Is there a way to have an incoming packet on the WAN 1 to always be returned out WAN 1 and Incoming traffic on WAN 2 to always be returned on WAN 2 regardless of source IP? With default router setup everything is returned to WAN 1 by default routing rules. I can add rules to route specific IP traffic to WAN 2, but would like it to be more of a connection tracked route, not IP range specific.
Here’s my setup:
This is going to be replicated 200 times across multiple sites and I’d rather not hard code IP routes in case one of the server addresses changes at some point. In that case I would have to log into all 200 sites and reconfigure the routes which I would prefer to avoid.
Mark new incoming connections in mangle and then reroute traffic from local hosts based on that connection mark (by using mangle routing mark or route rules)
Mark connections which are new or have no mark on ingress via the respective WAN interfaces, apply routing marks based on the connection marks to lookup outbound routes. It is mentioned in the Wiki PCC example https://wiki.mikrotik.com/wiki/Manual:PCC#Policy_routing and is still relevant even if you do not implement PCC for internally initiated outbound traffic.
This walks through things differently than the Wiki. Is there a right or best way to do this? I’m not familiar with text commands and haven’t used the terminal for configuration (I’m assuming that’s where I’d type these instructions in). Thanks for the assistance. As you can tell I’m just getting my mind wrapped around all this and my routing depth of knowledge is pretty shallow.
As with many blogs/videos it is incomplete - it only handles connections to the Mikrotik itself, not connections passing through the Mikrotik (both directly routed and destination NAT), and re-marks connections for every packet received, not just the first one which would have a connection state of new and also no existing connection mark, so using unecessary CPU resources.
Command-line examples precisely describe the settings made, using the Web UI / Winbox there may be settings on multiple tabs of a items properties which would require several screenshots and the necessary fields highlighted to convey the same information. You can always look through the graphical UI settings of an object to work out which fields correspond to the command-line example.
So I easily setup the inbound marks and can monitor that connections are getting marked via IP/Firewall/Connections, inbound are WAN1_conn and WAN2_conn. However, I’m having a hard time with routing out via those marks. I created two new tables in Routing/Tables: out_WAN1 and out_WAN2, but I don’t know where to build the rules for routing and what settings. Here is what I’ve got that’s not working at the moment:
Use /ip firewall mangle to also apply routing marks to marked connections, as you have only a screenshot of firewall connections what you have there is not displayed. For traffic from the Mikrotik itself it should be:
/ip firewall mangle
add chain=output connection-mark=WAN1_conn action=mark-routing new-routing-mark=out_ISP1
add chain=output connection-mark=WAN2_conn action=mark-routing new-routing-mark=out_ISP2
It is a multi-step process:
Applying the connection mark at the beginning of a new conversation identifies the stream of packets in that particular conversation.
Applying the routing mark identifies which routing table to use for each packet of the conversation.
The routing table identifies the destination to send the packet to.
This was the answer! Thank you so much tdw and mrz for you assistance! Once I added the rest of the mark rules the routing I had already setup worked. I’ve been working on this for WAY too long and you all got me where I needed to be. Thanks!
I’m loading a templated config into 200 new routers on the bench. Changes in the future should be one off, not en mass. Is there a good solution to do centeral management with these?
From within the Winbox GUI tool, open up the menu item “New Terminal”. Then type the following command: export file=“Export.rsc”. Then navigate to the “Files” menu option and you’ll note the newly exported configuration. Right click on it and download it to your PC. Open it up in an editor (like Notepad) and change personal information.
Thanks, I believe this is virtually the same as what I have setup now. It took a bit of brain damage to wrap my mind around the concepts, but it makes sense now.
