list=LAN out-interface-list=WAN
add action=accept chain=forward comment=“user LAN to NAS” src-address=10.10.0/24 dst-address=NAS-IP
{ ADD ANY ALLOW SIMILAR RULES FOR TRAFFIC NEEDED} add action=drop chain=input comment=“Drop all else” /ip firewall nat
add action=masquerade chain=srcnat out-interface=“PPPoE Gateway”
add action=masquerade chain=srcnat out-interface=ether9
Since I dont understand the need for any other sourcenat rules I didnt add them back in.
Make sure you actually need them…
Missing items so the above works… /interface list
add name=WAN
add name=LAN
/interface list members
add interface=ether9 list=WAN
add interface=“PPPoE-Gateway” list=WAN
add interface=LAN_ISP_PPPoE list=LAN
add interface=LAN_ISP_ETTH list=LAN
add interface=wg-vpn list=LAN
/ip firewall address-list
add address=10.10.0.X list=TRUSTED comment=“admin device on normal LAN subnet”
add address=10.11.0.Y list=TRUSTED comment=“admin device on NAS subnet”
add address=10.100.0.2 list=TRUSTED comment=“remote admin laptop”
{ ADD ANY OTHER ADDRESSES for access to config the router }
Thank you.
I did apply mangle rules as you told. Connections between subnets are fine(working)
But there is no Internet Access from 10.11.0.0/24
Any ideas? // Sry didnt see your second post i will check IT tommorow.
?