Hi. I have a poor internet. Right now the only option is LTE but my provider is also not stable. I have two LTE routers with cards from two different operators. I bought RB5009UG+S+ router and want to use ether1 and ether2 as wan ports. I think that i already managed to do that. Right now i have one of my LTE routers connected to ether2 and it works, i didn’t test ether1 yet. So now i want to configure load balancer. I don’t want to have failover as it is not like LTE is not working at all but it has speet like 2Mb/s when second one have let say 30Mb/s. After few hours it may change so i want to utilize both connections. I read that i should use PCC to not have problem that connections will switch from one wan to other as it might break some connectinon. I’m trying to understand what need to be done but i’m not sure. Could you look at my config and help me with that?
Remove router serial number from your post as precaution.
Remove this rule, its not normally used (first time i recall seeing it used, but my memory is faulty LOL ) /interface bridge nat
add action=accept chain=srcnat out-interface-list=WAN
YOu cannot do both, one either assigns an address for the WANIPs or one uses /IP DHCP Client.
So remove IP DHCP client settings and get rid of any notion of bridge and wan.
Not sure why you deviated so much from default firewall rules but get back on track… YOUR ROUTER IS UNSAFE WITH THE RULES USED or lack thereof! ( keeping chains together and order within chain is important )
/ip firewall filter
add action=accept chain=input connection-state=established,related,untracked
add action=drop chain=input connection-state=invalid
add action=accept chain=input comment=“defconf: accept ICMP” protocol=icmp
add action=accept chain=input in-interface-list=LAN
add action=drop chain=input comment="drop all else" { put this rule in last and in this position, not before the accept rule above }
++++++++++++++++++++++++++ add action=accept chain=forward connection-state=established,related,untracked
add action=drop chain=forward connection-state=invalid
add action=accept chain=forward comment=“internet traffic” in-interface-list=LAN out-interface-list=WAN
add action=drop chain=forward comment=“drop all else”
Fix SOURCENAT RULES basically delete the first passthrough rule, no reason for that unless you know of one??? /ip firewall nat
add action=masquerade chain=srcnat comment=“NAT for WAN1” out-interface=ether1
add action=masquerade chain=srcnat comment=“NAT for WAN2” out-interface=ether2
MANGLES - first rule is self defeating and plays no part in mangles… last ones same, wrong rules…
do not need to put connection-state=new either.
Wow, so many points. I will definetly look at it tommorow(today is too late). Right now router is working. I will add missed firewall rules, thanks for that. My router is not accessible via internet as my LTE providers are closing all ports but still it is good to be protected in case of operator change.
One comment. You wrote to set ‘ping distance=2’ but i think that then i will use only one connection and the second one will be failback. I want to use both of my connections.
I have one problem with my router. I have cameras connected on ether6 via Hikvision poe switch. For some reason cameras become unreachable after few minutes. To get them back i just disabled interface wait couple of seconds and enable it back. I have no idea what is the problem as on previous router it was working(the same cables). I disabled fast forward and set ARP timeout to 00:01:00 and disable loop protect on this interface(there was no logs about loop detections but i just try) but no effect. Do you have idea what else can i check? I see no erros or warings in logs.
Edit: the interesting thing is that all cameras going down in the same moment.
Rule of thumb, is never rely on your ISP to protect your network 100%!
I never said to set ping to anything, I set the distance of the second route so that there is no confusion in the router for any return traffic.
In other words, if there is any traffic to the router ( vpn ) it would come in most l ikely on wan1 and go out wan1, similarly if there was separate external traffic coming into a server,
it would likely come in on WAN1 and thus would go out WAN1. Its kinda of providing the router clear direction on the main table, and future proofing.
Currently the network is pretty clean but if any of the above occurred ( external traffic to the router) then additional mangling would be required.
3. I would avoid using the same DNS servers on my netwatch rules, that I use for my IP DNS settings. Suggest 1.0.0.1 and 8.8.4.4
Also rationalize the ruleset…
/ip dns
set allow-remote-requests=yes
Remove static IP dns /ip dns static
add address=192.168.88.1 comment=defconf name=router.lan type=A
and modify.
/ip dhcp-server network
add address=192.168.1.0/24 dns-server=1.0.0.1,8.8.4.4 gateway=192.168.1.1
@anav do you have any idea what might be wrong with that POE router? I can’t find out why 3 cameras connected to that poe router are the only devices which are not working right now. It works only few minutes after POE router or interface restart. Today i tried to connect them one by one to check if there is some issue with one of them but all works the same. I also increase MTU on ether6 interface but still after few minutes camera become unreachable .
Edit: I checked again and now i see some errors in logs.
16:16:19 dhcp,warning lan_dhcp offering lease 192.168.1.237 for F0:00:05:01:7B:E0 without success
16:17:12 dhcp,warning lan_dhcp offering lease 192.168.1.237 for F0:00:05:01:7B:E0 without success
16:17:44 dhcp,warning lan_dhcp offering lease 192.168.1.237 for F0:00:05:01:7B:E0 without success
16:18:16 dhcp,warning lan_dhcp offering lease 192.168.1.237 for F0:00:05:01:7B:E0 without success
16:19:08 dhcp,warning lan_dhcp offering lease 192.168.1.237 for F0:00:05:01:7B:E0 without success
16:19:41 dhcp,warning lan_dhcp offering lease 192.168.1.237 for F0:00:05:01:7B:E0 without success
16:20:13 dhcp,warning lan_dhcp offering lease 192.168.1.237 for F0:00:05:01:7B:E0 without success
16:21:05 dhcp,warning lan_dhcp offering lease 192.168.1.237 for F0:00:05:01:7B:E0 without success
16:21:37 dhcp,warning lan_dhcp offering lease 192.168.1.237 for F0:00:05:01:7B:E0 without success
16:22:10 dhcp,warning lan_dhcp offering lease 192.168.1.237 for F0:00:05:01:7B:E0 without success
16:23:02 dhcp,warning lan_dhcp offering lease 192.168.1.237 for F0:00:05:01:7B:E0 without success
16:23:34 dhcp,warning lan_dhcp offering lease 192.168.1.237 for F0:00:05:01:7B:E0 without success
16:24:06 dhcp,warning lan_dhcp offering lease 192.168.1.237 for F0:00:05:01:7B:E0 without success
16:24:59 dhcp,warning lan_dhcp offering lease 192.168.1.237 for F0:00:05:01:7B:E0 without success
16:25:31 dhcp,warning lan_dhcp offering lease 192.168.1.237 for F0:00:05:01:7B:E0 without success
16:26:03 dhcp,warning lan_dhcp offering lease 192.168.1.237 for F0:00:05:01:7B:E0 without success
16:26:56 dhcp,warning lan_dhcp offering lease 192.168.1.237 for F0:00:05:01:7B:E0 without success
16:27:28 dhcp,warning lan_dhcp offering lease 192.168.1.237 for F0:00:05:01:7B:E0 without success
16:28:00 dhcp,warning lan_dhcp offering lease 192.168.1.237 for F0:00:05:01:7B:E0 without success
16:28:52 dhcp,warning lan_dhcp offering lease 192.168.1.237 for F0:00:05:01:7B:E0 without success
Sorry for long not responding. I had a COVID, had 40 degree fever and was not able to do anything.
Yes, they are in the same subnet. I bought some time ago new ehternet connectors and make cable again. I just replace ethernet connectors on the end of the cable and it started to work. I don’t know why on previous router everything was ok but the same cable had a problem on mikrotik.
One question. How to identifiy problems like those? I didn’t saw any bad/lost packages in interface statistics. So how could i know that this is the problem? That was just blind guess. I did that connectors replace just before i went sick so it works for more than a week. Previously i had a problem after couple minutes/hours so i think it is ok now and problem is fixed.
and was not able to do anything.