Hello. Please tell me is there any solution for this task:
I have Rb411U with two USB 3G-dongles connected, working with two different networks, so I have two ppp WANs named mts and megafon. They are running simultaneously with no problems.
Also I have two ovpn-clients to connect to OpenVPN server somewhere in Internet (say it have ip 1.2.3.4 and listens on two tcp ports, 1194 and 1196). I need one ovpn-client to use first WAN, and second uses another. If one ppp WAN goes down, so goes his ovpn-client.
So here is my settings. First, ovpn-clients:
[admin@MikroTik] > /interface ovpn-client print
Flags: X - disabled, R - running
0 X name="ovpn-megafon" mac-address=FE:0C:2C:41:3D:0A max-mtu=1400
connect-to=1.2.3.4 port=1194 mode=ip user="rb411-lop" password=""
profile=default certificate=rb411-lop auth=sha1 cipher=blowfish128
add-default-route=no
1 X name="ovpn-mts" mac-address=FE:B7:31:17:61:C9 max-mtu=1500
connect-to=1.2.3.4 port=1196 mode=ip user="rb411-lop2" password=""
profile=default certificate=rb411-lop2 auth=sha1 cipher=blowfish128
add-default-route=no
Now I set the rules to mark connections from ovpn-clients:
[admin@MikroTik] > /ip firewall mangle print
Flags: X - disabled, I - invalid, D - dynamic
0 chain=output action=mark-connection new-connection-mark=ovpnmts passthrough=yes connection-state=new protocol=tcp dst-address=1.2.3.4 dst-port=1196
1 chain=output action=mark-routing new-routing-mark=ovpnmts passthrough=yes connection-mark=ovpnmts
2 chain=output action=mark-connection new-connection-mark=ovpnmegafon passthrough=yes connection-state=new protocol=tcp dst-address=1.2.3.4 dst-port=1194
3 chain=output action=mark-routing new-routing-mark=ovpnmegafon passthrough=yes connection-mark=ovpnmegafon
Routing them to different gateways:
[admin@MikroTik] > /ip route print detail where disabled=no
Flags: X - disabled, A - active, D - dynamic, C - connect, S - static, r - rip, b - bgp, o - ospf, m - mme, B - blackhole, U - unreachable, P - prohibit
2 A S dst-address=1.2.3.4/32 gateway=mts gateway-status=mts reachable distance=1 scope=30 target-scope=10 routing-mark=ovpnmts
3 A S dst-address=1.2.3.4/32 gateway=megafon gateway-status=megafon reachable distance=1 scope=30 target-scope=10 routing-mark=ovpnmegafon
8 ADC dst-address=10.112.113.66/32 pref-src=10.180.28.6 gateway=megafon gateway-status=megafon reachable distance=0 scope=10
9 ADC dst-address=10.112.113.72/32 pref-src=10.133.5.79 gateway=mts gateway-status=mts reachable distance=0 scope=10
12 ADC dst-address=192.168.4.0/24 pref-src=192.168.4.3 gateway=Local gateway-status=Local reachable distance=0 scope=10
It doesn’t work, both ovpn-clients does not connect. If I set routing-mark=main to any of routing rules (2 or 3) - both clients got connected via one WAN.
So the problem is connections is not marking.
I learned about Packet Flow in RouterOS and found that traffic from local process (which is ovpn-client) first goes to routing-decision and then to firewall. So there is no way to do policy-based routing for local processes in RouterOS?