I have been fighting this on and off for a couple of days, and I can almost get it functioning, but I run into issues. I have my main ISP feed WAN1 on eth 1, and starlink WAN2 on eth 2 as a fail over in the event that I lose my main connection. What I want to happen is if I lose WAN1, only allow a handfull of devices out WAN 2, then swap back once WAN 1 comes back up. The issue I keep running into is the hand full of devices part. The failover works, but then every device on the network has internet access. I have tried a second routing table, some tutorials talk about adding a routing rule, but the routing rules dont give the options that they are asking for, some tutorials just huge holes in them, so key pieces dont get filled in… Is there a good instruction sheet out there that would guide me through this? I am going to set things up again, and if it still doesn’t work, I will drop my config here and see if you guys can help me pick apart what I’m missing.
When you say a handful, how many exactly?
Is it possible that you could put these devices into their own subnet?
Is it possible these devices could use their own WLAN (ssid)?
I ask, to see if there is an easy way to accomplish your goals.
Otherwise through mangling, one could organize by address list, a group of devices and then apply the appropriate config.
An export will help us see what you are dealing with.
/export file=anynameyouwish (minus router serial number, any public WANIP information, keys, dhcp lease list)
Conceptually you need to be able to "identify" exactly the devices that are allowed to go through WAN2.
Routing rules (policy routing) is the easiest approach, but the kind of matcher/selectors is limited:
If they are a handful, you can use a policy for each address using " src-address" as the matcher, you don't really need a second routing table, you can simply drop packets coming from the source addresses covered by the rules.
You would need to make sure that a same (banned from using WAN2) has always the same IP.
Otherwise - this depends from your network topology - you could use the "interface" selector (that really means in-interface) if all the "banned" device are connected through a same interface/port of the router.
But it also depends on the kind of failover you are implementing, you could use (plainer) recursive routing but you would need something else (like a script running periodically) to enable or disable the policy rules, or netwatch, this latter might be a little more complex but the "down" script could enable the routing rules and the "up" script disable it.
Anav As of right now, maybe 5-6 devices. at some point once this is working properly, there will be more, maybe 50 devices. All devices are on hard wired ethernet, and share the same VLAN . I am working on getting the system configured again to get as close to working as I can get it, then I will export the config.
Jaciaz I have tried, he policy routing method, I have tried Mangle, there is just something that was missing. all devices have addresses, so tracking them is pretty straight forward. I will get an export posted as soon as I get it. Im hoping I am close and just missing one little piece.
All good information, with that number in mind the only real option is policy routing and mangling.
Showing us the config as requested, will go a long way to figuring out perhaps where you need to modify the config. I am loathe to start guessing.
The other question I have is regarding any other special needs?
Do you have any router services in play (wireguard, port forwarding?)
Awaiting config to crack the nut!
Here is config. No other special needs at this point. This project will grow a bit, but I need to wrap my head around what’s working and not working first. I just rebuilt the setup on my test router, and it seems close, other than now, the computer in my address list to be allowed to use the backup WAN 2 now doesn’t have DNS. I can ping 8.8.8.8, but I can’t load any pages. I think I’m making progress and making it worse at the same time. I will be honest, every different approach has different ip-routes, and I was kind of lost on this one, but I followed the instructions hoping for the best. I’m positive I have an issue in those routes because they did not look correct.
# 2026-03-24 10:03:36 by RouterOS 7.22
software id = TNH7-3XDV
model = RB3011UiAS
serial number =
/interface bridge
add admin-mac=B8:69:F4:0A:F2:DB auto-mac=no comment=defconf name=bridge
/interface list
add comment=defconf name=WAN
add comment=defconf name=LAN
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
/ip pool
add name=default-dhcp ranges=192.168.88.10-192.168.88.254
/ip dhcp-server
add address-pool=default-dhcp interface=bridge name=defconf
/routing table
add disabled=no fib name=To_Backup
/disk settings
set auto-media-interface=bridge auto-media-sharing=yes auto-smb-sharing=yes
/interface bridge port
add bridge=bridge comment=defconf interface=ether3
add bridge=bridge comment=defconf interface=ether4
add bridge=bridge comment=defconf interface=ether5
add bridge=bridge comment=defconf interface=ether6
add bridge=bridge comment=defconf interface=ether7
add bridge=bridge comment=defconf interface=ether8
add bridge=bridge comment=defconf interface=ether9
add bridge=bridge comment=defconf interface=ether10
add bridge=bridge comment=defconf interface=sfp1
/ip neighbor discovery-settings
set discover-interface-list=LAN
/interface list member
add comment=defconf interface=bridge list=LAN
add comment=defconf interface=ether1 list=WAN
add interface=ether2 list=WAN
/ip address
add address=192.168.88.1/24 comment=defconf interface=bridge network=
192.168.88.0
/ip dhcp-client
add comment=defconf interface=ether1 name=client1
add default-route-distance=2 default-route-tables=main interface=ether2 name=
"WAN 2"
/ip dhcp-server lease
add address=192.168.88.2 client-id=1:44:a9:2c:50:a1:52 mac-address=
44:A9:2C:50:A1:52 server=defconf
add address=192.168.88.3 client-id=1:60:6d:3c:ec:4d:b mac-address=
60:6D:3C:EC:4D:0B server=defconf
/ip dhcp-server network
add address=192.168.88.0/24 comment=defconf dns-server=192.168.88.1 gateway=
192.168.88.1
/ip dns
set allow-remote-requests=yes
/ip dns static
add address=192.168.88.1 comment=defconf name=router.lan type=A
/ip firewall address-list
add address=192.168.88.2 list=Alowed_On_Backup
/ip firewall filter
add action=accept chain=input comment=
"defconf: accept established,related,untracked" connection-state=
established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=
invalid
add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp
add action=accept chain=input comment=
"defconf: accept to local loopback (for CAPsMAN)" dst-address=127.0.0.1
in-interface=lo src-address=127.0.0.1
add action=drop chain=input comment="defconf: drop all not coming from LAN"
in-interface-list=!LAN
add action=accept chain=forward comment="defconf: accept in ipsec policy"
ipsec-policy=in,ipsec
add action=accept chain=forward comment="defconf: accept out ipsec policy"
ipsec-policy=out,ipsec
add action=fasttrack-connection chain=forward comment="defconf: fasttrack"
connection-state=established,related disabled=yes
add action=accept chain=forward comment=
"defconf: accept established,related, untracked" connection-state=
established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid"
connection-state=invalid
add action=drop chain=forward comment=
"defconf: drop all from WAN not DSTNATed" connection-nat-state=!dstnat
in-interface-list=WAN
/ip firewall mangle
add action=mark-routing chain=prerouting new-routing-mark=To_Backup
passthrough=no src-address-list=Alowed_On_Backup
/ip firewall nat
add action=masquerade chain=srcnat comment="defconf: masquerade"
ipsec-policy=out,none out-interface-list=WAN
add action=masquerade chain=srcnat out-interface=ether1
add action=masquerade chain=srcnat out-interface=ether2
/ip route
add comment="Host Monitoring" disabled=no distance=1 dst-address=8.8.8.8/32
gateway=192.168.10.1 routing-table=main
add comment="Secondary Host Monitoring" disabled=no distance=1 dst-address=
1.1.1.1/32 gateway=192.168.1.1 routing-table=main
add check-gateway=ping comment="Primary WAN" disabled=no distance=1
dst-address=0.0.0.0/0 gateway=8.8.8.8 routing-table=main target-scope=11
add check-gateway=ping comment="Backup WAN" disabled=no distance=2
dst-address=0.0.0.0/0 gateway=1.1.1.1 routing-table=To_Backup
target-scope=11
add disabled=no distance=2 dst-address=0.0.0.0/0 gateway=192.168.1.1
routing-table=To_Backup
/ipv6 firewall address-list
add address=::/128 comment="defconf: unspecified address" list=bad_ipv6
add address=::1/128 comment="defconf: lo" list=bad_ipv6
add address=fec0::/10 comment="defconf: site-local" list=bad_ipv6
add address=::ffff:0.0.0.0/96 comment="defconf: ipv4-mapped" list=bad_ipv6
add address=::/96 comment="defconf: ipv4 compat" list=bad_ipv6
add address=100::/64 comment="defconf: discard only " list=bad_ipv6
add address=2001:db8::/32 comment="defconf: documentation" list=bad_ipv6
add address=2001:10::/28 comment="defconf: ORCHID" list=bad_ipv6
add address=3ffe::/16 comment="defconf: 6bone" list=bad_ipv6
/ipv6 firewall filter
add action=accept chain=input comment=
"defconf: accept established,related,untracked" connection-state=
established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=
invalid
add action=accept chain=input comment="defconf: accept ICMPv6" protocol=
icmpv6
add action=accept chain=input comment="defconf: accept UDP traceroute"
dst-port=33434-33534 protocol=udp
add action=accept chain=input comment=
"defconf: accept DHCPv6-Client prefix delegation." dst-port=546 protocol=
udp src-address=fe80::/10
add action=accept chain=input comment="defconf: accept IKE" dst-port=500,4500
protocol=udp
add action=accept chain=input comment="defconf: accept ipsec AH" protocol=
ipsec-ah
add action=accept chain=input comment="defconf: accept ipsec ESP" protocol=
ipsec-esp
add action=accept chain=input comment=
"defconf: accept all that matches ipsec policy" ipsec-policy=in,ipsec
add action=drop chain=input comment=
"defconf: drop everything else not coming from LAN" in-interface-list=
!LAN
add action=fasttrack-connection chain=forward comment="defconf: fasttrack6"
connection-state=established,related
add action=accept chain=forward comment=
"defconf: accept established,related,untracked" connection-state=
established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid"
connection-state=invalid
add action=drop chain=forward comment=
"defconf: drop packets with bad src ipv6" src-address-list=bad_ipv6
add action=drop chain=forward comment=
"defconf: drop packets with bad dst ipv6" dst-address-list=bad_ipv6
add action=drop chain=forward comment="defconf: rfc4890 drop hop-limit=1"
hop-limit=equal:1 protocol=icmpv6
add action=accept chain=forward comment="defconf: accept ICMPv6" protocol=
icmpv6
add action=accept chain=forward comment="defconf: accept HIP" protocol=139
add action=accept chain=forward comment="defconf: accept IKE" dst-port=
500,4500 protocol=udp
add action=accept chain=forward comment="defconf: accept ipsec AH" protocol=
ipsec-ah
add action=accept chain=forward comment="defconf: accept ipsec ESP" protocol=
ipsec-esp
add action=accept chain=forward comment=
"defconf: accept all that matches ipsec policy" ipsec-policy=in,ipsec
add action=drop chain=forward comment=
"defconf: drop everything else not coming from LAN" in-interface-list=
!LAN
/system clock
set time-zone-name=America/Denver
/system identity
set name="Dual WAN MikroTik"
/tool mac-server
set allowed-interface-list=LAN
/tool mac-server mac-winbox
set allowed-interface-list=LAN
One could also use (mis-use or ab-use) kid control.
This allows to use pause when Wan2 is running and resume when Wan1 is back, still it is a "per device" (but MAC based, the IP is calculated from ARP table) kind of matcher.
What kid control actually does:
is to create a Dynamic reject rule in the firewall, so the same could be done manually/by script.
But - instead of the single src-address - one could then use a firewall address-list.
A couple random notes (unrelated to the limiting of devices):
- you have correctly categorized ether1 and ether2 as WAN so you don't need additional "single interface" masquerade rules.
- you are pinging gateway of your second WAN, which serves nothing, see note [1] in the spreadsheet here:
Simple recursive failover for bears of little brain
I did have the same thought on the second gateway ping, but wanted to follow the instructions just to rule things out. I did find it odd that several configurations I saw did utilize the second gateway ping.
I will remove the 2 masquerade rules. Thanks
No needs for 2nd routing table or routing rules. Just add plain firewall filter drop rules!
-
Add address list CRITICAL_DEVICES containing IP addresses that should still have access during failover.
-
Add drop rule:
/ip firewall filter add chain=forward action=drop out-interface=ether2 src-address-list=!CRITICAL_DEVICES
Yep, I believe it is something written in the example(s) without much thought to show how with recursive you can easily have several different WAN's connected and in "successive" failover, but for only two WAN's it is unneeded.
Ok, so, using recursive, the failover is "automatic" but in itself it only makes the Primary route (WAN1) not-active, and thus the secondary (with higher distance) becomes Active.
So you need some mechanism that checks which route is active and prevents (with this or that method), this could be a separate netwatch set of scripts.
Since you are still configuring the router, you could try changing the failover method from recursive to netwatch, so the same "trigger" will be able to prioritize the routes and disable/limit the access to the list of devices.
This is the simplest method:
Simpler Failover for two Gateways I found working - #19 by jaclaz
That seems way too easy. I will look into this. Thanks
I will play with this. I think I need to wipe and restart, but I have the steps down to get the second WAN up and running, so the process isn’t bad. By the time I am done with this, I will have then entre process memorized (That’s how I learned Linux, just keep issuing commands until it breaks, roll back and start over)
@CGGXANNX
Good catch! 
This is much simpler and no need to enable/disable anything.
Side/philosophical question:
kid control uses "reject" (as opposed to "drop"), maybe it is more "appropriate"?
Yes, right! Because we are dealing with LAN devices that should be denied access only to save cost, not to prevent any kind of hacking, we should not silently drop packets (which cause timeouts) but should use action=reject instead!
Good.
And - since we are going into details - does changing the "reject-with" default to (say) icmp-admin-prohibited make sense?
| Property | Description |
|---|---|
| reject-with (icmp-no-route | icmp-admin-prohibited | icmp-not-neighbour | icmp-address-unreachable | icmp-port-unreachable | tcp-reset | icmp-err-src-routing-header | icmp-headers-too-long ; Default: icmp-no-route) | Specifies ICMP error to be sent back if the packet is rejected. Applicable if action=reject |
| icmp-no-route: sends ICMP address no-route message. ICMP type 1, code 0 | |
| icmp-admin-prohibited: sends ICMP address prohibited message. ICMP type 1, code 1 | |
| icmp-not-neighbour: sends ICMP address not-member message. ICMP type 1, code 2 | |
| icmp-address-unreachable: sends ICMP address unreachable message. ICMP type 1, code 3 | |
| icmp-port-unreachable: sends ICMP port unreachable message. ICMP type 1, code 4 | |
| tcp-reset: sends ICMP resetting a TCP connection. ICMP type 1, code 6 | |
| icmp-err-src-routing-header: sends ICMP Error in Source Routing Header message. ICMP type 1, code 7 | |
| icmp-headers-too-long: sends ICMP Headers too long message. ICMP type 1, code 8 |
CGGXANNX Your idea was just stupid simple, straight forward, and after fighting this for days, it just worked. I think I went from a reset router to that functioning in under 5 minutes. I still need setup the netwatch as jaclaz mentioned, because I believe WAN 2 is causing a little bit of speed issue even when it isn’t active, but one major hurdle has been cleared. Thanks everyone for chiming in, I will update the post as I get other pieces in place today.
Yes please, very interested in looking at the finished working config using the kid control functionality.
Here it is, fully functioning. One thing that I had to go back and redo is when setting up WAN 1, if using DHCP, uncheck create default route in ip→dhcp client (Wan 1) and create the route manually so that you can add the comment “primary” because Netwatch looks for that comment . I’m sure there are several other ways to handle that, and I will play with it now, but for now, it is working. I feel like this is maybe the easiest way to do this, thanks to everyone’s input. I am far from a networking pro, but I know my way around the Mikrotik gear pretty well, and I think this entire process took under 15 minutes. I welcome any constructive feedback. And again, Thanks to everyone who helped out.
#2026-03-24 14:08:07 by RouterOS 7.22
#software id = TNH7-3XDV
#model = RB3011UiAS
#serial number =
/interface bridge
add admin-mac=B8:69:F4:0A:F2:DB auto-mac=no comment=defconf name=bridge
/interface list
add comment=defconf name=WAN
add comment=defconf name=LAN
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
/ip pool
add name=default-dhcp ranges=192.168.88.10-192.168.88.254
/ip dhcp-server
add address-pool=default-dhcp interface=bridge name=defconf
/disk settings
set auto-media-interface=bridge auto-media-sharing=yes auto-smb-sharing=yes
/interface bridge port
add bridge=bridge comment=defconf interface=ether3
add bridge=bridge comment=defconf interface=ether4
add bridge=bridge comment=defconf interface=ether5
add bridge=bridge comment=defconf interface=ether6
add bridge=bridge comment=defconf interface=ether7
add bridge=bridge comment=defconf interface=ether8
add bridge=bridge comment=defconf interface=ether9
add bridge=bridge comment=defconf interface=ether10
add bridge=bridge comment=defconf interface=sfp1
/ip neighbor discovery-settings
set discover-interface-list=LAN
/interface list member
add comment=defconf interface=bridge list=LAN
add comment=defconf interface=ether1 list=WAN
add interface=ether2 list=WAN
/ip address
add address=192.168.88.1/24 comment=defconf interface=bridge network=
192.168.88.0
/ip dhcp-client
add add-default-route=no comment=primary interface=ether1 name=client1
add default-route-distance=2 default-route-tables=main interface=ether2 name=
client2
/ip dhcp-server lease
add address=192.168.88.2 client-id=1:44:a9:2c:50:a1:52 mac-address=
44:A9:2C:50:A1:52 server=defconf
/ip dhcp-server network
add address=192.168.88.0/24 comment=defconf dns-server=192.168.88.1 gateway=
192.168.88.1
/ip dns
set allow-remote-requests=yes
/ip dns static
add address=192.168.88.1 comment=defconf name=router.lan type=A
/ip firewall address-list
add address=192.168.88.2 list=WAN2_Allowed
/ip firewall filter
add action=accept chain=input comment=
"defconf: accept established,related,untracked" connection-state=
established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=
invalid
add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp
add action=accept chain=input comment=
"defconf: accept to local loopback (for CAPsMAN)" dst-address=127.0.0.1
in-interface=lo src-address=127.0.0.1
add action=drop chain=input comment="defconf: drop all not coming from LAN"
in-interface-list=!LAN
add action=accept chain=forward comment="defconf: accept in ipsec policy"
ipsec-policy=in,ipsec
add action=accept chain=forward comment="defconf: accept out ipsec policy"
ipsec-policy=out,ipsec
add action=fasttrack-connection chain=forward comment="defconf: fasttrack"
connection-state=established,related
add action=accept chain=forward comment=
"defconf: accept established,related, untracked" connection-state=
established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid"
connection-state=invalid
add action=drop chain=forward comment=
"defconf: drop all from WAN not DSTNATed" connection-nat-state=!dstnat
in-interface-list=WAN
add action=reject chain=forward out-interface=ether2 reject-with=
icmp-network-unreachable src-address-list=!WAN2_Allowed
/ip firewall nat
add action=masquerade chain=srcnat comment="defconf: masquerade"
ipsec-policy=out,none out-interface-list=WAN
/ip route
add comment=primary disabled=no distance=1 dst-address=0.0.0.0/0 gateway=
192.168.10.1 routing-table=main
/ipv6 firewall address-list
add address=::/128 comment="defconf: unspecified address" list=bad_ipv6
add address=::1/128 comment="defconf: lo" list=bad_ipv6
add address=fec0::/10 comment="defconf: site-local" list=bad_ipv6
add address=::ffff:0.0.0.0/96 comment="defconf: ipv4-mapped" list=bad_ipv6
add address=::/96 comment="defconf: ipv4 compat" list=bad_ipv6
add address=100::/64 comment="defconf: discard only " list=bad_ipv6
add address=2001:db8::/32 comment="defconf: documentation" list=bad_ipv6
add address=2001:10::/28 comment="defconf: ORCHID" list=bad_ipv6
add address=3ffe::/16 comment="defconf: 6bone" list=bad_ipv6
/ipv6 firewall filter
add action=accept chain=input comment=
"defconf: accept established,related,untracked" connection-state=
established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=
invalid
add action=accept chain=input comment="defconf: accept ICMPv6" protocol=
icmpv6
add action=accept chain=input comment="defconf: accept UDP traceroute"
dst-port=33434-33534 protocol=udp
add action=accept chain=input comment=
"defconf: accept DHCPv6-Client prefix delegation." dst-port=546 protocol=
udp src-address=fe80::/10
add action=accept chain=input comment="defconf: accept IKE" dst-port=500,4500
protocol=udp
add action=accept chain=input comment="defconf: accept ipsec AH" protocol=
ipsec-ah
add action=accept chain=input comment="defconf: accept ipsec ESP" protocol=
ipsec-esp
add action=accept chain=input comment=
"defconf: accept all that matches ipsec policy" ipsec-policy=in,ipsec
add action=drop chain=input comment=
"defconf: drop everything else not coming from LAN" in-interface-list=
!LAN
add action=fasttrack-connection chain=forward comment="defconf: fasttrack6"
connection-state=established,related
add action=accept chain=forward comment=
"defconf: accept established,related,untracked" connection-state=
established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid"
connection-state=invalid
add action=drop chain=forward comment=
"defconf: drop packets with bad src ipv6" src-address-list=bad_ipv6
add action=drop chain=forward comment=
"defconf: drop packets with bad dst ipv6" dst-address-list=bad_ipv6
add action=drop chain=forward comment="defconf: rfc4890 drop hop-limit=1"
hop-limit=equal:1 protocol=icmpv6
add action=accept chain=forward comment="defconf: accept ICMPv6" protocol=
icmpv6
add action=accept chain=forward comment="defconf: accept HIP" protocol=139
add action=accept chain=forward comment="defconf: accept IKE" dst-port=
500,4500 protocol=udp
add action=accept chain=forward comment="defconf: accept ipsec AH" protocol=
ipsec-ah
add action=accept chain=forward comment="defconf: accept ipsec ESP" protocol=
ipsec-esp
add action=accept chain=forward comment=
"defconf: accept all that matches ipsec policy" ipsec-policy=in,ipsec
add action=drop chain=forward comment=
"defconf: drop everything else not coming from LAN" in-interface-list=
!LAN
/system clock
set time-zone-name=America/Denver
/system identity
set name="Dual WAN MikroTik"
/tool mac-server
set allowed-interface-list=LAN
/tool mac-server mac-winbox
set allowed-interface-list=LAN
/tool netwatch
add disabled=no down-script="/ip route disable [find comment="primary"]
\n/ip firewall connection remove [find]" host=8.8.8.8 test-script=""
timeout=1s type=simple up-script="/ip route enable [find comment="primary
"]
\n/ip firewall connection remove [find]"
??? Don’t see any kid control settings for example??