I want to know what actions or steps I should take to have the specific IPs using the specific gateway only.
For example: all IPs from 10.10.10.0/24 using only gateway 10.10.10.1, and all IPs from 10.10.20.0/24 using only gateway 10.10.20.1
Since Zerotier doesn’t let me chose routing table, so I want to use only main table.
Those three routes are automatically enabled with ECMP. Sometimes the connection from 10.10.10.0/24 will route to 10.10.20.1 since the ECMP is like load balancing.
If its whole subnets, dont use mangling.
If its a few users, dont use mangling
Instead use routing rules ( and I wont use your example of lan subnets somehow being in the same structure as each WAN subnet ;-PPP )
NOTE: You should realize that LAN to LAN traffic will not occur as traffic is being forced out the specific route!!
Therefore if you require lets say LAN1 to be reachable by LAN2 and LAN3 add a routing rule ORDER COUNTS, before the other rules.
What is missing are your requirements for failover or not. These can be quite detailed and can included everything from NO failover to something like:
1 goes to 2 then 3
2 goes to 1 then 3
3 goes to 1 then 2
If however, they are all from the same ISP then no point, if the ISP is down all three are not available.
Note the ROUTING RULE paramer of action is current set to: action=lookup.
This means if the table is not available, then go to the main table and find a working route!!
If you didnt want the LAN subnets being routed out any other WAN, then change action to : action=lookup-only-in-table
I have tried with different routing tables and it works fine.
What I’m looking for is to route 10.0.10.0/24 using gateway 10.0.10.1 and 10.0.20.0/24 using gateway 10.0.20.1, all within the same routing table.
(suppose 10.10.10.0/24, 10.10.20.0/24, 10.10.30.0/24 are public IPs)
Maybe using connection marks or packet marks, but couldn’t find any tutorials.
I understand users or LAN subnets wanting to go out specific WANs, WAn1, Wan2, Wan3.
Wans1-3 may be from the same or different ISPs.
They may have different connection types, standard cable, wifi, PPPOE, or starlink for example.
So your explanation does nothing to provide any fidelity for understanding of what you actually have and what you actually need to do.
Its about user requirements not the config. The Config can be derived with a proper understanding of the user requirements.
I followed your example and it worked a treat for me. I have 2 WAN ports and got it working with only 2 default routes. I have 1 entry in main and one entry in the second routing table. Why do you have 6 entries?
Note my current setup is working well for me (thanks to you). I was just curious why you had 6 default routes instead of 3. However if you want to comment on my setup I’m open to any suggestions. I’m not an expert.
I have 3 WANs, my regular home intenet which uses static IP, LTE via a Mikrotik SXT and a wireguard interface that goes to NordVPN via the active WAN. I don’t have or want automatic failover, I switch to the SXT manually by disabling the default route when my main internet is out (I only plug in the SXT when necessary). That way the second default route takes over and starts pushing data to the SXT. For Nord, currently I just have anything that comes in from the LAN on vlan 9 going to Nord.
The reason for six rules ( actually only 3 default type routes using table main, the other three are routes that could pertain to mangling or routing rules.
In your case you only have two WANS, and really one WAN at a time. The VPN is not a WAN exactly but you force vlan9 out the tunnel vice the local working WAN.
What is nonsensical is the allowed IP entry of 10.x anything. The 0.0.0.0/0 covers all possible entries so the 10 whatever is redundant.
Also nonsensical is this input chain rule… your device is not receiving handshake its sending one out to Nord Server. /ip firewall filter add action=accept chain=input dst-port=13231 protocol=udp
+++++++++++++++++
Looking at routing rules. all good, you can shorten it up by apparently using this nifty rule that keeps local traffic flowing.
You dont need to disable the WAN1 main route at all. If the main route is not working, there will be no traffic, regardless.
When you plug in the SXT the router will find that route and start sending traffic.
The question is do you want the traffic to back out WAN1 when it comes back on line automatically???
In terms of sourcenat, the only one that I would change is probably the nord one. (remove the to address not required, simply state the out going interface as the wireguard one. /ip firewall nat
add action=src-nat chain=srcnat comment=“Internet via eth2” out-interface=ether2 to-addresses=x.x.x.x
add action=masquerade chain=srcnat comment=“Mikrotik 4G (port 4 of Netgear Switch)” out-interface=VLAN4 add action=masquerade chain=srcnat comment=“Nord” out-interface=Nord
Couple of other things would do is set the DNS server on the .9 network to the DNS that NORD should have given you?? add address=192.168.9.0/24 dns-server**=???** gateway=192.168.9.1
Also ensure you have the standard IP DNS setting of: /ip dns
set allow-remote-requests=yes servers=1.1.1.1,8.8.8.8
Finally, to ensure optimal NORD experience for various websites consider including a mangle rule. /ip firewall mangle
add action=change-mss chain=forward comment=“Clamp MSS to PMTU for Outgoing packets” new-mss=clamp-to-pmtu out-interface=Nord passthrough=yes protocol=tcp tcp-flags=syn
and if that doesnt work the alternative. /ip firewall mangle
add action=change-mss chain=forward new-mss=1380 out-interface=Nord protocol=tcp tcp-flags=syn tcp-mss=1381-65535
Thanks for the reply. The FW rule for wireguard is there for other peers not shown in the config I posted. With regards the 2 WANs, I need to do it manually because sometimes my primary internet is working but slow. My main internet is wireless NBN in Australia so can become unusable in really bad weather. Everything else you’ve said makes a lot of sense and I will got through them all. The nord info is useful, I went through MTU issues when trying without success to get Nord to function with IP Sec.
If you ever run into mTU issues with Nord wireguard, then on the MT device,
Try this first add action=change-mss chain=forward comment=“Clamp MSS to PMTU for Outgoing packets” new-mss=clamp-to-pmtu out-interface=Wireguard-Name passthrough=yes protocol=tcp tcp-flags=syn
IF no joy an alternate is this: add action=change-mss chain=forward new-mss=1380 out-interface=Wireguard-Name protocol=tcp tcp-flags=syn tcp-mss=1381-65535