IF the second video does not get you all the way, then post your config
/export file=anynameyouwish ( minus router serial number, any public WANIP information, keys etc.)
Confirm users are coming inbound on the VPN to your router ( mikrotik is hosting VPN using its services ) not to servers on the lan.
Not sure I understand but will look…
Do you send vpn traffic to WAN1 or WAN2??
Do you do any port forwarding on WAN1 or WAN2??
Maybe I misunderstood how you use VPN??
/ip firewall mangle
add action=change-ttl chain=postrouting new-ttl=set:1 out-interface=Hotspot passthrough=yes { no idea what this does but will leave it alone }
{ four rules for traffic to ROUTER add action=mark-connection chain=input connection-mark=no-mark in-interface=WAN1 new-connection-mark=ISP1_conn passthrough=yes
add action=mark-connection chain=input connection-mark=no-mark in-interface=WAN2 new-connection-mark=ISP2_conn passthrough=yes
add action=mark-routing chain=output connection-mark=ISP1_conn new-routing-mark=ISP1 passthrough=yes
add action=mark-routing chain=output connection-mark=ISP2_conn new-routing-mark=ISP2 passthrough=yes
{ four rules for pcc traffic } add action=mark-connection chain=forward connection-mark=no-mark dst-address-type=!local hotspot=auth in-interface=Hotspot
new-connection-mark=ISP1_pcc passthrough=yes per-connection-classifier=src-address-and-port:2/0
add action=mark-connection chain=prerouting connection-mark=no-mark dst-address-type=!local hotspot=auth in-interface=Hotspot
new-connection-mark=ISP2_pcc passthrough=yes per-connection-classifier=src-address-and-port:2/1
add action=mark-routing chain=prerouting connection-mark=ISP1_pcc new-routing-mark=ISP1 passthrough=no
add action=mark-routing chain=prerouting connection-mark=ISP2_pcc new-routing-mark=ISP2 passthrough=no
/ip firewall nat add action=masquerade chain=srcnat comment=“masquerade hotspot network” out-interface-list=WAN
Sadly your config is incomplete no firewall rules etc… and no lists so you will have to make it two rules out-interface=wan1 / out-interface=wan2
Discussion: Do not need new connection, do not need to put in-hotspot on routing-mark rule, as is already done in mark-connection rule!
I prefer forward chain for mark-connection rule its more accurate.
also I have different mark connection rule, for troubleshooting and logging purposes, it makes it much clearer which traffic is being shown.
ROUTES need work!!! We cannot use gateway=interface for these rules, they need to be gateway IPs……
If static fine, if dynamic, will need scripts to keep them updated… So right now they are placeholders but not correct.
/ip route
{main table} add check-gateway=ping distance=1 dst-address=0.0.0.0/0 gateway=WAN1 routing-table=main
add check-gateway=ping distance=2 dst-address=0.0.0.0/0 gateway=WAN2 routing-table=main
{special tables} (check gateway=ping is useless, there is only one entry in each table) add dst-address=0.0.0.0/0 gateway=WAN1 routing-table=ISP1
add dst-address=0.0.0.0/0 gateway=WAN2 routing-table=ISP2
{no idea what these tables are for ???) add dst-address=192.168.200.0/24 gateway=192.168.200.1 routing-table=main
add dst-address=192.168.10.0/24 gateway=192.168.200.1 pref-src=“” routing-table=main
add dst-address=185.155.X97.XX/32 gateway=WAN2 routing-table=*402 <----- This one is showing an error too!!!
I have hotspot by using Starlink terminal. Authentication is done by using a Remote Radius Server (In a different country) that is why I need to establish a VPN connection between my Mikrotik and the Radius server.
First Starlink now it is 192.168.1.1/24 connected to Ether 1: 192.168.1.2
Second Starlink now it is: 192.16.2.1/24 connected to Ether 2: 192.168.2.1
Ether 3 to Ether 10 is bridged for my Hotspot with IP assigned to bridge is: 10.0.0.1/16
Remote Radius Server assume it is 38.242.235.250
VPN server so I can access the radius assume it is 38.242.235.249
VPN DHCP Server is: 192.168.200.1
Mikortik will get 192.16.200.2 from the remote VPN server.
Suppose I want to do PCC load balancing + Hotspot + VPN connection used only for Hotspot Radius authentication only.
Mikrotik is OS7
Router is RB-3011
I did exactly the official PCC for OS7 from Mikrotik but without Hotspot and added hotspot=auth in every pcc rule but the mobile users had exlamination mark with “Connected, but no internet connection” don’t know why
Hello, I’m also trying to set PCC on my CCR2004. But keep getting issues with my routing tables. I have all my 3 starlinks in bypass so my ip is dynamic and even if I type the gateway in the routing table it comes back as inactive.
In case you find a solution kindly share because it’s really turned into a headache.
