Hello guys. First of all sorry for my ignorance, I’m not an IT expert and all my studies were in the field of geology. And it’s the first time using RouterOS!
I just converted my homelab from a (very power hungry) PFSense setup to a RB3011. I like it very much and have been able to replicate most of the stuff the PFSense firewall did, but then it all ground to a halt when I tried to implement the dual WAN setup.
Here is the network’s schematic.
PF_AIR is a 100/20 Mbit point to point wireless link.
PF_FTTC as the name implies is a 60/20 Mbit FTTC VDSL connection.
There is also a “last resort” LTE connection called TIM, but I’m honestly not that interested in that one for the moment (I’d like to sort the port forwarding before).
How I had implemented this on PFSense: PF_AIR and PF_FTTC had equal cost in the gateway parameters, and then I added normal port forwarding rules from both connections (so basically I had duplicate rules: one for port 80 for PF_FTTC; and another for port 80 for PF_AIR).
How I tried replicating this on RouterOS: I followed this guide: https://www.paolodaniele.it/mikrotik-aggregare-due-wan-con-pcc/ for PCC (I had to adjust the syntax because that guide was written for RouterOS 6), then I attempted to add port forwarding rules via the NAT tab in the firewall (dst-nat etc.). It appeared to work, but a day later it didn’t anymore (see below). So I searched in the forums and found this: http://forum.mikrotik.com/t/port-forwarding-using-pcc-help-required/70261/1 But that didn’t work either. Then, I tried another forum post: http://forum.mikrotik.com/t/big-confusion-pcc-with-nat-port-forwarding/115727/1 but to no avail either..
What works: The PCC appears to work as both connections get similar usage when looking at the statistics.
What does NOT work: Port forwarding is extremely erratic. Sometimes it works perfectly through both connections, sometimes only HTTP(S) works, sometimes it only works from PF_AIR, sometimes SSH works through PF_FTTC but not PF_AIR. And what’s even more troubling, is that when, for example, SSH works only through PF_FTTC for me, if I ask a friend, it might only work through PF_AIR for him! Same goes for HTTP.
This is the config:
# 2024-04-24 15:20:29 by RouterOS 7.14.3
# software id = Y09A-7J23
#
# model = RB3011UiAS
# serial number = ##############
/disk
add parent=usb1 partition-number=1 partition-offset=512 partition-size=\
"30 765 219 328" type=partition
/interface bridge
add admin-mac=B8:69:F4:98:60:FB auto-mac=no name=bridge-LAN port-cost-mode=\
short
/interface ethernet
set [ find default-name=ether1 ] name=ether1-PF_AIR
set [ find default-name=ether2 ] name=ether2-TIM
set [ find default-name=ether5 ] name=ether5-LAN2
/interface wireguard
add comment=back-to-home-vpn listen-port=10434 mtu=1420 name=back-to-home-vpn
/interface vlan
add interface=bridge-LAN name=vlan10-Ospiti vlan-id=10
add interface=bridge-LAN name=vlan11-IoT vlan-id=11
add interface=bridge-LAN name=vlan13-Inaffidabile vlan-id=13
/interface pppoe-client
add add-default-route=yes interface=ether1-PF_AIR name=PF-AIR user=\
air218@pianetafibra.it
add add-default-route=yes disabled=no interface=sfp1 name=PF-FTTC \
use-peer-dns=yes user=fttc4250
/interface list
add comment=defconf name=WAN
add comment=defconf name=LAN
/interface lte apn
set [ find default=yes ] ip-type=ipv4 use-network-apn=no
/ip dhcp-server option
add code=160 name=160_Polycom value=\
"' http://172.16.20.215/provisioning/m1c2up6299fyn4'"
/ip pool
add name=dhcp ranges=172.16.30.2-172.16.30.254
add name=vpn ranges=192.168.89.2-192.168.89.255
add name=dhcp_pool2 ranges=192.168.12.2-192.168.12.254
add name=dhcp_pool3 ranges=192.168.10.2-192.168.10.254
add name=dhcp_pool4 ranges=192.168.11.2-192.168.11.254
add name=dhcp_pool5 ranges=192.168.13.2-192.168.13.254
/ip dhcp-server
add address-pool=dhcp interface=bridge-LAN lease-time=23h59m59s name=LAN_DHCP
add address-pool=dhcp_pool2 interface=ether5-LAN2 name=LAN2_DHCP
add address-pool=dhcp_pool3 interface=vlan10-Ospiti name=Ospiti_DHCP
add address-pool=dhcp_pool4 interface=vlan11-IoT name=IoT_DHCP
add address-pool=dhcp_pool5 interface=vlan13-Inaffidabile name=\
Inaffidabile_DHCP
/ip smb users
add name=admin
/port
set 0 name=serial0
/ppp profile
set *FFFFFFFE local-address=192.168.89.1 remote-address=vpn
/queue simple
add comment="Limite Ospiti" max-limit=1M/7M name=Ospiti target=\
192.168.10.0/24
add comment="Limite AptDis" max-limit=1M/10M name=AptDis target=\
192.16.12.0/24
add comment="Limite Inaffidabile" max-limit=500k/5M name=Inaffidabile target=\
192.168.13.0/24
/routing table
add disabled=no fib name=to_FTTC
add disabled=no fib name=to_AIR
/ip smb
set comment=MIKROTIK domain=WORKGROUP interfaces=bridge-LAN
/interface bridge port
add bridge=bridge-LAN comment=defconf ingress-filtering=no interface=ether6 \
internal-path-cost=10 path-cost=10
add bridge=bridge-LAN comment=defconf ingress-filtering=no interface=ether7 \
internal-path-cost=10 path-cost=10
add bridge=bridge-LAN comment=defconf ingress-filtering=no interface=ether8 \
internal-path-cost=10 path-cost=10
add bridge=bridge-LAN comment=defconf ingress-filtering=no interface=ether9 \
internal-path-cost=10 path-cost=10
add bridge=bridge-LAN comment=defconf ingress-filtering=no interface=ether10 \
internal-path-cost=10 path-cost=10
add bridge=bridge-LAN comment=defconf disabled=yes ingress-filtering=no \
interface=sfp1 internal-path-cost=10 path-cost=10
/ip firewall connection tracking
set udp-timeout=10s
/ip neighbor discovery-settings
set discover-interface-list=LAN
/ip settings
set max-neighbor-entries=8192
/ipv6 settings
set disable-ipv6=yes max-neighbor-entries=8192
/interface bridge vlan
add bridge=bridge-LAN tagged=vlan10-Ospiti,vlan11-IoT,vlan13-Inaffidabile \
vlan-ids=10,11,13
/interface l2tp-server server
set enabled=yes use-ipsec=yes
/interface list member
add comment=defconf interface=bridge-LAN list=LAN
add interface=PF-FTTC list=WAN
add interface=PF-AIR list=WAN
/interface ovpn-server server
set auth=sha256,sha512 certificate=a-centauri cipher=\
blowfish128,aes256-cbc,aes256-gcm enabled=yes protocol=udp \
redirect-gateway=def1
/interface pptp-server server
# PPTP connections are considered unsafe, it is suggested to use a more modern V N protocol instead
set authentication=pap,chap,mschap1,mschap2 enabled=yes
/interface sstp-server server
set default-profile=default-encryption
/ip address
add address=172.16.20.1/16 comment=LAN interface=bridge-LAN network=\
172.16.0.0
add address=192.168.12.1/24 comment=LAN2 interface=ether5-LAN2 network=\
192.168.12.0
add address=192.168.10.1/24 comment=Ospiti interface=vlan10-Ospiti network=\
192.168.10.0
add address=192.168.11.1/24 comment=IoT interface=vlan11-IoT network=\
192.168.11.0
add address=192.168.13.1/24 comment=Inaffidabile interface=\
vlan13-Inaffidabile network=192.168.13.0
add address=192.168.2.1/24 comment=TIM interface=ether2-TIM network=\
192.168.2.0
/ip cloud
set back-to-home-vpn=enabled ddns-enabled=yes
/ip dhcp-server lease
add address=172.16.20.161 mac-address=BC:DD:C2:44:1E:DA server=LAN_DHCP
add address=172.16.20.233 client-id=1:b8:27:eb:f7:41:9f comment=Marconi \
mac-address=B8:27:EB:F7:41:9F server=LAN_DHCP
add address=172.16.30.244 dhcp-option=160_Polycom mac-address=\
64:16:7F:0B:F6:FA server=LAN_DHCP
add address=172.16.20.235 client-id=1:b8:27:eb:be:70:8f mac-address=\
B8:27:EB:BE:70:8F server=LAN_DHCP
add address=172.16.20.212 client-id=1:b8:27:eb:cf:86:71 mac-address=\
B8:27:EB:CF:86:71 server=LAN_DHCP
add address=172.16.25.42 client-id=1:0:60:35:6:f0:16 mac-address=\
00:60:35:06:F0:16 server=LAN_DHCP
add address=172.16.22.100 client-id=\
ff:11:e4:49:24:0:1:0:1:2d:a7:ed:cd:bc:24:11:e4:49:24 mac-address=\
BC:24:11:E4:49:24 server=LAN_DHCP
add address=172.16.20.215 client-id=1:bc:24:11:9e:f2:3 mac-address=\
BC:24:11:9E:F2:03 server=LAN_DHCP
add address=172.16.20.211 client-id=\
ff:11:6e:18:77:0:1:0:1:2d:a5:b3:f5:bc:24:11:6e:18:77 mac-address=\
BC:24:11:6E:18:77 server=LAN_DHCP
add address=172.16.20.160 client-id=1:d8:3a:dd:a7:d6:5e comment=Helios \
mac-address=D8:3A:DD:A7:D6:5E server=LAN_DHCP
add address=172.16.20.230 comment=SunFire mac-address=00:03:BA:16:77:13 \
server=LAN_DHCP
add address=172.16.23.1 client-id=1:0:a0:c5:b9:35:b1 mac-address=\
00:A0:C5:B9:35:B1 server=LAN_DHCP
/ip dhcp-server network
add address=172.16.0.0/16 comment=LAN dns-server=172.16.20.211,172.16.20.210 \
gateway=172.16.20.1 netmask=16
add address=192.168.10.0/24 dns-server=172.16.20.211,172.16.20.210 gateway=\
192.168.10.1
add address=192.168.11.0/24 dns-server=172.16.20.211,172.16.20.210 gateway=\
192.168.11.1
add address=192.168.12.0/24 dns-server=172.16.20.211,172.16.20.210 gateway=\
192.168.12.1
add address=192.168.13.0/24 dns-server=172.16.20.211,172.16.20.210 gateway=\
192.168.13.1
/ip dns static
add address=172.16.20.1 comment=defconf name=router.lan
/ip firewall filter
add action=accept chain=input comment=\
"defconf: accept established,related,untracked" connection-state=\
established,related,untracked
add action=accept chain=input comment="allow IPsec NAT" dst-port=4500 \
protocol=udp
add action=accept chain=input comment="allow IKE" dst-port=500 protocol=udp
add action=accept chain=input comment="allow l2tp" dst-port=1701 protocol=udp
add action=accept chain=input comment="allow pptp" dst-port=1723 protocol=tcp
add action=accept chain=input comment="allow sstp" dst-port=443 protocol=tcp
add action=drop chain=input comment="defconf: drop invalid" connection-state=\
invalid
add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp
add action=accept chain=input comment=\
"defconf: accept to local loopback (for CAPsMAN)" dst-address=127.0.0.1
add action=accept chain=forward comment="defconf: accept in ipsec policy" \
ipsec-policy=in,ipsec
add action=accept chain=forward comment="defconf: accept out ipsec policy" \
ipsec-policy=out,ipsec
add action=accept chain=forward comment=\
"defconf: accept established,related, untracked" connection-state=\
established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" \
connection-state=invalid
add action=drop chain=forward comment=\
"defconf: drop all from WAN not DSTNATed" connection-nat-state=!dstnat \
connection-state=new in-interface-list=WAN
add action=drop chain=input comment="Deny SSH from WAN" dst-port=22 \
in-interface-list=WAN protocol=tcp
add action=drop chain=input comment="Deny telnet from WAN" dst-port=23 \
in-interface-list=WAN protocol=tcp
/ip firewall mangle
add action=mark-connection chain=forward comment="PF-AIR Forward" disabled=\
yes in-interface=PF-AIR new-connection-mark=AIR_conn passthrough=yes
add action=mark-connection chain=forward comment="PF-FTTC forward" disabled=\
yes in-interface=PF-FTTC new-connection-mark=FTTC_conn passthrough=yes
add action=mark-connection chain=prerouting comment="PF-AIR PortForward" \
disabled=yes dst-address-type=!local in-interface=PF-AIR \
new-connection-mark=AIR_conn passthrough=yes
add action=mark-connection chain=prerouting comment="PF-FTTC PortForward" \
disabled=yes dst-address-type=!local in-interface=PF-FTTC \
new-connection-mark=FTTC_conn passthrough=yes
add action=mark-connection chain=input in-interface=PF-FTTC \
new-connection-mark=FTTC_conn
# PF-AIR not ready
add action=mark-connection chain=input in-interface=PF-AIR \
new-connection-mark=AIR_conn
add action=mark-routing chain=output connection-mark=FTTC_conn \
new-routing-mark=to_FTTC
add action=mark-routing chain=output connection-mark=AIR_conn \
new-routing-mark=to_AIR
add action=mark-connection chain=prerouting dst-address-type=!local \
in-interface=bridge-LAN new-connection-mark=FTTC_conn passthrough=yes \
per-connection-classifier=both-addresses-and-ports:2/0
add action=mark-connection chain=prerouting dst-address-type=!local \
in-interface=bridge-LAN new-connection-mark=AIR_conn passthrough=yes \
per-connection-classifier=both-addresses-and-ports:2/1
add action=mark-routing chain=prerouting connection-mark=FTTC_conn \
in-interface=bridge-LAN new-routing-mark=to_FTTC
add action=mark-routing chain=prerouting connection-mark=AIR_conn \
in-interface=bridge-LAN new-routing-mark=to_AIR
/ip firewall nat
add action=masquerade chain=srcnat comment="masq. vpn traffic" src-address=\
192.168.89.0/24
add action=dst-nat chain=dstnat comment="SunFire HTTPS" dst-port=443 \
in-interface-list=WAN protocol=tcp to-addresses=172.16.20.230 to-ports=\
443
add action=dst-nat chain=dstnat comment="SunFire FTP" dst-port=21 \
in-interface-list=WAN protocol=tcp to-addresses=172.16.20.230 to-ports=21
add action=dst-nat chain=dstnat comment="SunFire HTTP" dst-port=80 \
in-interface-list=WAN protocol=tcp to-addresses=172.16.20.230 to-ports=80
add action=dst-nat chain=dstnat comment="SunFire SSH" dst-port=2222 \
in-interface-list=WAN protocol=tcp to-addresses=172.16.20.230 to-ports=22
add action=dst-nat chain=dstnat comment="Webmin sunfire" dst-port=10000 \
in-interface-list=WAN protocol=tcp to-addresses=172.16.20.230 to-ports=\
10000
add action=dst-nat chain=dstnat comment=Minecraft dst-port=25565 \
in-interface-list=WAN protocol=tcp to-addresses=172.16.20.220 to-ports=\
25565
add action=dst-nat chain=dstnat comment="Minecraft Dynmap" dst-port=8123 \
in-interface-list=WAN protocol=tcp to-addresses=172.16.20.220 to-ports=\
8123
add action=dst-nat chain=dstnat comment="SSH Pi5 JVital" dst-port=52233 \
in-interface-list=WAN protocol=tcp to-addresses=172.16.20.160 to-ports=22
add action=masquerade chain=srcnat out-interface=PF-FTTC
# PF-AIR not ready
add action=masquerade chain=srcnat out-interface=PF-AIR
add action=masquerade chain=srcnat comment="defconf: masquerade" \
ipsec-policy=out,none out-interface-list=WAN
/ip route
add check-gateway=ping dst-address=0.0.0.0/0 gateway=PF-FTTC routing-table=\
to_FTTC
add check-gateway=ping dst-address=0.0.0.0/0 gateway=PF-AIR routing-table=\
to_AIR
/ip service
set www-ssl address=0.0.0.0/0 certificate=a-centauri disabled=no tls-version=\
only-1.2
/ip smb shares
add directory=usb1-part1 name=USB1 valid-users=guest
/ip upnp
set enabled=yes
/ip upnp interfaces
add interface=PF-AIR type=external
/ppp aaa
set use-radius=yes
/ppp secret
add name=vpn
add name=J2 profile=default-encryption
/radius
add accounting-backup=yes address=172.16.20.216 comment=RADIUS service=\
ppp,login,hotspot,ipsec,dot1x
/routing bfd configuration
add disabled=no interfaces=all min-rx=200ms min-tx=200ms multiplier=5
/system clock
set time-zone-name=Europe/Rome
/system identity
set name=MikroTik-VR
/system note
set show-at-login=no
/system ntp client
set enabled=yes
/system ntp server
set enabled=yes use-local-clock=yes
/system ntp client servers
add address=time.inrim.it
add address=ntp1.inrim.it
/tool graphing interface
add allow-address=172.16.0.0/16
/tool mac-server
set allowed-interface-list=LAN
/tool mac-server mac-winbox
set allowed-interface-list=LAN
Thank you a LOT in advance for any pointers you might give me!
