We operate a microwave network covering a wide area. The network has internet connectivity at 2 primary points of presences and full internet routing across that network. A few sites have a local ISP connectioin of some sort with static addresses but no ability to advertise routes so not suitable as an egress link for the network, but the connection makes a useful management interface to gain access in the event of link outages. The ISP connection has a default route as does the microwave network
The question for this forum is what should our configuration be to allow remote connections via the local ISP interface such that connections that arrive on that interface are isolated to that interface and will not try to traverse the microwave network, and conversely, microwave traffic destined for the internet will not try to egress via the ISP connection.
On RouterOS 6, we used this configuration:
/ip route vrf add routing-mark=OOB interfaces=<OOB interface>
/ip address add interface=<OOB interface> address=<OOB IP>
/ip route add routing-mark=OOB gateway=<OOB default gateway>
/ip firewall nat action=masquerade chain=srcnat out-interface=<OOB interface>
/ip firewall mangle
add action=mark-routing chain=output new-routing-mark=OOB src-address=<OOB IP>
On RouterOS 7, I believe that we need something like:
/route table add name=OOB fib
/ip address add interface=<OOB interface> address=<OOB IP>
/ip route add routing-table=OOB dst-address=0.0.0.0/0 gateway=<OOB default gateway>%<OOB interface>
/ip firewall nat action=masquerade chain=srcnat out-interface=<OOB interface>
/ip firewall mangle
add action=mark-connection chain=input in-interface=<OOB interface> new-connection-mark=OOB
add action=mark-routing chain=output routing" new-routing-mark=OOB src-address=<OOP IP>
There is some question about whether we need to do more to use the mark, but the approach used in ROS6 is no longer applicable. Is use of the OOB routing table implied in some way?