OliZi
November 21, 2023, 11:33pm
1
Hi there,
could someone help me please?
I try to config pcc load balancing with 5WAN and port forwarding.
But why?
So if anyone know what I did wrong please let me know
here my config:
/interface bridge
add name=LAN
/interface ethernet
set [ find default-name=ether1 ] name=WAN1
set [ find default-name=ether2 ] name=WAN2
set [ find default-name=ether3 ] name=WAN3
set [ find default-name=ether4 ] name=WAN4
set [ find default-name=ether5 ] name=WAN5
/interface list
add name=WAN-list
add name=LAN-list
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
/ip pool
add name=dhcp_pool0 ranges=10.0.0.100-10.0.0.200
/ip dhcp-server
add address-pool=dhcp_pool0 disabled=no interface=LAN name=dhcp1
/interface bridge port
add bridge=LAN interface=ether12
add bridge=LAN interface=ether8
add bridge=LAN interface=ether11
/interface list member
add interface=WAN1 list=WAN-list
add interface=WAN2 list=WAN-list
add interface=WAN3 list=WAN-list
add interface=WAN4 list=WAN-list
add interface=WAN5 list=WAN-list
add interface=LAN list=LAN-list
/ip address
add address=10.0.0.75/24 interface=ether12 network=10.0.0.0
add address=81.223.59.xxx/29 interface=WAN1 network=81.223.59.xxx
add address=10.0.0.1 interface=ether11 network=10.0.0.1
add address=192.168.4.50/24 interface=WAN3 network=192.168.4.0
add address=192.168.7.50/24 interface=WAN4 network=192.168.7.0
add address=192.168.6.50/24 interface=WAN5 network=192.168.6.0
/ip dhcp-client
add add-default-route=no disabled=no interface=WAN5 use-peer-dns=no \
use-peer-ntp=no
add add-default-route=no disabled=no interface=WAN2 use-peer-dns=no \
use-peer-ntp=no
add add-default-route=no disabled=no interface=WAN3 use-peer-dns=no \
use-peer-ntp=no
add add-default-route=no disabled=no interface=WAN4 use-peer-dns=no \
use-peer-ntp=no
/ip dhcp-server lease
add address=10.0.0.144 client-id=1:0:50:56:93:f0:9a mac-address=\
00:50:56:93:F0:9A server=dhcp1
/ip dhcp-server network
add address=10.0.0.0/24 dns-server=10.0.0.25,10.0.0.1 domain=dom-01.net \
gateway=10.0.0.1
/ip dns
set allow-remote-requests=yes servers=10.0.0.25 use-doh-server=\
https://dns.google/dns-query verify-doh-cert=yes
/ip dns static
add address=8.8.8.8 name=dns.google
add address=8.8.4.4 name=dns.google
/ip firewall address-list
add address=10.0.0.0/24 list=LAN_10
add address=10.0.0.0/24 list=LAN_IP
add address=10.0.0.0/8 list=RFC1918
add address=172.16.0.0/12 list=RFC1918
add address=192.168.0.0/16 list=RFC1918
add address=81.223.59.xxx/29 list=WAN1
add address=212.95.26.xxx/29 list=WAN3
add address=212.95.27.xxx/24 list=WAN4
add address=176.66.0.xxx/16 list=WAN5
add address=212.95.26.xxx/30 list=WAN2
add address=10.0.0.69-10.0.0.70 list=PBR_LAN5
add address=10.0.0.1-10.0.0.99 list=DT_SERVER
add address=10.0.0.100-10.0.0.200 list=DT_DHCP
add address=10.0.0.201-10.0.0.253 list=DT_FIX
/ip firewall filter
add action=drop chain=input comment="Drop Invalid connections" \
connection-state=invalid
add action=accept chain=input comment="Zugang aus dem Hausnetz" dst-port=\
8291,22,80 in-interface=LAN protocol=tcp
add action=accept chain=input comment=\
"Allow Established/Related/Untracked connections" connection-state=\
established,related
add action=accept chain=input comment="Allow ICMP" protocol=icmp
add action=accept chain=input comment="DNS nicht von extern" dst-port=53 \
protocol=tcp src-address-list=LAN_IP
add action=accept chain=input dst-port=53 protocol=udp src-address-list=\
LAN_IP
add action=drop chain=input comment="Drop everything else" log=yes \
log-prefix=_DROP_IN_
add action=accept chain=forward dst-address=10.0.0.144 dst-port=80,443 \
protocol=tcp
add action=accept chain=forward comment="allow port forwarding" \
connection-nat-state=dstnat connection-state=new
add action=accept chain=forward comment="forward established" \
connection-state=established,related
add action=accept chain=forward comment="allow internet traffic" \
in-interface-list=LAN-list out-interface-list=WAN-list
add action=drop chain=forward comment="Forward Drop invalid " \
connection-state=invalid
add action=drop chain=forward comment="forward drop anything"
/ip firewall mangle
add action=accept chain=prerouting comment=0001 dst-address-list=RFC1918 \
src-address-list=RFC1918
add action=mark-routing chain=prerouting comment="GIT to WAN3" \
connection-mark=WAN3_conn disabled=yes new-routing-mark=toWan3 \
passthrough=no src-address=10.0.0.144
add action=mark-connection chain=forward comment="GIT to WAN3" \
connection-state=new disabled=yes in-interface=WAN3 new-connection-mark=\
WAN3_conn passthrough=no
add action=accept chain=prerouting comment=0002 dst-address=81.223.59.xx/29 \
in-interface=LAN
add action=accept chain=prerouting dst-address=212.95.26.xxx/30 in-interface=\
LAN
add action=accept chain=prerouting dst-address=212.95.26.xxx/29 in-interface=\
LAN
add action=accept chain=prerouting dst-address=212.95.27.xxx/24 in-interface=\
LAN
add action=accept chain=prerouting dst-address=176.66.0.xxx/16 in-interface=LAN
add action=mark-connection chain=prerouting comment="Incomming WAN marking" \
connection-mark=no-mark in-interface=WAN1 new-connection-mark=WAN1_conn \
passthrough=yes
add action=mark-connection chain=prerouting connection-mark=no-mark \
in-interface=WAN2 new-connection-mark=WAN2_conn passthrough=yes
add action=mark-connection chain=prerouting connection-mark=no-mark \
in-interface=WAN3 new-connection-mark=WAN3_conn passthrough=yes
add action=mark-connection chain=prerouting connection-mark=no-mark \
in-interface=WAN4 new-connection-mark=WAN4_conn passthrough=yes
add action=mark-connection chain=prerouting connection-mark=no-mark \
in-interface=WAN5 new-connection-mark=WAN5_conn passthrough=yes
add action=mark-routing chain=output comment="outgoing WAN routing" \
connection-mark=WAN1_conn new-routing-mark=toWan1 passthrough=no
add action=mark-routing chain=output connection-mark=WAN2_conn \
new-routing-mark=toWan2 passthrough=no
add action=mark-routing chain=output connection-mark=WAN3_conn \
new-routing-mark=toWan3 passthrough=no
add action=mark-routing chain=output connection-mark=WAN4_conn \
new-routing-mark=toWan4 passthrough=no
add action=mark-routing chain=output connection-mark=WAN5_conn \
new-routing-mark=toWan5 passthrough=no
add action=mark-connection chain=prerouting comment="3CX to WAN" disabled=yes \
new-connection-mark=WAN2_conn passthrough=no src-address=10.0.0.50
add action=mark-connection chain=prerouting comment="Routing to WAN2 device" \
connection-mark=no-mark disabled=yes dst-address=192.168.3.1 \
dst-address-type="" in-interface-list=LAN-list new-connection-mark=\
WAN2_conn passthrough=yes
add action=mark-connection chain=prerouting comment="Routing to WAN3 device" \
connection-mark=no-mark disabled=yes dst-address=192.168.4.1 \
dst-address-type="" in-interface-list=LAN-list new-connection-mark=\
WAN3_conn passthrough=yes
add action=mark-connection chain=prerouting comment="Routing to WAN4 device" \
connection-mark=no-mark disabled=yes dst-address=192.168.7.1 \
dst-address-type="" in-interface-list=LAN-list new-connection-mark=\
WAN4_conn passthrough=yes
add action=mark-connection chain=prerouting comment="Routing to WAN5 device" \
connection-mark=no-mark disabled=yes dst-address=192.168.6.1 \
dst-address-type="" in-interface-list=LAN-list new-connection-mark=\
WAN5_conn passthrough=yes
add action=mark-connection chain=prerouting comment="Loadbalancing WAN 2- 5" \
connection-mark=no-mark dst-address-type=!local in-interface-list=\
LAN-list new-connection-mark=WAN2_conn passthrough=yes \
per-connection-classifier=both-addresses:4/0
add action=mark-connection chain=prerouting connection-mark=no-mark \
dst-address-type=!local in-interface-list=LAN-list new-connection-mark=\
WAN3_conn passthrough=yes per-connection-classifier=both-addresses:4/1
add action=mark-connection chain=prerouting connection-mark=no-mark \
dst-address-type=!local in-interface-list=LAN-list new-connection-mark=\
WAN4_conn passthrough=yes per-connection-classifier=both-addresses:4/2
add action=mark-connection chain=prerouting connection-mark=no-mark \
dst-address-type=!local in-interface-list=LAN-list new-connection-mark=\
WAN5_conn passthrough=yes per-connection-classifier=both-addresses:4/3
add action=mark-routing chain=prerouting comment="outgoing routing" \
connection-mark=WAN1_conn in-interface-list=LAN-list new-routing-mark=\
toWan1 passthrough=no
add action=mark-routing chain=prerouting connection-mark=WAN2_conn \
in-interface-list=LAN-list new-routing-mark=toWan2 passthrough=no
add action=mark-routing chain=prerouting connection-mark=WAN3_conn \
in-interface-list=LAN-list new-routing-mark=toWan3 passthrough=no
add action=mark-routing chain=prerouting connection-mark=WAN4_conn \
in-interface-list=LAN-list new-routing-mark=toWan4 passthrough=no
add action=mark-routing chain=prerouting connection-mark=WAN5_conn \
in-interface-list=LAN-list new-routing-mark=toWan5 passthrough=no
add action=mark-routing chain=prerouting comment="Test Mangle one WAN" \
disabled=yes in-interface-list=LAN-list new-routing-mark=toWan3 \
passthrough=yes
/ip firewall nat
add action=src-nat chain=srcnat comment="SNat for reverse exchange 35" \
disabled=yes out-interface=WAN1 src-address=10.0.0.35 to-addresses=\
81.223.59.194
add action=src-nat chain=srcnat comment="SNat for reverse proxy 222" \
disabled=yes out-interface=WAN1 src-address=10.0.0.222 to-addresses=\
81.223.59.194
add action=src-nat chain=srcnat comment="SNat for reverse syno 240" disabled=\
yes out-interface=WAN1 src-address=10.0.0.240 to-addresses=81.223.59.194
add action=src-nat chain=srcnat comment="SNat for reverse printer 250" \
disabled=yes out-interface=WAN1 src-address=10.0.0.250 to-addresses=\
81.223.59.194
add action=dst-nat chain=dstnat comment="testwebsite W1" dst-address=\
81.223.59.194 dst-port=80 protocol=tcp to-addresses=10.0.0.100 to-ports=\
4400
add action=dst-nat chain=dstnat comment="testwebsite W4" dst-address=\
212.95.27.226 dst-port=80 protocol=tcp to-addresses=10.0.0.100 to-ports=\
4400
add action=dst-nat chain=dstnat comment="testwebsite W5" dst-address=\
176.66.79.218 dst-port=80 protocol=tcp to-addresses=10.0.0.100 to-ports=\
4400
add action=dst-nat chain=dstnat comment="GitLab incomming W3" dst-address=\
212.95.26.84 dst-address-type=local dst-port=80,443,22 protocol=tcp \
to-addresses=10.0.0.100 to-ports=4400
add action=dst-nat chain=dstnat comment="GitLab incomming W2" dst-address=\
212.95.26.85 dst-address-type=local dst-port=80,443,22 protocol=tcp \
to-addresses=10.0.0.100 to-ports=4400
add action=dst-nat chain=dstnat dst-address=212.95.26.84 dst-address-type=\
local dst-port=22 in-interface=WAN3 protocol=udp to-addresses=10.0.0.144 \
to-ports=22
add action=src-nat chain=srcnat connection-mark=WAN3_connPF disabled=yes \
out-interface=WAN3 src-address=10.0.0.144 to-addresses=212.95.26.84
add action=masquerade chain=srcnat comment="WAN Masquerade" out-interface=\
WAN1
add action=masquerade chain=srcnat comment="WAN Masquerade" out-interface=\
WAN2
add action=masquerade chain=srcnat comment="WAN Masquerade" out-interface=\
WAN3
add action=masquerade chain=srcnat comment="WAN Masquerade" out-interface=\
WAN4
add action=masquerade chain=srcnat comment="WAN Masquerade" out-interface=\
WAN5
add action=masquerade chain=srcnat comment="MAIN Masquerade" disabled=yes \
out-interface-list=WAN-list src-address-list=RFC1918
add action=masquerade chain=srcnat comment="MAIN Masquerade" disabled=yes
add action=dst-nat chain=dstnat comment="Website incomming" disabled=yes \
dst-port=80,443 in-interface=WAN1 protocol=tcp to-addresses=10.0.0.222
add action=dst-nat chain=dstnat comment="FTP incomming" disabled=yes \
dst-port=20,21,990,9990-10000 in-interface=WAN1 protocol=tcp \
to-addresses=10.0.0.217
add action=dst-nat chain=dstnat comment="3CX incomming" disabled=yes \
dst-address=212.95.26.xxx dst-port=5160,5060-5062,5090,443,5001,2197,5223 \
protocol=tcp src-port="" to-addresses=10.0.0.50
add action=dst-nat chain=dstnat disabled=yes dst-address=212.95.26.xxx \
dst-port=5160,5060-5062,5090,5001,2197,5223,9000-32560 port="" protocol=\
udp src-port="" to-addresses=10.0.0.50
add action=accept chain=srcnat comment="2CX Outgoing" disabled=yes protocol=\
tcp src-address=10.0.0.50 src-port=2195,2196,443,2528
add action=accept chain=srcnat comment="2CX Outgoing" disabled=yes protocol=\
udp src-address=10.0.0.50 src-port=48000-65535
/ip route
add check-gateway=ping comment="Routing WAN1" distance=1 gateway=4.2.2.2 \
routing-mark=toWan1 target-scope=11
add check-gateway=ping comment="failover WAN2" disabled=yes distance=2 \
gateway=4.2.2.3 routing-mark=toWan1 target-scope=11
add check-gateway=ping comment="failover WAN3" disabled=yes distance=2 \
gateway=4.2.2.4 routing-mark=toWan1 target-scope=11
add check-gateway=ping comment="failover WAN4" disabled=yes distance=2 \
gateway=1.1.1.1 routing-mark=toWan1 target-scope=11
add check-gateway=ping comment="failover WAN5" disabled=yes distance=2 \
gateway=1.0.0.1 routing-mark=toWan1 target-scope=11
add check-gateway=ping comment="Routing WAN2" distance=1 gateway=4.2.2.3 \
routing-mark=toWan2 target-scope=11
add check-gateway=ping comment="failover WAN1" disabled=yes distance=2 \
gateway=4.2.2.2 routing-mark=toWan2 target-scope=11
add check-gateway=ping comment="failover WAN3" disabled=yes distance=3 \
gateway=4.2.2.4 routing-mark=toWan2 target-scope=11
add check-gateway=ping comment="failover WAN4" disabled=yes distance=3 \
gateway=1.1.1.1 routing-mark=toWan2 target-scope=11
add check-gateway=ping comment="failover WAN5" disabled=yes distance=3 \
gateway=1.0.0.1 routing-mark=toWan2 target-scope=11
add check-gateway=ping comment="Routing WAN3" distance=1 gateway=4.2.2.4 \
routing-mark=toWan3 target-scope=11
add check-gateway=ping comment="failover WAN1" disabled=yes distance=3 \
gateway=4.2.2.2 routing-mark=toWan3 target-scope=11
add check-gateway=ping comment="failover WAN2" disabled=yes distance=3 \
gateway=4.2.2.3 routing-mark=toWan3 target-scope=11
add check-gateway=ping comment="failover WAN4" disabled=yes distance=4 \
gateway=1.1.1.1 routing-mark=toWan3 target-scope=11
add check-gateway=ping comment="failover WAN5" disabled=yes distance=4 \
gateway=1.0.0.1 routing-mark=toWan3 target-scope=11
add check-gateway=ping comment="Routing WAN4" distance=1 gateway=1.1.1.1 \
routing-mark=toWan4 target-scope=11
add check-gateway=ping comment="failover WAN1" disabled=yes distance=4 \
gateway=4.2.2.2 routing-mark=toWan4 target-scope=11
add check-gateway=ping comment="failover WAN2" disabled=yes distance=4 \
gateway=4.2.2.3 routing-mark=toWan4 target-scope=11
add check-gateway=ping comment="failover WAN3" disabled=yes distance=4 \
gateway=4.2.2.4 routing-mark=toWan4 target-scope=11
add check-gateway=ping comment="failover WAN5" disabled=yes distance=5 \
gateway=1.0.0.1 routing-mark=toWan4 target-scope=11
add check-gateway=ping comment="Routing WAN5" distance=1 gateway=1.0.0.1 \
routing-mark=toWan5 target-scope=11
add check-gateway=ping comment="failover WAN1" disabled=yes distance=5 \
gateway=4.2.2.2 routing-mark=toWan5 target-scope=11
add check-gateway=ping comment="failover WAN2" disabled=yes distance=5 \
gateway=4.2.2.3 routing-mark=toWan5 target-scope=11
add check-gateway=ping comment="failover WAN3" disabled=yes distance=5 \
gateway=4.2.2.4 routing-mark=toWan5 target-scope=11
add check-gateway=ping comment="failover WAN4" disabled=yes distance=5 \
gateway=1.1.1.1 routing-mark=toWan5 target-scope=11
add check-gateway=ping comment="default wan 1" distance=1 gateway=4.2.2.2 \
target-scope=11
add check-gateway=ping comment="default wan 2" distance=1 gateway=4.2.2.3 \
target-scope=11
add check-gateway=ping comment="default wan 4" distance=1 gateway=1.1.1.1 \
target-scope=11
add check-gateway=ping comment="default wan 3" distance=1 gateway=4.2.2.4 \
target-scope=11
add check-gateway=ping comment="default wan 5" distance=1 gateway=1.0.0.1 \
target-scope=11
add comment="Monitor WAN5" distance=1 dst-address=1.0.0.1/32 gateway=\
176.66.0.xxx scope=10
add comment="Monitor WAN4" distance=1 dst-address=1.1.1.1/32 gateway=\
212.95.27.xxx scope=10
add comment="Monitor WAN1" distance=1 dst-address=4.2.2.2/32 gateway=\
81.223.59.xxx scope=10
add comment="Monitor WAN2" distance=1 dst-address=4.2.2.3/32 gateway=\
212.95.26.xxx scope=10
add comment="Monitor WAN3" distance=1 dst-address=4.2.2.4/32 gateway=\
212.95.26.xxx scope=10
/system clock
set time-zone-name=Europe/Vienna
/tool graphing interface
add interface=WAN1
add interface=WAN2
add interface=WAN3
add interface=WAN4
add interface=WAN5
add interface=LAN
/tool sniffer
set file-name=testsniff filter-interface=WAN3
anav
November 22, 2023, 12:28am
2
Dont name your bridge LAN, its very confusing to the reader and probably to the router.
I have no idea what you are doing with this so called lan subnet, is it supposed to be attached to the bridge, ether12, ether11.
/ip dhcp-serverinterface=LAN name=dhcp1 /ip pool10.0.0.100-10.0.0.200 /interface bridge portether12 ether11 ether12 network=10.0.0.0ether11 network=10.0.0.1
anav
November 22, 2023, 12:37am
3
I also dont think you have a clue about port forwarding with a rule like this… Created a youtube/google monster… ( very disorganized rule order as well )add action=accept chain=forward dst-address=10.0.0.144 dst-port=80,443
When the rest of the config is cleaned up I would scrap all your mangles and routes until you have a coherent plan.
OR if one wan goes down do you want the traffic more or less equally spread to all other WANS. etc…
OliZi
November 22, 2023, 11:38am
4
Hi there,
thanks for your replay.
If you could check again it would be great.
My last device was a zywall and it was a bit easier for me to get this config to work.
/interface bridge
add name=bridge-LAN
/interface ethernet
set [ find default-name=ether1 ] name=WAN1
set [ find default-name=ether2 ] name=WAN2
set [ find default-name=ether3 ] name=WAN3
set [ find default-name=ether4 ] name=WAN4
set [ find default-name=ether5 ] name=WAN5
/interface list
add name=WAN-list
add name=LAN-list
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
/ip pool
add name=dhcp_pool0 ranges=10.0.0.100-10.0.0.200
/ip dhcp-server
add address-pool=dhcp_pool0 disabled=no interface=bridge-LAN name=dhcp1
/interface bridge port
add bridge=bridge-LAN interface=ether12
add bridge=bridge-LAN interface=ether8
add bridge=bridge-LAN interface=ether11
/interface list member
add interface=WAN1 list=WAN-list
add interface=WAN2 list=WAN-list
add interface=WAN3 list=WAN-list
add interface=WAN4 list=WAN-list
add interface=WAN5 list=WAN-list
add interface=bridge-LAN list=LAN-list
/ip address
add address=10.0.0.75/24 interface=ether12 network=10.0.0.0
add address=81.223.59.xxx/29 interface=WAN1 network=81.223.59.192
add address=10.0.0.1 interface=ether11 network=10.0.0.1
add address=192.168.4.50/24 interface=WAN3 network=192.168.4.0
add address=192.168.7.50/24 interface=WAN4 network=192.168.7.0
add address=192.168.6.50/24 interface=WAN5 network=192.168.6.0
/ip dhcp-client
add add-default-route=no disabled=no interface=WAN5 use-peer-dns=no \
use-peer-ntp=no
add add-default-route=no disabled=no interface=WAN2 use-peer-dns=no \
use-peer-ntp=no
add add-default-route=no disabled=no interface=WAN3 use-peer-dns=no \
use-peer-ntp=no
add add-default-route=no disabled=no interface=WAN4 use-peer-dns=no \
use-peer-ntp=no
/ip dhcp-server lease
add address=10.0.0.144 client-id=1:0:50:56:93:f0:9a mac-address=\
00:50:56:93:F0:9A server=dhcp1
/ip dhcp-server network
add address=10.0.0.0/24 dns-server=10.0.0.25,10.0.0.1 domain=dom-01.net \
gateway=10.0.0.1
/ip dns
set allow-remote-requests=yes servers=10.0.0.25 use-doh-server=\
https://dns.google/dns-query verify-doh-cert=yes
/ip dns static
add address=8.8.8.8 name=dns.google
add address=8.8.4.4 name=dns.google
/ip firewall address-list
add address=10.0.0.0/24 list=LAN_10
add address=10.0.0.0/24 list=LAN_IP
add address=10.0.0.0/8 list=RFC1918
add address=172.16.0.0/12 list=RFC1918
add address=192.168.0.0/16 list=RFC1918
add address=10.0.0.69-10.0.0.70 list=PBR_LAN5
add address=10.0.0.1-10.0.0.99 list=DT_SERVER
add address=10.0.0.100-10.0.0.200 list=DT_DHCP
add address=10.0.0.201-10.0.0.253 list=DT_FIX
/ip firewall filter
add action=drop chain=input comment="Drop Invalid connections" \
connection-state=invalid
add action=accept chain=input comment="Zugang aus dem Hausnetz" dst-port=\
8291,22,80 in-interface=bridge-LAN protocol=tcp
add action=accept chain=input comment=\
"Allow Established/Related/Untracked connections" connection-state=\
established,related
add action=accept chain=input comment="Allow ICMP" protocol=icmp
add action=accept chain=input comment="DNS nicht von extern" dst-port=53 \
protocol=tcp src-address-list=LAN_IP
add action=accept chain=input dst-port=53 protocol=udp src-address-list=\
LAN_IP
add action=drop chain=input comment="Drop everything else" log=yes \
log-prefix=_DROP_IN_
add action=accept chain=forward comment="allow port forwarding" \
connection-nat-state=dstnat connection-state=new
add action=accept chain=forward comment="forward established" \
connection-state=established,related
add action=accept chain=forward comment="allow internet traffic" \
in-interface-list=LAN-list out-interface-list=WAN-list
add action=drop chain=forward comment="Forward Drop invalid " \
connection-state=invalid
add action=drop chain=forward comment="forward drop anything"
/ip firewall mangle
add action=accept chain=prerouting comment=0001 dst-address-list=RFC1918 \
src-address-list=RFC1918
add action=accept chain=prerouting comment=0002 dst-address=81.223.59.xxx/29 \
in-interface=bridge-LAN
add action=accept chain=prerouting dst-address=212.95.26.xxx/30 in-interface=\
bridge-LAN
add action=accept chain=prerouting dst-address=212.95.26.xxx/29 in-interface=\
bridge-LAN
add action=accept chain=prerouting dst-address=212.95.27.xxx/24 in-interface=\
bridge-LAN
add action=accept chain=prerouting dst-address=176.66.0.xxx/16 in-interface=\
bridge-LAN
add action=mark-connection chain=prerouting comment="Incomming WAN marking" \
connection-mark=no-mark in-interface=WAN1 new-connection-mark=WAN1_conn \
passthrough=yes
add action=mark-connection chain=prerouting connection-mark=no-mark \
in-interface=WAN2 new-connection-mark=WAN2_conn passthrough=yes
add action=mark-connection chain=prerouting connection-mark=no-mark \
in-interface=WAN3 new-connection-mark=WAN3_conn passthrough=yes
add action=mark-connection chain=prerouting connection-mark=no-mark \
in-interface=WAN4 new-connection-mark=WAN4_conn passthrough=yes
add action=mark-connection chain=prerouting connection-mark=no-mark \
in-interface=WAN5 new-connection-mark=WAN5_conn passthrough=yes
add action=mark-routing chain=output comment="outgoing WAN routing" \
connection-mark=WAN1_conn new-routing-mark=toWan1 passthrough=no
add action=mark-routing chain=output connection-mark=WAN2_conn \
new-routing-mark=toWan2 passthrough=no
add action=mark-routing chain=output connection-mark=WAN3_conn \
new-routing-mark=toWan3 passthrough=no
add action=mark-routing chain=output connection-mark=WAN4_conn \
new-routing-mark=toWan4 passthrough=no
add action=mark-routing chain=output connection-mark=WAN5_conn \
new-routing-mark=toWan5 passthrough=no
add action=mark-connection chain=prerouting comment="Loadbalancing WAN 2- 5" \
connection-mark=no-mark dst-address-type=!local in-interface-list=\
LAN-list new-connection-mark=WAN2_conn passthrough=yes \
per-connection-classifier=both-addresses:4/0
add action=mark-connection chain=prerouting connection-mark=no-mark \
dst-address-type=!local in-interface-list=LAN-list new-connection-mark=\
WAN3_conn passthrough=yes per-connection-classifier=both-addresses:4/1
add action=mark-connection chain=prerouting connection-mark=no-mark \
dst-address-type=!local in-interface-list=LAN-list new-connection-mark=\
WAN4_conn passthrough=yes per-connection-classifier=both-addresses:4/2
add action=mark-connection chain=prerouting connection-mark=no-mark \
dst-address-type=!local in-interface-list=LAN-list new-connection-mark=\
WAN5_conn passthrough=yes per-connection-classifier=both-addresses:4/3
add action=mark-routing chain=prerouting comment="outgoing routing" \
connection-mark=WAN1_conn in-interface-list=LAN-list new-routing-mark=\
toWan1 passthrough=no
add action=mark-routing chain=prerouting connection-mark=WAN2_conn \
in-interface-list=LAN-list new-routing-mark=toWan2 passthrough=no
add action=mark-routing chain=prerouting connection-mark=WAN3_conn \
in-interface-list=LAN-list new-routing-mark=toWan3 passthrough=no
add action=mark-routing chain=prerouting connection-mark=WAN4_conn \
in-interface-list=LAN-list new-routing-mark=toWan4 passthrough=no
add action=mark-routing chain=prerouting connection-mark=WAN5_conn \
in-interface-list=LAN-list new-routing-mark=toWan5 passthrough=no
/ip firewall nat
add action=dst-nat chain=dstnat comment="testwebsite W1" dst-address=\
81.223.59.xxx dst-port=80 protocol=tcp to-addresses=10.0.0.100 to-ports=\
4400
add action=dst-nat chain=dstnat comment="testwebsite W4" dst-address=\
212.95.27.xxx dst-port=80 protocol=tcp to-addresses=10.0.0.100 to-ports=\
4400
add action=dst-nat chain=dstnat comment="testwebsite W5" dst-address=\
176.66.79.xxx dst-port=80 protocol=tcp to-addresses=10.0.0.100 to-ports=\
4400
add action=dst-nat chain=dstnat comment="test website W3" dst-address=\
212.95.26.xxx dst-address-type=local dst-port=80,443,22 protocol=tcp \
to-addresses=10.0.0.100 to-ports=4400
add action=dst-nat chain=dstnat comment="test website W2" dst-address=\
212.95.26.xxx dst-address-type=local dst-port=80,443,22 protocol=tcp \
to-addresses=10.0.0.100 to-ports=4400
add action=dst-nat chain=dstnat dst-address=212.95.26.xxx dst-address-type=\
local dst-port=22 in-interface=WAN3 protocol=udp to-addresses=10.0.0.144 \
to-ports=22
add action=masquerade chain=srcnat comment="WAN Masquerade" out-interface=\
WAN1
add action=masquerade chain=srcnat comment="WAN Masquerade" out-interface=\
WAN2
add action=masquerade chain=srcnat comment="WAN Masquerade" out-interface=\
WAN3
add action=masquerade chain=srcnat comment="WAN Masquerade" out-interface=\
WAN4
add action=masquerade chain=srcnat comment="WAN Masquerade" out-interface=\
WAN5
/ip route
add check-gateway=ping comment="Routing WAN1" distance=1 gateway=4.2.2.2 \
routing-mark=toWan1 target-scope=11
add check-gateway=ping comment="failover WAN2" distance=2 gateway=4.2.2.3 \
routing-mark=toWan1 target-scope=11
add check-gateway=ping comment="failover WAN3" distance=2 gateway=4.2.2.4 \
routing-mark=toWan1 target-scope=11
add check-gateway=ping comment="failover WAN4" distance=2 gateway=1.1.1.1 \
routing-mark=toWan1 target-scope=11
add check-gateway=ping comment="failover WAN5" distance=2 gateway=1.0.0.1 \
routing-mark=toWan1 target-scope=11
add check-gateway=ping comment="Routing WAN2" distance=1 gateway=4.2.2.3 \
routing-mark=toWan2 target-scope=11
add check-gateway=ping comment="failover WAN1" distance=2 gateway=4.2.2.2 \
routing-mark=toWan2 target-scope=11
add check-gateway=ping comment="failover WAN4" distance=3 gateway=1.1.1.1 \
routing-mark=toWan2 target-scope=11
add check-gateway=ping comment="failover WAN3" distance=3 gateway=4.2.2.4 \
routing-mark=toWan2 target-scope=11
add check-gateway=ping comment="failover WAN5" distance=3 gateway=1.0.0.1 \
routing-mark=toWan2 target-scope=11
add check-gateway=ping comment="Routing WAN3" distance=1 gateway=4.2.2.4 \
routing-mark=toWan3 target-scope=11
add check-gateway=ping comment="failover WAN1" distance=3 gateway=4.2.2.2 \
routing-mark=toWan3 target-scope=11
add check-gateway=ping comment="failover WAN2" distance=3 gateway=4.2.2.3 \
routing-mark=toWan3 target-scope=11
add check-gateway=ping comment="failover WAN4" distance=4 gateway=1.1.1.1 \
routing-mark=toWan3 target-scope=11
add check-gateway=ping comment="failover WAN5" distance=4 gateway=1.0.0.1 \
routing-mark=toWan3 target-scope=11
add check-gateway=ping comment="Routing WAN4" distance=1 gateway=1.1.1.1 \
routing-mark=toWan4 target-scope=11
add check-gateway=ping comment="failover WAN1" distance=4 gateway=4.2.2.2 \
routing-mark=toWan4 target-scope=11
add check-gateway=ping comment="failover WAN2" distance=4 gateway=4.2.2.3 \
routing-mark=toWan4 target-scope=11
add check-gateway=ping comment="failover WAN3" distance=4 gateway=4.2.2.4 \
routing-mark=toWan4 target-scope=11
add check-gateway=ping comment="failover WAN5" distance=5 gateway=1.0.0.1 \
routing-mark=toWan4 target-scope=11
add check-gateway=ping comment="Routing WAN5" distance=1 gateway=1.0.0.1 \
routing-mark=toWan5 target-scope=11
add check-gateway=ping comment="failover WAN1" distance=5 gateway=4.2.2.2 \
routing-mark=toWan5 target-scope=11
add check-gateway=ping comment="failover WAN2" distance=5 gateway=4.2.2.3 \
routing-mark=toWan5 target-scope=11
add check-gateway=ping comment="failover WAN4" distance=5 gateway=1.1.1.1 \
routing-mark=toWan5 target-scope=11
add check-gateway=ping comment="failover WAN3" distance=5 gateway=4.2.2.4 \
routing-mark=toWan5 target-scope=11
add check-gateway=ping comment="default wan 1" distance=1 gateway=4.2.2.2 \
target-scope=11
add check-gateway=ping comment="default wan 2" distance=1 gateway=4.2.2.3 \
target-scope=11
add check-gateway=ping comment="default wan 4" distance=1 gateway=1.1.1.1 \
target-scope=11
add check-gateway=ping comment="default wan 3" distance=1 gateway=4.2.2.4 \
target-scope=11
add check-gateway=ping comment="default wan 5" distance=1 gateway=1.0.0.1 \
target-scope=11
add comment="Monitor WAN5" distance=1 dst-address=1.0.0.1/32 gateway=\
176.66.0.xxx scope=10
add comment="Monitor WAN4" distance=1 dst-address=1.1.1.1/32 gateway=\
212.95.27.xxx scope=10
add comment="Monitor WAN1" distance=1 dst-address=4.2.2.2/32 gateway=\
81.223.59.xxx scope=10
add comment="Monitor WAN2" distance=1 dst-address=4.2.2.3/32 gateway=\
212.95.26.xxx scope=10
add comment="Monitor WAN3" distance=1 dst-address=4.2.2.4/32 gateway=\
212.95.26.xxx scope=10
/system clock
set time-zone-name=Europe/Vienna
/tool graphing interface
add interface=WAN1
add interface=WAN2
add interface=WAN3
add interface=WAN4
add interface=WAN5
add interface=bridge-LAN
/tool sniffer
set file-name=testsniff filter-interface=WAN3
anav
November 22, 2023, 1:28pm
5
I came from zyxel myself, and yes its more ProSumer, whereas MT is more IT based programming.
I will have a look at your config.
anav
November 22, 2023, 2:47pm
6
Sorry still dont understand the config,
(1) Why does the bridge not have an IP address assigned to it?? Why does ether 12 instead have an IP address??add address=10.0.0.75/24 interface=ether12 network=10.0.0.0add address=10.0.0.1 interface=ether11 network=10.0.0.1
As noted previously the dhcp-server indicates bridge.. so no consistency.interface=LAN name=dhcp1
Conclusion: You didnt read my post at all, and thus I cannot help further , hopefully someone else has more patience, good luck.
OliZi
November 22, 2023, 6:42pm
7
hi,
sorry, I don’t got what you meant.
this line :
but what’s wrong with this line?bridge-LAN name=dhcp1
I renamed LAN to bridge-LAN as you told me.
eth11 = my local network
why needs the bridge there own ip?!?
anav
November 22, 2023, 7:45pm
8
The point being,
and yet dont see the problem, means you either dont understand networking, or mikrotik OS, or both.How bout ether8, what is that connected to as its also on the bridge… what IPs do the users get connected to ether8.What I am saying is you dont need any bridge.
OliZi
November 22, 2023, 9:18pm
9
ok, I thought the bridge work like a internal switch.
If you could give me the next idea?
/interface ethernetdomain=dom-01.net https://dns.google/dns-query > verify-doh-cert=yesDROP_IN
anav
November 25, 2023, 10:47pm
10
(1) Order of firewall rules fixed.
/interface ethernet
set [ find default-name=ether1 ] name=WAN1
set [ find default-name=ether2 ] name=WAN2
set [ find default-name=ether3 ] name=WAN3
set [ find default-name=ether4 ] name=WAN4
set [ find default-name=ether5 ] name=WAN5
set [ find default-name=ether11 ] name=ether11-LAN
/interface list
add name=WAN-list
add name=LAN-list
/routing table
add fib name=useWAN1
add fib name=useWAN2
add fib name=useWAN3
add fib name=useWAN4
add fib name=useWAN5
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
/ip pool
add name=dhcp_pool0 ranges=10.0.0.100-10.0.0.200
/ip dhcp-server
add address-pool=dhcp_pool0 disabled=no interface=ether11-LAN name=dhcp1
/interface list member
add interface=WAN1 list=WAN-list
add interface=WAN2 list=WAN-list
add interface=WAN3 list=WAN-list
add interface=WAN4 list=WAN-list
add interface=WAN5 list=WAN-list
add interface=ether11-LAN list=LAN-list
/ip address
add address=81.223.59.xxx/29 interface=WAN1 network=81.223.59.xxx
add address=10.0.0.1/24 interface=ether11-LAN network=10.0.0.0
add address=192.168.4.xxx/24 interface=WAN3 network=192.168.4.0
add address=192.168.7.50/24 interface=WAN4 network=192.168.7.0
add address=192.168.6.50/24 interface=WAN5 network=192.168.6.0
add address=192.168.3.20/24 interface=WAN2 network=192.168.3.0
add address=212.95.26.xxx/30 interface=WAN2 network=212.95.26.xxx
add address=212.95.26.xxx/29 interface=WAN3 network=212.95.26.xxx
add address=212.95.27.xxx/24 interface=WAN4 network=212.95.27.xxx
add address=176.66.79.xxx/16 interface=WAN5 network=176.66.0.xxx
/ip dhcp-client
add add-default-route=no interface=WAN5 use-peer-dns=no use-peer-ntp=no
add add-default-route=no interface=WAN2 use-peer-dns=no use-peer-ntp=no
add add-default-route=no interface=WAN3 use-peer-dns=no use-peer-ntp=no
add add-default-route=no interface=WAN4 use-peer-dns=no use-peer-ntp=no
/ip dhcp-server lease
add address=10.0.0.144 client-id=1:0:50:56:93:f0:9a mac-address=\
00:50:56:93:F0:9A server=dhcp1
/ip dhcp-server network
add address=10.0.0.0/24 dns-server=10.0.0.25,10.0.0.1 domain=dom-01.net \
gateway=10.0.0.1
/ip dns
set allow-remote-requests=yes servers=10.0.0.25 use-doh-server=\
https://dns.google/dns-query verify-doh-cert=yes
/ip dns static
add address=8.8.8.8 name=dns.google
add address=8.8.4.4 name=dns.google
/ip firewall address-list
add address=10.0.0.69-10.0.0.70 list=PBR_LAN5
add address=10.0.0.1-10.0.0.99 list=DT_SERVER
add address=10.0.0.100-10.0.0.200 list=DT_DHCP
add address=10.0.0.201-10.0.0.253 list=DT_FIX
add address=10.0.0.XXx list=Authorized comment=admin-desktop
add addres=10.0.0.YYy list=Authorized comment=admin-latpop
add address=10.0.0.TTt list=Authorized comment=admin-smartphone/ipad
/ip firewall filter
add action=accept chain=input comment=\
"Allow Established/Related/Untracked connections" connection-state=\
established,related
add action=drop chain=input comment="Drop Invalid" connection-state=invalid
add action=accept chain=input comment="Allow ICMP" protocol=icmp
add action=accept chain=input comment="defconf: accept to local loopback (for CAPsMAN)" dst-address=127.0.0.1
add action=accept chain=input comment="allow admin access only" src-address-list=Authorized
add action=accept chain=input comment="DNS nicht von extern" dst-port=53 \
protocol=tcp in-interface-list=LAN-list
add action=accept chain=input dst-port=53 protocol=udp in-interface-list=Lan-list
add action=drop chain=input comment="Drop everything else" log=no \
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" \
connection-state=established,related connection-mark=no-mark
add action=accept chain=forward comment="forward established untracked" \
connection-state=established,related,untracked
add action=drop chain=forward comment="Forward Drop invalid " \
connection-state=invalid
add action=accept chain=forward comment="port forward" connection-nat-state=dstnat
add action=accept chain=forward comment="allow internet traffic" \
in-interface-list=LAN-list out-interface-list=WAN-list
add action=drop chain=forward comment="forward drop anything"
/ip firewall nat
add action=masquerade chain=srcnat out-interface-list=WAN-list
add action=dst-nat chain=dstnat comment="testwebsite W1" dst-address=\
81.223.59.xxx dst-port=80 protocol=tcp to-addresses=10.0.0.100 to-ports=\
4400
add action=dst-nat chain=dstnat comment="testwebsite W4" dst-address=\
212.95.27.xxx dst-port=80 protocol=tcp to-addresses=10.0.0.100 to-ports=\
4400
add action=dst-nat chain=dstnat comment="testwebsite W5" dst-address=\
176.66.79.xxx dst-port=80 protocol=tcp to-addresses=10.0.0.100 to-ports=\
4400
add action=dst-nat chain=dstnat comment="test website W3" dst-address=\
212.95.26.xxx dst-address-type=local dst-port=80,443,22 protocol=tcp \
to-addresses=10.0.0.100 to-ports=4400
add action=dst-nat chain=dstnat comment="test website W2" dst-address=\
212.95.26.xxx dst-address-type=local dst-port=80,443,22 protocol=tcp \
to-addresses=10.0.0.100 to-ports=4400
add action=dst-nat chain=dstnat dst-address=212.95.26.xxx dst-address-type=\
local dst-port=22 in-interface=WAN3 protocol=udp to-addresses=10.0.0.144 \
to-ports=22
add action=masquerade chain=srcnat out-interface-list=WAN-list
/ip firewall mangle
comment=" The following 10 mangles ensure traffic coming in on WANX, goes out WANX"
add action=mark-connections chain=prerouting connection-mark=no-mark \
in-interface=WAN1 new-connection-mark=incomingWAN1 passthrough=yes
add action=mark-connections chain=prerouting connection-mark=no-mark \
in-interface=WAN2 new-connection-mark=incomingWAN2 passthrough=yes
add action=mark-connections chain=prerouting connection-mark=no-mark \
in-interface=WAN3 new-connection-mark=incomingWAN3 passthrough=yes
add action=mark-connections chain=prerouting connection-mark=no-mark \
in-interface=WAN4 new-connection-mark=incomingWAN4 passthrough=yes
add action=mark-connections chain=prerouting connection-mark=no-mark \
in-interface=WAN5 new-connection-mark=incomingWAN5 passthrough=yes
add action=mark-routing chain=output connection-mark=incomingWAN1 \
new-routing-mark=useWAN1 passthrough=no
add action=mark-routing chain=output connection-mark=incomingWAN2 \
new-routing-mark=useWAN2 passthrough=no
add action=mark-routing chain=output connection-mark=incomingWAN3 \
new-routing-mark=useWAN3 passthrough=no
add action=mark-routing chain=output connection-mark=incomingWAN4 \
new-routing-mark=useWAN4 passthrough=no
add action=mark-routing chain=output connection-mark=incomingWAN5 \
new-routing-mark=useWAN5 passthrough=no
comment=" The following 10 mangles ensure PCC traffic for all 5 WANS"
add action=mark-connections chain=prerouting connection-mark=no-mark \
in-interface=ether11-LAN new-connection-mark=to-WAN1 dst-address-type=!local\
per-connection-classifier=both-addresses:5/0 passthrough=yes
add action=mark-connections chain=prerouting connection-mark=no-mark \
in-interface=ether11-LAN new-connection-mark=to-WAN2 dst-address-type=!local\
per-connection-classifier=both-addresses:5/1 passthrough=yes
add action=mark-connections chain=prerouting connection-mark=no-mark \
in-interface=ether11-LAN new-connection-mark=to-WAN3 dst-address-type=!local\
per-connection-classifier=both-addresses:5/2 passthrough=yes
add action=mark-connections chain=prerouting connection-mark=no-mark \
in-interface=ether11-LAN new-connection-mark=to-WAN4 dst-address-type=!local\
per-connection-classifier=both-addresses:5/3 passthrough=yes
add action=mark-connections chain=prerouting connection-mark=no-mark \
in-interface=ether11-LAN new-connection-mark=to-WAN5 dst-address-type=!local\
per-connection-classifier=both-addresses:5/4 passthrough=yes
add action=mark-routing chain=prerouting connection-mark=to-WAN1 \
new-routing-mark=useWAN1 passthrough=yes
add action=mark-routing chain=prerouting connection-mark=to-WAN2 \
new-routing-mark=useWAN2 passthrough=yes
add action=mark-routing chain=prerouting connection-mark=to-WAN3 \
new-routing-mark=useWAN3 passthrough=yes
add action=mark-routing chain=prerouting connection-mark=to-WAN4 \
new-routing-mark=useWAN4 passthrough=yes
add action=mark-routing chain=prerouting connection-mark=to-WAN5 \
new-routing-mark=useWAN5 passthrough=yes
/ip route
{ first 10 routes address the main table and recursive routing }
add check-gateway=ping distance=1 dst-address=0.0.0.0/0 gateway=1.1.1.1 scope=10 target-scope=12 routing-table=main
add check-gateway=ping distance=2 dst-address=0.0.0.0/0 gateway=1.0.0.1 scope=10 target-scope=12 routing-table=main
add check-gateway=ping distance=3 dst-address=0.0.0.0/0 gateway=9.9.9.9 scope=10 target-scope=12 routing-table=main
add check-gateway=ping distance=4 dst-address=0.0.0.0/0 gateway=208.67.222.222 scope=10 target-scope=12 routing-table=main
add check-gateway=ping distance=5 dst-address=0.0.0.0/0 gateway=94.140.14.14 scope=10 target-scope=12 routing-table=main
+++++++++++++++++++++++++++++
add check-gateway=ping distance=1 dst-address=1.1.1.1/32 gateway=ISP1 scope=10 target-scope=11 routing-table=main
add check-gateway=ping distance=2 dst-address=1.0.0.1/32 gateway=ISP2 scope=10 target-scope=11 routing-table=main
add check-gateway=ping distance=3 dst-address=9.9.9.9/32 gateway=ISP3 scope=10 target-scope=11 routing-table=main
add check-gateway=ping distance=4 dst-address=208.67.222.222/32 gateway=ISP4 scope=10 target-scope=11 routing-table=main
add check-gateway=ping distance=5 dst-address=94.140.14.14/32 gateway=ISP5 scope=10 target-scope=11 routing-table=main
{ the following 25 routes handle basic simple, pcc failover so that traffic from a failed WAN gets punted to the next available WAN }
add check-gateway=ping dst-address=0.0.0.0/0 gateway=ISP1-gateway routing-table=useWAN1 distance=1
add check-gateway=ping dst-address=0.0.0.0/0 gateway=ISP2-gateway routing-table=useWAN1 distance=2
add check-gateway=ping dst-address=0.0.0.0/0 gateway=ISP3-gateway routing-table=useWAN1 distance=3
add check-gateway=ping dst-address=0.0.0.0/0 gateway=ISP4-gateway routing-table=useWAN1 distance=4
add dst-address=0.0.0.0/0 gateway=ISP5-gateway routing-table=useWAN1 distance=5
add check-gateway=ping dst-address=0.0.0.0/0 gateway=ISP2-gateway routing-table=useWAN2 distance=1
add check-gateway=ping dst-address=0.0.0.0/0 gateway=ISP1-gateway routing-table=useWAN2 distance=2
add check-gateway=ping dst-address=0.0.0.0/0 gateway=ISP3-gateway routing-table=useWAN2 distance=3
add check-gateway=ping dst-address=0.0.0.0/0 gateway=ISP4-gateway routing-table=useWAN2 distance=4
add dst-address=0.0.0.0/0 gateway=ISP5-gateway routing-table=useWAN2 distance=5
add check-gateway=ping dst-address=0.0.0.0/0 gateway=ISP3-gateway routing-table=useWAN3 distance=1
add check-gateway=ping dst-address=0.0.0.0/0 gateway=ISP1-gateway routing-table=useWAN3 distance=2
add check-gateway=ping dst-address=0.0.0.0/0 gateway=ISP2-gateway routing-table=useWAN3 distance=3
add check-gateway=ping dst-address=0.0.0.0/0 gateway=ISP4-gateway routing-table=useWAN3 distance=4
add dst-address=0.0.0.0/0 gateway=ISP5-gateway routing-table=useWAN3 distance=5
add check-gateway=ping dst-address=0.0.0.0/0 gateway=ISP4-gateway routing-table=useWAN4 distance=1
add check-gateway=ping dst-address=0.0.0.0/0 gateway=ISP1-gateway routing-table=useWAN4 distance=2
add check-gateway=ping dst-address=0.0.0.0/0 gateway=ISP2-gateway routing-table=useWAN4 distance=3
add check-gateway=ping dst-address=0.0.0.0/0 gateway=ISP3-gateway routing-table=useWAN4 distance=4
add dst-address=0.0.0.0/0 gateway=ISP5-gateway routing-table=useWAN4 distance=5
add check-gateway=ping dst-address=0.0.0.0/0 gateway=ISP5-gateway routing-table=useWAN5 distance=1
add check-gateway=ping dst-address=0.0.0.0/0 gateway=ISP1-gateway routing-table=useWAN5 distance=2
add check-gateway=ping dst-address=0.0.0.0/0 gateway=ISP2-gateway routing-table=useWAN5 distance=3
add check-gateway=ping dst-address=0.0.0.0/0 gateway=ISP3-gateway routing-table=useWAN5 distance=4
add dst-address=0.0.0.0/0 gateway=ISP4-gateway routing-table=useWAN5 distance=5
anav
November 25, 2023, 10:47pm
11
The above handles all the rules required.
OliZi
November 26, 2023, 1:30pm
12
Hi,
I use router os ver 6.xx there are no /ip tables ?
in the meantime I try to find the error.
So traffic comes in, but not out?!?
I have seen that my external IP’s have overlapping Subnets.
I think I have a outgoing routing problem, but I don’t know why?
Here my actual config, adapted with the help from anav
If someone could help?
nov/26/2023 14:14:19 by RouterOS 6.49.10
/interface ethernetdomain=dom-01.net https://dns.google/dns-query > verify-doh-cert=yesDROP_IN
anav
November 26, 2023, 3:33pm
13
Wait you are still on vers 6?? My configs are predicated on vers 7
OliZi
November 26, 2023, 6:10pm
14
yes I am on 6.49
Is version 7 better? I found different statements to version 7.
anav
November 27, 2023, 12:39am
15
The improvements to many functions and the ability to do wireguard are huge reasons to move ahead.