Need help - Configuration Sample for 2 Internet WAN with 2 SUBNET (one for each)

RouterOS General
1

Hi ,

I have two diferent internal networks (lan1 - 192.168.2.0/24 and lan2 - 192.168.3.0/24) and also two Internet Links (WAN1/WAN2)

I want to route all users from LAN1 to WAN1 and LAN2 to WAN2.

I used the mangle pre-routing to mark packets:
chain=prerouting action=mark-routing new-routing-mark=to_wan1 passthrough=no src-address=192.168.2.0/24 log=no log-prefix=“”
chain=prerouting action=mark-routing new-routing-mark=to_wan2 passthrough=no src-address=192.168.3.0/24 log=no log-prefix=“”

Then routes to match the routing mark:
0.0.0.0/0 wan1 mark - to_wan1
0.0.0.0/0 wan2 mark - to_wan2

With this configuration both subnets can browse to internet, without no problems, but VPN coming through WAN1 not Works.
Adding:
0.0.0.0/0 wan1 (with no mark)

VPN Works, but browsing to internet using subnet2 stops.

Someone can help ?

2

Mark new incoming connections with connection marks (different for each WAN) and then mark routing for outgoing traffic of those connections to use the right gateway.

3

I created the marks, but still with no sucess.

SETUP:
LAN1: 192.168.2.0/24 IP 192.168.2.1 PORT ETH1
LAN2: 10.0.0.0/24 IP 10.0.0.1 ETH2 BRIDGE WITH PORTS 6,7,8
WAN1: 192.168.5.0/24 IP 192.168.5.2 PORT ETH4
WAN2: 192.168.0.0/24 IP 192.168.0.2 PORT ETH5

Setup that I want: Users from LAN1 should Always use WAN1 , and users from LAN2 should Always use WAN2. (Someone have one exaclty same setup, for just copy and paste)?

If I remove the default route without the mark, it Works well, but in other hand, I cannot use my PPTP vpn anymore.

Another workaround is start a packet sniffing in Tools, doing this, even with default route created, the scenario Works.

  1. What reason can explain after start a packet sniffing, make the firewall Works?
  2. Using bridge between ports 2,6,7,8 can cause this issue ? (mix of switch1/switch2)
  3. Any recommended test ? Or anyone with similar scenario to share the config ?


    My Config:

LAN1 -> WAN1

chain=prerouting action=mark-connection new-connection-mark=WAN1
passthrough=yes src-address=192.168.2.0/24 dst-address=!192.168.2.0/24
log=no log-prefix=""

LAN1 -> WAN1

chain=prerouting action=mark-routing new-routing-mark=WAN1 passthrough=no
src-address=192.168.2.0/24 dst-address=!192.168.2.0/24 log=no
log-prefix=""
#LAN2 -> WAN2

chain=prerouting action=mark-connection new-connection-mark=WAN2
passthrough=yes src-address=10.0.0.0/22 dst-address=!10.0.0.0/22
in-interface=WIFIPREDIO log=no log-prefix=""

#LAN2 -> WAN2
chain=prerouting action=mark-routing new-routing-mark=WAN2 passthrough=no
src-address=10.0.0.0/22 dst-address=!10.0.0.0/22 in-interface=WIFIPREDIO
log=no log-prefix=""

#LAN1 ->WAN1
chain=input action=mark-connection new-connection-mark=WAN1 passthrough=yes
connection-mark=no-mark in-interface=ether4-VIVO log=no log-prefix=""

#LAN2 ->WAN2
chain=input action=mark-connection new-connection-mark=WAN2 passthrough=yes
connection-mark=no-mark in-interface=ether5-NET log=no log-prefix=""

#LAN 2 - > WAN2
chain=prerouting action=mark-routing new-routing-mark=wifiadm
passthrough=no dst-address-type="" connection-mark=WAN2
in-interface=ether5-NET log=no log-prefix=""
#LAN1 -> WAN1
chain=prerouting action=mark-routing new-routing-mark=admnet passthrough=n>
dst-address-type="" connection-mark=WAN1 in-interface=ether4-VIVO log=no
log-prefix=""

LAN 1 -> WAN1

chain=output action=mark-routing new-routing-mark=WAN1 passthrough=no
connection-mark=WAN1 log=no log-prefix=""

#LAN 2 -> WAN2
chain=output action=mark-routing new-routing-mark=WAN2 passthrough=no
connection-mark=WAN2 log=no log-prefix=""

4

It reminds me of something:
Sniffer cures packetloss [fasttrack problem?]

5

Man you are rock !!!

/interface bridge settings> set allow-fast-path=no (fix the issue) !!!