Hi everyone,
I’m working on load-balancing a pair of WAN connections on my hEX S router. Unlike the Manual:PCC guide, though, both of my WAN connections have a dynamic IP address assigned with DHCP.
To get around this, I’m using a slight twist on the DHCP script example found on the wiki:
:local rmark “to_ISP1”
:local count [/ip route print count-only where comment=“to_ISP1”]
:if ($bound=1) do={
:if ($count = 0) do={
/ip route add gateway=$“gateway-address” comment=“to_ISP1” routing-mark=$rmark check-gateway=ping
} else={
:if ($count = 1) do={
:local test [/ip route find where comment=“to_ISP1”]
:if ([/ip route get $test gateway] != $“gateway-address”) do={
/ip route set $test gateway=$“gateway-address”
}
} else={
:error “Multiple routes found”
}
}
} else={
/ip route remove [find comment=“to_ISP1”]
}The other WAN port’s script replaces “to_ISP1” with “to_ISP2”.
I’m also using the router’s ‘bridge’ port instead of a ‘LAN’ port as listed in the guide.
Finally, I’ve replaced the two ‘accept’ rules with a single rule specifying a destination address type of ‘local’ instead.
/ip firewall mangle
add action=accept chain=prerouting dst-address-type=local in-interface=bridge
add action=mark-connection chain=prerouting connection-mark=no-mark
in-interface=ISP1 new-connection-mark=ISP1_conn
add action=mark-connection chain=prerouting connection-mark=no-mark
in-interface=ISP2 new-connection-mark=ISP2_conn
add action=mark-connection chain=prerouting connection-mark=no-mark
dst-address-type=!local in-interface=bridge new-connection-mark=ISP1_conn
per-connection-classifier=both-addresses:2/0
add action=mark-connection chain=prerouting connection-mark=no-mark
dst-address-type=!local in-interface=bridge new-connection-mark=ISP2_conn
per-connection-classifier=both-addresses:2/1
add action=mark-routing chain=prerouting connection-mark=ISP1_conn
in-interface=bridge new-routing-mark=to_ISP1
add action=mark-routing chain=prerouting connection-mark=ISP2_conn
in-interface=bridge new-routing-mark=to_ISP2
add action=mark-routing chain=output connection-mark=ISP1_conn
new-routing-mark=to_ISP1
add action=mark-routing chain=output connection-mark=ISP2_conn
new-routing-mark=to_ISP2
/ip firewall nat
add action=masquerade chain=srcnat comment=“defconf: masquerade”
ipsec-policy=out,none out-interface-list=WAN
add action=masquerade chain=srcnat out-interface=ISP1
add action=masquerade chain=srcnat out-interface=ISP2This is working well! I can pull the combined speed of both of my WAN connections when on a multi-connection download test like fast.com. 42Mbps might not sound like a lot, but it is when you’re used to 20. 
However, the problem comes when I try to use failover routing as discussed in the PCC guide. It suggests creating a route with a cost of 1 and 2 on WAN1 and WAN2, respectively.
add dst-address=0.0.0.0/0 gateway=10.111.0.1 distance=1 check-gateway=ping
add dst-address=0.0.0.0/0 gateway=10.112.0.1 distance=2 check-gateway=pingI’ve tried a couple of different options to fill this in with the correct information. One was adding another route inside the DHCP script:
/ip route add gateway=$“gateway-address” comment=“to_ISP1” routing-mark=$rmark check-gateway=ping
/ip route add gateway=$“gateway-address” comment=“failover_ISP1” distance=1 check-gateway=pingI also tried to use the DHCP Client’s default route.
When I try either of these options, I’m basically unable to use HTTP(S). While ICMP traffic seems to pass undisturbed, any attempts to browse the web take a very long time to connect and only pass traffic at about 100Kbps. Once the routes without marks are deleted again, traffic is able to pass at 42Mbps.
But that still leaves me without failover… Does anyone know why having the so-called “Failover” routes in this configuration would cause such strange traffic patterns? I suspect that changing the “accept” rules is the most likely problem, but I’m not sure how I’d dynamically create these rules correctly.
A full /export hide-sensitive with my router’s IPs masked can be found at https://paste.ubuntu.com/p/XxXPJgYmzd/