Problem with Load Balance PCC and routing

e1sacred · January 18, 2013, 5:32pm

I have created a Load Balance PCC with 2 lines VDSL 50MBit and everything is functioning correctly at the LBPCC. The only problem I am facing is that I have one more 24Mbit line only for gaming: e.g. when I say that the sport 27005 (CounterStrike) will exit from the Game Line (by mark routing), it still continues to be directed from the Load Balance.
Maybe I should make better routing. The conf is the following. in the Firewall, in the connections list for the sport 27005 says that uses as Reply Dst. Adress one of the two GW which I have for the Load Balance. In the Connection Mark says the right mark!
Should I set a ip route rule or have I made a mistake in the Mangle List? Is there a possibility I have overlooked something?
Thank you in advance.
Obviously I should make Bypass the LBPCC so it can function well the mark routing for the Game Line.

/ip address
add address=10.10.10.253/24 network=10.10.10.0 broadcast=10.10.10.255 interface=LAN
add address=192.168.3.10/24 network=192.168.3.0 broadcast=192.168.3.255 interface=LINE1
add address=192.168.4.10/24 network=192.168.4.0 broadcast=192.168.4.255 interface=LINE2
add address=192.168.1.10/24 network=192.168.1.0 broadcast=192.168.1.255 interface=GAME


/ip firewall mangle
add chain=input in-interface=LINE1 action=mark-connection new-connection-mark=LINE1_conn
add chain=input in-interface=LINE2 action=mark-connection new-connection-mark=LINE2_conn
add chain=input in-interface=GAME action=mark-connection new-connection-mark=GAME_conn


add chain=output connection-mark=LINE1_conn action=mark-routing new-routing-mark=to_LINE1
add chain=output connection-mark=LINE2_conn action=mark-routing new-routing-mark=to_LINE2
add chain=output connection-mark=GAME_conn action=mark-routing new-routing-mark=to_GAME


add chain=prerouting dst-address=192.168.1.0/24 action=accept in-interface=LAN
add chain=prerouting dst-address=192.168.3.0/24 action=accept in-interface=LAN
add chain=prerouting dst-address=192.168.4.0/24 action=accept in-interface=LAN


add chain=prerouting dst-address-type=!local in-interface=LAN per-connection-classifier=both-addresses-and-ports:2/0 action=mark-connection new-connection-mark=LINE1_conn passthrough=yes
add chain=prerouting dst-address-type=!local in-interface=LAN per-connection-classifier=both-addresses-and-ports:2/1 action=mark-connection new-connection-mark=LINE2_conn passthrough=yes

add chain=prerouting connection-mark=LINE1_conn in-interface=LAN action=mark-routing new-routing-mark=to_LINE1
add chain=prerouting connection-mark=LINE2_conn in-interface=LAN action=mark-routing new-routing-mark=to_LINE2
add chain=prerouting connection-mark=GAME_conn in-interface=LAN action=mark-routing new-routing-mark=to_GAME


/ip route
add dst-address=0.0.0.0/0 gateway=192.168.3.1 routing-mark=to_LINE1 check-gateway=ping
add dst-address=0.0.0.0/0 gateway=192.168.4.1 routing-mark=to_LINE2 check-gateway=ping
add dst-address=0.0.0.0/0 gateway=192.168.1.254 routing-mark=to_GAME check-gateway=ping


add dst-address=0.0.0.0/0 gateway=192.168.3.1 distance=1 check-gateway=ping
add dst-address=0.0.0.0/0 gateway=192.168.4.1 distance=1 check-gateway=ping
add dst-address=0.0.0.0/0 gateway=192.168.1.254 distance=1 check-gateway=ping


/ip firewall nat
add chain=srcnat out-interface=LINE1 action=masquerade
add chain=srcnat out-interface=LINE2 action=masquerade
add chain=srcnat out-interface=GAME action=masquerade

/ip firewall mangle
add action=mark-connection chain=prerouting comment="Counter Strike" disabled=no src-port=27005 new-connection-mark="GAME_conn" passthrough=yes protocol=udp

Caci99 · January 18, 2013, 6:24pm

The order of the mangle rules is important, so you should put the “game” rules, above/before the PCC rules, so that they do not get processed further down and remarked by the PCC rules.

e1sacred · January 19, 2013, 8:27am

Okay so I did as he told me and works properly!!
Thank you very much.
But now when fall one router from the Load Balance or the both of them the traffic go and to the line for the games, how can I tell him that the line for the game will be only for the game and not for http and downloading.
Sorry for my english

minelli · January 19, 2013, 5:33pm

Hello e1sacred, please test these rules and see if it works as you need.

//IP ADDRESS - Add IPs
/ip address
add address=10.10.10.253/24 disabled=no network=10.10.10.0 broadcast=10.10.10.255 interface=LAN
add address=192.168.3.10/24 disabled=no network=192.168.3.0 broadcast=192.168.3.255 interface=LINE1
add address=192.168.4.10/24 disabled=no network=192.168.4.0 broadcast=192.168.4.255 interface=LINE2
add address=192.168.1.10/24 disabled=no network=192.168.1.0 broadcast=192.168.1.255 interface=GAME

//IP FIREWALL NAT
/ip firewall nat
add action=masquerade chain=srcnat comment="Nat - PCC" disabled=no src-address=10.10.10.0/24 to-addresses=0.0.0.0

//IP FIREWALL MANGLE - Add Rules
/ip firewall mangle
add action=mark-routing chain=prerouting comment="Counter Strike" disabled=no dst-port=27005 in-interface=EthClientes new-routing-mark=Route_Game passthrough=yes protocol=udp

//All that leaves is Sem_Balance by Default Route
add action=accept chain=prerouting comment="Sem Balance" disabled=no dst-address-list=sem_balance in-interface=EthClientes

//Mark Entry
add action=mark-connection chain=input comment="\"" disabled=no in-interface=LINE1 new-connection-mark=LINE1_conn passthrough=no
add action=mark-connection chain=input disabled=no in-interface=LINE2 new-connection-mark=LINE2_conn passthrough=no

//Marca Out
add action=mark-routing chain=output comment="''" connection-mark=LINE1_conn disabled=no new-routing-mark=to_LINE1 passthrough=no
add action=mark-routing chain=output connection-mark=LINE2_conn disabled=no new-routing-mark=to_LINE1 passthrough=no

//Marca Connections
add action=mark-connection chain=prerouting comment="''" disabled=no dst-address-type=!local in-interface=LAN new-connection-mark=LINE1_conn passthrough=yes per-connection-classifier=both-addresses-and-ports:2/0
add action=mark-connection chain=prerouting disabled=no dst-address-type=!local in-interface=LAN new-connection-mark=LINE2_conn passthrough=yes per-connection-classifier=both-addresses-and-ports:2/1

//Marca Rotes
add action=mark-routing chain=prerouting comment="''" connection-mark=LINE1_conn disabled=no in-interface=LAN new-routing-mark=to_nra passthrough=no
add action=mark-routing chain=prerouting connection-mark=LINE2_conn disabled=no in-interface=LAN new-routing-mark=to_nrb passthrough=no

//IP FIREWALL ADDRESS-LIST - Sites that do not pass through the balance
/ip firewall address-list
add address=200.198.182.152 comment=F2b disabled=no list=sem_balance

//IP Routes - Add Routes
/ip route
add check-gateway=ping disabled=no distance=1 dst-address=0.0.0.0/0 gateway=192.168.1.254 routing-mark=Route_Game scope=30 target-scope=10
add check-gateway=ping disabled=no distance=1 dst-address=0.0.0.0/0 gateway=192.168.3.1 routing-mark=to_nra scope=30 target-scope=10
add check-gateway=ping disabled=no distance=1 dst-address=0.0.0.0/0 gateway=192.168.4.1 routing-mark=to_nrb scope=30 target-scope=10
add check-gateway=ping disabled=no distance=1 dst-address=0.0.0.0/0 gateway=192.168.3.1 scope=30 target-scope=10
add check-gateway=ping disabled=no distance=2 dst-address=0.0.0.0/0 gateway=192.168.4.1 scope=30 target-scope=10

If that solves your problem please thank and ask for the closure of the topic.

Note: Please excuse my English as well speak only Portuguese.

e1sacred · January 21, 2013, 7:23am

Because I have some work to do to Answer During the During the day or tomorrow. Nevertheless I tried it and did not work as I would like .. and must have Kapi wrong in this command

add action=mark-routing chain=output connection-mark=LINE2_conn disabled=no new-routing-mark=to_LINE1 passthrough=no

should be so

add action=mark-routing chain=output connection-mark=LINE2_conn disabled=no new-routing-mark=to_LINE2 passthrough=no

e1sacred · February 11, 2013, 7:55am

The problem is that, if both load balance lines are down, I don’t have dns for the game line.
If I have the game line as gateway I can solve the problem but afterwards if load balance lines are down, everything goes through the gameline…

e1sacred · February 19, 2013, 7:00pm

Can anyone help me, or tell something to try.
I have searched everywhere but i can understand what happened!!
On the cisco 1841 and 877 i want only one hour to configure all of them..
The mikrotik router is new for me!!

dtoffo · February 19, 2013, 11:10pm

I suggest using distance in routes:

for DNS put three rules specific for your dns server with increasing distance, the third on your gaming interface gateway.

To void load balancing traffig going through the gaming interface, you can do the same the routing tables LINE1_conn e LINe2_conn: add an entry with higer distance toward the other load balancing gateway, and maybe a third with a fake gateway (without ping check, of course), so that traffic will never go everywere if not in one of the two load balancing gateways. If I understood, this is what you want: if line1 and line2 are down, their traffic is blocked but gaming interface continues to work.

e1sacred · February 22, 2013, 1:00pm

Thank you very much, nice idea.

e1sacred · April 5, 2013, 9:16am

Αnd the final configuration!!!

/ip address
add address=10.10.10.254/24 interface=ether1-LAN network=10.10.10.0
add address=192.168.1.253/24 interface=ether6-GAME network=192.168.1.0
add address=192.168.3.10/24 interface=ether7-LINE1 network=192.168.3.0
add address=192.168.4.10/24 interface=ether8-LINE2 network=192.168.4.0

/ip route
add check-gateway=ping distance=1 gateway=192.168.1.254 routing-mark=to_ether6-GAME scope=255
add check-gateway=ping distance=1 gateway=192.168.3.1 routing-mark=to_ether7-LINE1
add check-gateway=ping distance=1 gateway=192.168.4.1 routing-mark=to_ether8-LINE2
add check-gateway=ping distance=1 gateway=192.168.3.1
add check-gateway=ping distance=1 gateway=192.168.4.1

/ip dns
set allow-remote-requests=yes servers=192.168.1.254,192.168.3.1,192.168.4.1


/ip firewall mangle
add action=mark-routing chain=prerouting comment=ICMP dst-address-type=!local in-interface=ether1-LAN new-routing-mark=to_ether6-GAME passthrough=no protocol=icmp
add action=mark-routing chain=prerouting comment="Counter Strike" dst-address-type=!local in-interface=ether1-LAN new-routing-mark=to_ether6-GAME passthrough=no protocol=udp src-port=27005
add action=mark-routing chain=prerouting comment="CS Server" dst-address-type=!local in-interface=ether1-LAN new-routing-mark=to_ether6-GAME passthrough=no protocol=udp src-port=27015-27017
add action=mark-routing chain=prerouting comment="League OF Legends" dst-address-type=!local dst-port=5000-5500 in-interface=ether1-LAN new-routing-mark=to_ether6-GAME passthrough=no protocol=udp

------------THIS LINEs MAKING THE DIFFERENCE-------------------
add action=mark-connection chain=prerouting comment=Routing connection-mark=no-mark in-interface=ether6-GAME new-connection-mark=ether6-GAME_conn
add action=mark-routing chain=prerouting comment=Routing connection-mark=ether6-GAME_conn in-interface=ether1-LAN new-routing-mark=to_ether6-GAME
add chain=prerouting comment=Routing dst-address=192.168.1.0/24 in-interface=ether1-LAN 
------------THIS LINEs MAKING THE DIFFERENCE-------------------

add action=mark-connection chain=input comment=Routing in-interface=ether7-LINE1 new-connection-mark=ether7-LINE1_conn passthrough=no
add action=mark-connection chain=input comment=Routing in-interface=ether8-LINE2 new-connection-mark=ether8-LINE2_conn passthrough=no

add action=mark-routing chain=output comment=Routing connection-mark=ether7-LINE1_conn new-routing-mark=to_ether7-LINE1 passthrough=no
add action=mark-routing chain=output comment=Routing connection-mark=ether8-LINE2_conn new-routing-mark=to_ether8-LINE2 passthrough=no

add chain=prerouting comment=Routing dst-address=192.168.3.0/24 in-interface=ether1-LAN 
add chain=prerouting comment=Routing dst-address=192.168.4.0/24 in-interface=ether1-LAN 

add action=mark-connection chain=prerouting comment=Routing dst-address-type=!local in-interface=ether1-LAN new-connection-mark=ether7-LINE1_conn per-connection-classifier=both-addresses-and-ports:2/0
add action=mark-connection chain=prerouting comment=Routing dst-address-type=!local in-interface=ether1-LAN new-connection-mark=ether8-LINE2_conn per-connection-classifier=both-addresses-and-ports:2/1

add action=mark-routing chain=prerouting comment=Routing connection-mark=ether7-LINE1_conn in-interface=ether1-LAN new-routing-mark=to_ether7-LINE1 passthrough=no
add action=mark-routing chain=prerouting comment=Routing connection-mark=ether8-LINE2_conn in-interface=ether1-LAN new-routing-mark=to_ether8-LINE2 passthrough=no

/ip firewall nat
add action=masquerade chain=srcnat comment=GAMELINE out-interface=ether6-GAME
add action=masquerade chain=srcnat comment=LINE1 out-interface=ether8-LINE2
add action=masquerade chain=srcnat comment=LINE2 out-interface=ether7-LINE1
add action=dst-nat chain=dstnat comment="CS Server" dst-port=27015-27017 in-interface=ether6-GAME protocol=udp\
to-addresses=10.10.10.40 !to-ports