Hi Guys,
Fisrt of all, Im new here so thank you so much for the read this (even if you don't have how to fix this).
I have 2 WAN links (ether1 & ether2) and 2 LAN ports (ether3 & ether4), LAN1 use WAN1 and LAN2 use WAN2, for making this possible I configure mark routing inside Mangle and the Routes. Also I have some vlans over LAN1 and another vlan over LAN2.
So today I have the following problem, I can't access between lan segments when I have the mark routing configured, its like all vlans are insolated by default.
I need to have access from vlan_ADMINS to all the other vlans.
Here is my /ip export
may/01/2017 17:30:29 by RouterOS 6.38.5
software id = DMJD-EMVC
/ip ipsec proposal
set [ find default=yes ] enc-algorithms=3des
/ip pool
add name=dhcp_pool1 ranges=10.0.255.2-10.0.255.254
add name=dhcp_pool2 ranges=10.0.1.2-10.0.1.254
add name=dhcp_pool3 ranges=10.0.2.10-10.0.2.254
/ip address
add address=10.0.0.1/24 comment="ETHER3-LAN1" interface=ether3-LAN1 network=10.0.0.0
add address=172.0.0.1/24 comment="ETHER4-LAN2" interface=ether4-LAN2 network=172.0.0.0
add address=190.1.19.2/29 comment=WAN interface=ether2-WAN2 network=190.1.19.0
add address=10.0.1.1/24 interface=vlan_HOME network=10.0.1.0
add address=10.0.2.1/24 interface=vlan_WIFI network=10.0.2.0
add address=10.0.255.1/24 interface=vlan_ADMINS network=10.0.255.0
add address=10.10.10.1/24 interface=vlan_SERVERS network=10.10.10.0
add address=172.10.2.1/24 interface=vlan_PRIME network=172.10.2.0
add address=190.1.19.3/29 interface=ether2-WAN2 network=190.1.19.0
add address=190.1.19.4/29 interface=ether2-WAN2 network=190.1.19.0
add address=190.1.19.5/29 interface=ether2-WAN2 network=190.1.19.0
add address=190.1.19.6/29 interface=ether2-WAN2 network=190.1.19.0
add address=172.10.3.1/24 interface=vlan_PRIME network=172.10.3.0
add address=172.10.4.1/24 interface=vlan_PRIME network=172.10.4.0
add address=172.10.5.1/24 interface=vlan_PRIME network=172.10.5.0
add address=172.10.6.1/24 interface=vlan_PRIME network=172.10.6.0
/ip dhcp-client
add comment=WAN1 default-route-distance=0 disabled=no interface=ether1-WAN1
/ip dhcp-server
add address-pool=dhcp_pool1 disabled=no interface=vlan_ADMINS lease-time=1d name=dhcp1
add address-pool=dhcp_pool2 disabled=no interface=vlan_HOME lease-time=1d name=dhcp2
add address-pool=dhcp_pool3 disabled=no interface=vlan_WIFI lease-time=1d name=dhcp3
/ip dhcp-server network
add address=10.0.1.0/24 dns-server=8.8.8.8,8.8.8.8 gateway=10.0.1.1
add address=10.0.2.0/24 dns-server=8.8.8.8,8.8.8.8 gateway=10.0.2.1
add address=10.0.255.0/24 dns-server=8.8.8.8,8.8.8.8 gateway=10.0.255.1
/ip dns
set servers=8.8.8.8,8.8.4.4
/ip firewall address-list
add address=10.0.0.0/24 list=Connected
add address=10.0.1.0/24 list=Connected
add address=10.0.2.0/24 list=Connected
add address=10.10.10.0/24 list=Connected
add address=10.0.255.0/24 list=Connected
add address=172.0.0.0/24 list=Connected
add address=172.10.2.0/24 list=Connected
add address=172.10.3.0/24 list=Connected
add address=172.10.4.0/24 list=Connected
add address=172.10.5.0/24 list=Connected
add address=172.10.6.0/24 list=Connected
/ip firewall filter
add action=accept chain=input dst-port=8291 protocol=tcp
add action=accept chain=input disabled=yes dst-port=80 protocol=tcp
add action=accept chain=input comment="TCP 1723 PPTP" dst-port=1723 protocol=tcp
add action=accept chain=input comment="Allow GRE protocol ID 47" protocol=gre
/ip firewall mangle
add action=mark-routing chain=prerouting new-routing-mark=mark_WAN1 passthrough=no src-address=10.0.0.0/24
add action=mark-routing chain=prerouting new-routing-mark=mark_WAN1 passthrough=no src-address=10.0.1.0/24
add action=mark-routing chain=prerouting new-routing-mark=mark_WAN1 passthrough=no src-address=10.0.2.0/24
add action=mark-routing chain=prerouting new-routing-mark=mark_WAN1 passthrough=no src-address=10.0.255.0/24
add action=mark-routing chain=prerouting new-routing-mark=mark_WAN1 passthrough=no src-address=10.10.10.0/24
add action=mark-routing chain=prerouting new-routing-mark=mark_WAN2 passthrough=no src-address=172.0.0.0/24
add action=mark-routing chain=prerouting new-routing-mark=mark_WAN2 passthrough=no src-address=172.10.2.0/24
add action=mark-routing chain=prerouting new-routing-mark=mark_WAN2 passthrough=no src-address=172.10.3.0/24
add action=mark-routing chain=prerouting new-routing-mark=mark_WAN2 passthrough=no src-address=172.10.4.0/24
add action=mark-routing chain=prerouting new-routing-mark=mark_WAN2 passthrough=no src-address=172.10.5.0/24
add action=mark-routing chain=prerouting new-routing-mark=mark_WAN2 passthrough=no src-address=172.10.6.0/24
/ip firewall nat
add action=masquerade chain=srcnat out-interface=ether1-WAN1 src-address=10.0.0.0/24
add action=masquerade chain=srcnat out-interface=ether1-WAN1 src-address=10.10.10.0/24
add action=masquerade chain=srcnat out-interface=ether1-WAN1 src-address=10.0.255.0/24
add action=masquerade chain=srcnat out-interface=ether1-WAN1 src-address=10.0.1.0/24
add action=masquerade chain=srcnat out-interface=ether1-WAN1 src-address=10.0.2.0/24
add action=masquerade chain=srcnat out-interface=ether2-WAN2 src-address=172.0.0.0/24
add action=masquerade chain=srcnat disabled=yes out-interface=ether2-WAN2 src-address=172.10.2.0/24
add action=masquerade chain=srcnat disabled=yes out-interface=ether2-WAN2 src-address=172.10.3.0/24
add action=masquerade chain=srcnat disabled=yes out-interface=ether2-WAN2 src-address=172.10.4.0/24
add action=masquerade chain=srcnat disabled=yes out-interface=ether2-WAN2 src-address=172.10.5.0/24
add action=masquerade chain=srcnat disabled=yes out-interface=ether2-WAN2 src-address=172.10.6.0/24
add action=netmap chain=dstnat dst-address=190.1.19.2 in-interface=ether2-WAN2 to-addresses=172.10.2.0/24
add action=netmap chain=dstnat dst-address=190.1.19.3 in-interface=ether2-WAN2 to-addresses=172.10.3.0/24
add action=netmap chain=dstnat dst-address=190.1.19.4 in-interface=ether2-WAN2 to-addresses=172.10.4.0/24
add action=netmap chain=dstnat dst-address=190.1.19.5 in-interface=ether2-WAN2 to-addresses=172.10.5.0/24
add action=netmap chain=dstnat dst-address=190.1.19.6 in-interface=ether2-WAN2 to-addresses=172.10.6.0/24
add action=netmap chain=srcnat out-interface=ether2-WAN2 src-address=172.10.2.0/24 to-addresses=190.1.19.2
add action=netmap chain=srcnat out-interface=ether2-WAN2 src-address=172.10.3.0/24 to-addresses=190.1.19.3
add action=netmap chain=srcnat out-interface=ether2-WAN2 src-address=172.10.4.0/24 to-addresses=190.1.19.4
add action=netmap chain=srcnat out-interface=ether2-WAN2 src-address=172.10.5.0/24 to-addresses=190.1.19.5
add action=netmap chain=srcnat out-interface=ether2-WAN2 src-address=172.10.6.0/24 to-addresses=190.1.19.6
/ip ipsec peer
add address=0.0.0.0/0 dpd-interval=2s enc-algorithm=3des exchange-mode=main-l2tp generate-policy=port-override secret=453146
/ip route
add distance=1 gateway=190.2.80.1 routing-mark=mark_WAN1
add distance=1 gateway=190.1.19.1 routing-mark=mark_WAN2
add distance=1 gateway=190.1.19.1
add distance=1 gateway=190.2.80.1
/ip route rule
add interface=ether1-WAN1 routing-mark=mark_WAN1 src-address=10.0.0.0/24 table=mark_WAN1
add interface=ether2-WAN2 routing-mark=mark_WAN2 src-address=172.10.2.0/24 table=mark_WAN2
add interface=ether2-WAN2 routing-mark=mark_WAN2 src-address=172.10.3.0/24 table=mark_WAN2
add interface=ether1-WAN1 routing-mark=mark_WAN1 src-address=10.0.1.0/24 table=mark_WAN1
add interface=ether2-WAN2 routing-mark=mark_WAN2 src-address=172.0.0.0/24 table=mark_WAN2
add interface=ether1-WAN1 routing-mark=mark_WAN1 src-address=10.0.2.0/24 table=mark_WAN1
add interface=ether1-WAN1 routing-mark=mark_WAN1 src-address=10.0.255.0/24 table=mark_WAN1
add interface=ether1-WAN1 routing-mark=mark_WAN1 src-address=10.10.10.0/24 table=mark_WAN1
add interface=ether2-WAN2 routing-mark=mark_WAN2 src-address=172.10.4.0/24 table=mark_WAN2
add interface=ether2-WAN2 routing-mark=mark_WAN2 src-address=172.10.5.0/24 table=mark_WAN2
add interface=ether2-WAN2 routing-mark=mark_WAN2 src-address=172.10.6.0/24 table=mark_WAN2
/ip service
set telnet address=10.0.0.0/8,172.0.0.0/8
set ssh address=10.0.0.0/8,172.0.0.0/8I will really appreciate if someone know how to fix this.
Thanks!