PCC with 1:1 NAT issue

RouterOS General
1

hi, first time here. Would like to get inputs for a possible fix on the issue below:

  1. Configured PCC with 3 wan. Working flawlessly.
  2. *nix Proxy server connected to mikrotik router using it as an ISP loadbalancer. Working as it should.
    Issue:
  • configured the 1:1 NAT for the mikrotik router(2 interfaces) to forward SSH requests to the proxy server. The outside session seem to connect, but only syn-sent status. The issue lies in the PCC. the incoming SSH session forwards the reqeusts to the proxy server, but the response gets “balanced” from the PCC outgoing. So the session does not get established, since it goes in one of the gw, goes out the other.

What’s possibly wrong? or needs to be added?

Snippet of the configs.
/ip firewall mangle
add action=mark-routing chain=output connection-mark=WAN1_conn new-routing-mark=to_WAN1
add action=mark-routing chain=output connection-mark=WAN2_conn new-routing-mark=to_WAN2
add action=mark-routing chain=output connection-mark=WAN3_conn new-routing-mark=to_WAN3
add action=accept chain=prerouting dst-address=112.112.112.160/29 in-interface=Localnet
add action=accept chain=prerouting dst-address=111.111.111.120/29 in-interface=Localnet
add action=accept chain=prerouting dst-address=222.222.222.224/29 in-interface=Localnet
add action=mark-connection chain=prerouting dst-address-list=mid_address in-interface=Localnet new-connection-mark=ea_conn passthrough=yes
add action=mark-connection chain=prerouting dst-address-type=!local in-interface=Localnet new-connection-mark=WAN1_conn passthrough=yes per-connection-classifier=both-addresses-and-ports:3/0
add action=mark-connection chain=prerouting dst-address-type=!local in-interface=Localnet new-connection-mark=WAN2_conn passthrough=yes per-connection-classifier=both-addresses-and-ports:3/1
add action=mark-connection chain=prerouting dst-address-type=!local in-interface=Localnet new-connection-mark=WAN3_conn passthrough=yes per-connection-classifier=both-addresses-and-ports:3/2
add action=mark-routing chain=prerouting connection-mark=ea_conn dst-address-list=mid_address in-interface=Localnet new-routing-mark=to_ea
add action=mark-routing chain=prerouting connection-mark=WAN1_conn in-interface=Localnet new-routing-mark=to_WAN1
add action=mark-routing chain=prerouting connection-mark=WAN2_conn in-interface=Localnet new-routing-mark=to_WAN2
add action=mark-routing chain=prerouting connection-mark=WAN3_conn in-interface=Localnet new-routing-mark=to_WAN3
add action=mark-connection chain=input in-interface=ether1 new-connection-mark=WAN1_conn
add action=mark-connection chain=input in-interface=ether2 new-connection-mark=WAN2_conn
add action=mark-connection chain=input in-interface=ether3 new-connection-mark=WAN3_conn

/ip firewall nat
add action=dst-nat chain=dstnat dst-port=21 in-interface-list=All_WAN protocol=tcp to-addresses=11.0.0.1 to-ports=22
add action=dst-nat chain=dstnat dst-address=222.222.222.228 dst-port=22 in-interface-list=All_WAN protocol=tcp to-addresses=11.0.0.2
add action=dst-nat chain=dstnat dst-address=111.111.111.124 dst-port=22 in-interface-list=All_WAN protocol=tcp to-addresses=11.0.0.2 to-ports=22
add action=dst-nat chain=dstnat dst-address=112.112.112.164 dst-port=22 protocol=tcp to-addresses=11.0.0.2
add action=masquerade chain=srcnat out-interface=ether1
add action=masquerade chain=srcnat out-interface=ether2
add action=masquerade chain=srcnat out-interface=ether3

2

You already mark connections from internet with WANx_conn marks, but only when they are for router itself (last three mangle rules). If you change those rules from input to prerouting, it will work also for connections through router (dstnated ones). And then you just need to make sure that they won’t be re-marked later, by adding connection-mark=no-mark condition to PCC rules.

3

WOW! thanks! it worked!.. realized what you pointed out with regards to the last 3 mangle and no-marks on pcc, since it does not have to have new marks passing thru it.. Thanks again!