Hello guys recently I got a new mikrotik at home and stuck on the most basic setup. Even cant believe that its possible probably I do something fundamentally wrong.
Here is some info about the setup:
Model 2011UiAS-2HnD
RouterOS v6.40.2 (stable)
2 WAN (one over pppoe) and one NAT network.
/ip address print
Flags: X - disabled, I - invalid, D - dynamic
# ADDRESS NETWORK INTERFACE
0 ;;; defconf
192.168.88.1/24 192.168.88.0 ether2-master
1 84.54.xxx.249/29 84.54.xxx.248 WAN2-pppoe
2 84.54.xxx.251/29 84.54.xxx.248 WAN2-pppoe
3 84.54.xxx.252/29 84.54.xxx.248 WAN2-pppoe
4 84.54.xxx.253/29 84.54.xxx.248 WAN2-pppoe
5 84.54.xxx.250/29 84.54.xxx.248 WAN2-pppoe
6 D 84.54.xxx.136/32 84.54.xxx.1 WAN2-pppoe
7 D 84.242.xxx.127/21 84.242.168.0 WAN1
/ip firewall nat print
Flags: X - disabled, I - invalid, D - dynamic
0 chain=srcnat action=masquerade src-address=192.168.88.0/24 out-interface=WAN2-pppoe log=no log-prefix=""
1 chain=srcnat action=masquerade src-address=192.168.88.0/24 out-interface=WAN1 log=no log-prefix=""
2 chain=srcnat action=src-nat to-addresses=84.54.xxx.250 src-address=192.168.88.37 log=yes log-prefix="SRCNAT"
3 chain=dstnat action=dst-nat to-addresses=192.168.88.37 protocol=tcp dst-address=84.54.xxx.250 log=no log-prefix="DNAT"
/ip route print
Flags: X - disabled, A - active, D - dynamic, C - connect, S - static, r - rip, b - bgp, o - ospf, m - mme, B - blackhole, U - unreachable, P - prohibit
# DST-ADDRESS PREF-SRC GATEWAY DISTANCE
0 ADS 0.0.0.0/0 84.242.xxx.1 1
1 DS 0.0.0.0/0 WAN2-pppoe 2
2 ADC 84.54.xxx.1/32 84.54.xxx.136 WAN2-pppoe 0
3 ADC 84.54.xxx.248/29 84.54.xxx.251 WAN2-pppoe 0
4 ADC 84.242.xxx.0/21 84.242.xxx.127 WAN1 0
5 ADC 192.168.88.0/24 192.168.88.1 bridge 0
The issue actually is that I cant create src + dst NAT. basicly i like 84.54.xxx.250 to be reachable from outside.
With that configuration seems that traffic comes via WAN2 but for some reason is traing to go out via WAN1.
To solve that i tried to add routing mark with mangle
/ip firewall mangle print
Flags: X - disabled, I - invalid, D - dynamic
0 D ;;; special dummy rule to show fasttrack counters
chain=prerouting action=passthrough
1 D ;;; special dummy rule to show fasttrack counters
chain=forward action=passthrough
2 D ;;; special dummy rule to show fasttrack counters
chain=postrouting action=passthrough
3 chain=forward action=mark-connection new-connection-mark=mtel_conn passthrough=yes connection-state=new in-interface=WAN1 log=no log-prefix=""
4 chain=forward action=mark-connection new-connection-mark=oc_conn passthrough=yes connection-state=new in-interface=WAN2-pppoe log=no log-prefix=""
5 chain=input action=mark-connection new-connection-mark=mtel_conn passthrough=yes in-interface=WAN1 log=no log-prefix=""
6 chain=input action=mark-connection new-connection-mark=oc_conn passthrough=yes in-interface=WAN2-pppoe log=no log-prefix=""
7 chain=output action=mark-routing new-routing-mark=to_mtel passthrough=yes connection-mark=mtel_conn log=no log-prefix=""
8 chain=output action=mark-routing new-routing-mark=to_oc passthrough=yes connection-mark=oc_conn log=no log-prefix=""
9 chain=prerouting action=accept dst-address=84.242.xxx.0/21 in-interface=bridge log=no log-prefix=""
10 chain=prerouting action=accept dst-address=84.54.xxx.248/29 in-interface=bridge log=no log-prefix=""
11 chain=prerouting action=mark-connection new-connection-mark=mtel_conn passthrough=yes dst-address-type=!local connection-mark=no-mark in-interface=bridge log=no log-prefix=""
12 chain=prerouting action=mark-connection new-connection-mark=oc_conn passthrough=yes dst-address-type=!local connection-mark=no-mark in-interface=bridge log=no log-prefix=""
13 chain=prerouting action=mark-routing new-routing-mark=to_mtel passthrough=yes connection-mark=mtel_conn in-interface=bridge log=no log-prefix=""
14 chain=prerouting action=mark-routing new-routing-mark=to_oc passthrough=yes connection-mark=oc_conn in-interface=bridge log=no log-prefix=""
And I add routing roles with routing marks
No success either so I come to the conclusion that I am doing something fundamentally wrong but have no idea what is it.