Problem with Port Forwarding in Dual Wan Scenario

RouterOS General
1

Hello Friends

I am not a expert here and don’t know much about scripting and commands which are required in Mikrotik routers.
But because of this great forum, I was able to setup my newly purchased RB3011 router.
In my case, i have 2 WAN’s on ether1 and ether2 and I have successfully setup dual wan with load balancing and it is working.
WAN on ether1 is having static public IP.
I have a MSSQL server which is required to sync data from other pc’s (which are located at other places and contact the static IP on WAN on Ether1).

Now the problem is that port forwarding to the MSSQL server is not working in case of Dual Wan and the moment I disable Ether2, it starts working.

I request the friends out here to solve this issue in simple language, so that I can understand it.


Thanks

2

Hi,

Please, show us your config in order to get a better idea. Copy&paste here content of command:

/export hide-sensitive

kind regards,

3

Thinking …

If you do only destination NAT then packet comming from outside reach MSSQL with public IP. MSQL answers so packets go via “load balanced” WANS so they could leave touter with different address than they have entered with into the router.
Therefore they possibly are dropped on the client side as kind of “attack” as they are not from the expected IP of WAN1.
Please read this: http://forum.mikrotik.com/t/port-forwarding-problem/93224/16

IMHO you need to do destination NAT and source nat for MSSQL traffic to let the router track sources of packets.

4 
# mar/17/2017 16:12:08 by RouterOS 6.37.5
# software id = INCE-TUXI
#
/interface bridge
add arp=proxy-arp name=bridge1
/ip dhcp-server
add add-arp=yes disabled=no interface=bridge1 name=dhcp1
/ip pool
add name=pool1 ranges=192.168.10.254-192.168.11.200
/interface bridge port
add bridge=bridge1 interface=ether3
add bridge=bridge1 interface=ether6
/interface l2tp-server server
set authentication=mschap1,mschap2
/interface pptp-server server
set default-profile=vpn
/ip accounting
set account-local-traffic=yes enabled=yes
/ip address
add address=10.0.1.249/24 comment=WAN1 interface=ether1 network=10.0.1.0
add address=10.0.4.46/24 comment=WAN2 interface=ether2 network=10.0.4.0
add address=192.168.10.110/24 comment="LOCAL LAN" interface=bridge1 network=\
    192.168.10.0
add address=192.168.11.110/24 comment="LOCAL LAN SLOW SPEED" interface=bridge1 \
    network=192.168.11.0
/ip cloud
set update-time=no
/ip dhcp-server network
add address=192.168.10.0/24 gateway=192.168.10.110
/ip dns
set allow-remote-requests=yes cache-size=5000KiB max-udp-packet-size=512 \
    servers=208.67.222.123,8.8.8.8
/ip firewall address-list
add address=192.168.10.0/24 list=LAN
add address=0.0.0.0/8 comment=Self-Identification list=bogons
add address=127.0.0.0/8 comment=Loopback list=bogons
add address=169.254.0.0/16 comment="Link Local" list=bogons
add address=172.16.0.0/12 comment="Private[RFC 1918] - CLASS B" list=bogons
add address=192.0.2.0/24 comment="Reserved - IANA - TestNet1" list=bogons
add address=192.88.99.0/24 comment="6to4 Relay Anycast [RFC 3068]" list=bogons
add address=198.18.0.0/15 comment="NIDB Testing" list=bogons
add address=198.51.100.0/24 comment="Reserved - IANA - TestNet2" list=bogons
add address=203.0.113.0/24 comment="Reserved - IANA - TestNet3" list=bogons
add address=224.0.0.0/4 comment=\
    "MC, Class D, IANA # Check if you need this subnet before enable it" list=\
    bogons
/ip firewall filter
add action=accept chain=input disabled=yes
add action=accept chain=output disabled=yes
add action=accept chain=forward disabled=yes
add action=accept chain=input comment="SQL SERVER PORT 1433" dst-address=\
    10.0.1.249 dst-port=1433 in-interface=ether1 protocol=tcp
add action=accept chain=input comment=VPN disabled=yes dst-port=1723 protocol=\
    tcp
add action=accept chain=input disabled=yes protocol=gre
add action=add-src-to-address-list address-list=Syn_Flooder \
    address-list-timeout=30m chain=input comment="Add Syn Flood IP to the list" \
    connection-limit=30,32 protocol=tcp tcp-flags=syn
add action=drop chain=input comment="Drop to syn flood list" src-address-list=\
    Syn_Flooder
add action=add-src-to-address-list address-list=Port_Scanner \
    address-list-timeout=1w chain=input comment="Port Scanner Detect" protocol=\
    tcp psd=21,3s,3,1
add action=drop chain=input comment="Drop to port scan list" src-address-list=\
    Port_Scanner
add action=jump chain=input comment="Jump for icmp input flow" jump-target=ICMP \
    protocol=icmp
add action=drop chain=input comment="Block all access to the winbox - except to \
    support list # DO NOT ENABLE THIS RULE BEFORE ADD YOUR SUBNET IN THE SUPPORT\
    \_ADDRESS LIST" dst-port=8291 protocol=tcp src-address-list=!LAN
add action=jump chain=forward comment="Jump for icmp forward flow" jump-target=\
    ICMP protocol=icmp
add action=drop chain=forward comment="Drop to bogon list" dst-address-list=\
    bogons
add action=add-src-to-address-list address-list=spammers address-list-timeout=\
    3h chain=forward comment="Add Spammers to the list for 3 hours" \
    connection-limit=30,32 dst-port=25,587 limit=30/1m,0 protocol=tcp
add action=drop chain=forward comment="Avoid spammers action" dst-port=25,587 \
    protocol=tcp src-address-list=spammers
add action=accept chain=input comment="Accept DNS - UDP" port=53 protocol=udp
add action=accept chain=input comment="Accept DNS - TCP" port=53 protocol=tcp
add action=accept chain=input comment="Accept to established connections" \
    connection-state=established
add action=accept chain=input comment="Accept to related connections" \
    connection-state=related
add action=accept chain=input comment="Full access to LAN address list" \
    src-address-list=LAN
add action=drop chain=input comment="Drop anything else! # DO NOT ENABLE THIS RU\
    LE BEFORE YOU MAKE SURE ABOUT ALL ACCEPT RULES YOU NEED"
add action=accept chain=ICMP comment="Echo request - Avoiding Ping Flood" \
    icmp-options=8:0 limit=1,5 protocol=icmp
add action=accept chain=ICMP comment="Echo reply" icmp-options=0:0 protocol=\
    icmp
add action=accept chain=ICMP comment="Time Exceeded" icmp-options=11:0 \
    protocol=icmp
add action=accept chain=ICMP comment="Destination unreachable" icmp-options=\
    3:0-1 protocol=icmp
add action=accept chain=ICMP comment=PMTUD icmp-options=3:4 protocol=icmp
add action=drop chain=ICMP comment="Drop to the other ICMPs" protocol=icmp
add action=jump chain=output comment="Jump for icmp output" jump-target=ICMP \
    protocol=icmp
add action=accept chain=input connection-nat-state=dstnat port=1433 protocol=\
    tcp
/ip firewall mangle
add action=mark-routing chain=prerouting dst-address=10.0.1.249 dst-port=1433 \
    in-interface=ether1 new-routing-mark=sql passthrough=yes protocol=tcp
add action=mark-connection chain=input in-interface=ether1 new-connection-mark=\
    WAN1_conn
add action=mark-connection chain=input in-interface=ether2 new-connection-mark=\
    WAN2_conn
add action=mark-routing chain=output connection-mark=WAN1_conn \
    new-routing-mark=to_WAN1
add action=mark-routing chain=output connection-mark=WAN2_conn \
    new-routing-mark=to_WAN2
add action=accept chain=prerouting dst-address=10.0.1.0/24 in-interface=bridge1
add action=accept chain=prerouting dst-address=10.0.4.0/24 in-interface=bridge1
add action=mark-connection chain=prerouting dst-address-type=!local \
    in-interface=bridge1 new-connection-mark=WAN1_conn passthrough=yes \
    per-connection-classifier=both-addresses-and-ports:2/0
add action=mark-connection chain=prerouting dst-address-type=!local \
    in-interface=bridge1 new-connection-mark=WAN2_conn passthrough=yes \
    per-connection-classifier=both-addresses-and-ports:2/1
add action=mark-routing chain=prerouting connection-mark=WAN1_conn \
    in-interface=bridge1 new-routing-mark=to_WAN1
add action=mark-routing chain=prerouting connection-mark=WAN2_conn \
    in-interface=bridge1 new-routing-mark=to_WAN2
/ip firewall nat
add action=masquerade chain=srcnat out-interface=ether1
add action=masquerade chain=srcnat disabled=yes out-interface=ether1
add action=masquerade chain=srcnat out-interface=ether2
add action=dst-nat chain=dstnat disabled=yes dst-address=192.168.10.1 dst-port=\
    1433 protocol=tcp src-address=192.168.10.110 to-addresses=192.168.10.1 \
    to-ports=1433
add action=dst-nat chain=dstnat disabled=yes dst-port=1433 protocol=udp \
    to-addresses=192.168.10.1 to-ports=1433
add action=dst-nat chain=dstnat disabled=yes dst-port=1434 protocol=udp \
    to-addresses=192.168.10.1 to-ports=1434
add action=src-nat chain=srcnat disabled=yes src-address=192.168.10.1 \
    to-addresses=10.0.1.249
add action=dst-nat chain=dstnat dst-port=1433 in-interface=ether1 log=yes \
    log-prefix=SQLSERVER protocol=tcp to-addresses=192.168.10.1 to-ports=1433
add action=dst-nat chain=dstnat dst-port=1433 in-interface=ether1 log=yes \
    log-prefix=SQLSERVER protocol=udp to-addresses=192.168.10.1 to-ports=1433
add action=dst-nat chain=dstnat dst-port=1434 in-interface=ether1 log=yes \
    log-prefix=SQLSERVER protocol=tcp to-addresses=192.168.10.1 to-ports=1433
add action=dst-nat chain=dstnat dst-port=1434 in-interface=ether1 log=yes \
    log-prefix=SQLSERVER protocol=udp to-addresses=192.168.10.1 to-ports=1433
/ip route
add check-gateway=ping distance=1 dst-address=0.0.0.0/32 gateway=ether1 \
    routing-mark=sql
add check-gateway=ping distance=1 gateway=10.0.1.241 routing-mark=to_WAN1
add check-gateway=ping distance=1 gateway=10.0.4.33 routing-mark=
add check-gateway=ping distance=1 gateway=10.0.1.241
add check-gateway=ping distance=2 gateway=10.0.4.33
/ppp profile
add dns-server=208.67.222.123,8.8.8.8 local-address=192.168.10.11
    remote-address=*2
/system clock
set time-zone-name=Asia/Kolkata
/system identity
set name=TyresShoppe_Router
/system logging
add topics=pptp
add topics=firewall
add topics=l2tp
/system ntp client
set enabled=yes primary-ntp=139.59.61.225 secondary-ntp=209.58.18

Thanks

5

Thank you for your kind reply, but everything is going above my mind when I try to understand the post. Can you please explain it to me in simple language ?

6

Simply:

If you send traffic from client to server using WAN1 and you receive answer, because of load balacing in the router, from WAN2 IP then antivirus at client PC trats it as dangerous and kills such traffic.

7

This is ok, but it only covers connections to router. To make it work also for forwarded ports, move it from input to prerouting:

/ip firewall mangle
add action=mark-connection chain=input in-interface=ether1 new-connection-mark=WAN1_conn
add action=mark-connection chain=input in-interface=ether2 new-connection-mark=WAN2_conn

These two need additional connection-mark=no-mark, otherwise they happily overwrite your previously set marks:

/ip firewall mangle
add action=mark-connection chain=prerouting dst-address-type=!local in-interface=bridge1 new-connection-mark=WAN1_conn passthrough=yes per-connection-classifier=both-addresses-and-ports:2/0
add action=mark-connection chain=prerouting dst-address-type=!local in-interface=bridge1 new-connection-mark=WAN2_conn passthrough=yes per-connection-classifier=both-addresses-and-ports:2/1

These are nonsense, you’re not running sql server on router itself:

/ip firewall filter
add action=accept chain=input comment="SQL SERVER PORT 1433" dst-address=10.0.1.249 dst-port=1433 in-interface=ether1 protocol=tcp
add action=accept chain=input connection-nat-state=dstnat port=1433 protocol=tcp

Since your default action for forward is allow, you don’t need to add anything there to make it work. But it’s not good config, you should do at least what RouterOS default config does:

/ip firewall filter
add action=drop chain=forward connection-nat-state=!dstnat connection-state=new in-interface=ether1
add action=drop chain=forward connection-nat-state=!dstnat connection-state=new in-interface=ether2

That would be after accepting established & related connections, which should be very first rule, because vast majority of packets will match that:

/ip firewall filter
add action=accept chain=forward connection-state=established,related

Bonus: You want to add in-interface=bridge1 to these (allow DNS only from LAN), because as they are now, they make you open resolver:

/ip firewall filter
add action=accept chain=input comment="Accept DNS - UDP" port=53 protocol=udp
add action=accept chain=input comment="Accept DNS - TCP" port=53 protocol=tcp
8

I have done all the above steps but still the outside pc’s cant contact the SQL server. They are only able to contact when I disable ether2.

Thanks

9

Try posting your updated config…

10 
/interface bridge
add arp=proxy-arp name=bridge1
/interface ethernet
set [ find default-name=ether1 ] comment=WAN1 mac-address=78:DA:6E:65:00:9D
set [ find default-name=ether2 ] comment=WAN2 disabled=yes mac-address=\
    78:DA:6E:65:00:9E
set [ find default-name=ether3 ] comment=\
    "Master Port 1 for LAN (Connected to Mohit Home Laptop_"
set [ find default-name=ether4 ] comment="Connected to TS5 Tower" master-port=\
    ether3
set [ find default-name=ether5 ] comment="Connected to Ground Floor WIFI" \
    master-port=ether3
set [ find default-name=ether6 ] bandwidth=2M/2M comment=\
    "Master Port 2 for LAN(Connected to Rohit WIFI)"
set [ find default-name=ether7 ] comment="Connected to DVR" master-port=ether6
set [ find default-name=ether8 ] comment="Connected to WD MyCloud" master-port=\
    ether6
set [ find default-name=ether9 ] master-port=ether6
set [ find default-name=ether10 ] master-port=ether6
set [ find default-name=sfp1 ] disabled=yes
/ip neighbor discovery
set ether1 comment=WAN1
set ether2 comment=WAN2
set ether3 comment="Master Port 1 for LAN (Connected to Mohit Home Laptop_"
set ether4 comment="Connected to TS5 Tower"
set ether5 comment="Connected to Ground Floor WIFI"
set ether6 comment="Master Port 2 for LAN(Connected to Rohit WIFI)"
set ether7 comment="Connected to DVR"
set ether8 comment="Connected to WD MyCloud"
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
/ip pool
add name=pool1 ranges=192.168.11.200-192.168.11.254
/ip dhcp-server
add add-arp=yes address-pool=pool1 disabled=no interface=bridge1 name=dhcp1
/queue simple
add comment="BANDWIDTH CONTROL ON 192.168.11.0 LAN" max-limit=256k/256k name=\
    BANDWIDTH_CONTROL target=192.168.11.0/24 time=\
    0s-1d,sun,mon,tue,wed,thu,fri,sat
add comment="BANDWIDTH CONTROL OF ANDROID TV BOX" max-limit=2M/2M name=\
    "TVBOX BANDWIDTH CONTROL" target=192.168.10.153/32
add max-limit=512k/512k name="TS MAIN OFFICE 3" target=192.168.10.5/32
add max-limit=2M/2M name="RJ SAMSUNG" target=192.168.10.11/32
add max-limit=2M/2M name=REEMA1+2 target=192.168.10.9/32
add max-limit=512k/512k name="TSMAIN OFFICE 2" target=192.168.10.14/32
add max-limit=512k/512k name=MICHELINKIOSK target=192.168.10.207/32
add max-limit=2M/2M name=SUNIL_SAMSUNG target=192.168.10.17/32
add max-limit=2M/2M name=POONAM_SAMSUNG target=192.168.10.18/32
add max-limit=1M/1M name="PRIYA VIVO" target=192.168.10.15/32
add max-limit=512k/512k name="TS16 LAPPTOP" target=192.168.10.134/32
add max-limit=512k/512k name="TS66 LAPTOP" target=192.168.10.66/32
add max-limit=512k/512k name="TS66 ALIGNMENT" target=192.168.10.67/32
add max-limit=2M/2M name="SUNILJAIN S2 TAB" target=192.168.10.12/32
add max-limit=1M/2M name=IBALLtab66 target=192.168.10.19/32
/dude
set enabled=yes
/interface bridge port
add bridge=bridge1 interface=ether3
add bridge=bridge1 interface=ether6
/interface l2tp-server server
set authentication=mschap1,mschap2
/interface pptp-server server
set default-profile=vpn
/ip accounting
set account-local-traffic=yes enabled=yes
/ip address
add address=10.0.1.249/24 comment=WAN1 interface=ether1 network=10.0.1.0
add address=10.0.4.46/24 comment=WAN2 interface=ether2 network=10.0.4.0
add address=192.168.10.110/24 comment="LOCAL LAN" interface=bridge1 network=\
    192.168.10.0
add address=192.168.11.110/24 comment="LOCAL LAN SLOW SPEED" interface=bridge1 \
    network=192.168.11.0
/ip cloud
set ddns-enabled=yes
/ip dhcp-server network
add address=192.168.10.0/24 gateway=192.168.10.110
/ip dns
set allow-remote-requests=yes cache-size=5000KiB max-udp-packet-size=512 \
    servers=208.67.222.123,8.8.8.8
/ip firewall address-list
add address=192.168.10.0/24 list=LAN
add address=0.0.0.0/8 comment=Self-Identification list=bogons
add address=127.0.0.0/8 comment=Loopback list=bogons
add address=169.254.0.0/16 comment="Link Local" list=bogons
add address=172.16.0.0/12 comment="Private[RFC 1918] - CLASS B" list=bogons
add address=192.0.2.0/24 comment="Reserved - IANA - TestNet1" list=bogons
add address=192.88.99.0/24 comment="6to4 Relay Anycast [RFC 3068]" list=bogons
add address=198.18.0.0/15 comment="NIDB Testing" list=bogons
add address=198.51.100.0/24 comment="Reserved - IANA - TestNet2" list=bogons
add address=203.0.113.0/24 comment="Reserved - IANA - TestNet3" list=bogons
add address=224.0.0.0/4 comment=\
    "MC, Class D, IANA # Check if you need this subnet before enable it" list=\
    bogons
add address=103.18.72.122 list="93 IP"
add address=150.242.61.61 list="104 IP"
/ip firewall filter
add action=accept chain=forward connection-state=established,related
add action=drop chain=forward connection-nat-state=!dstnat connection-state=new \
    in-interface=ether1
add action=accept chain=input comment="Accept DNS - UDP" port=53 protocol=udp
add action=accept chain=input comment="Accept DNS - TCP" port=53 protocol=tcp
add action=drop chain=forward connection-nat-state=!dstnat connection-state=new \
    in-interface=ether2
add action=accept chain=input disabled=yes
add action=accept chain=output disabled=yes
add action=accept chain=forward disabled=yes
add action=accept chain=input comment=VPN disabled=yes dst-port=1723 protocol=\
    tcp
add action=accept chain=input disabled=yes protocol=gre
add action=add-src-to-address-list address-list=Syn_Flooder \
    address-list-timeout=30m chain=input comment="Add Syn Flood IP to the list" \
    connection-limit=30,32 protocol=tcp tcp-flags=syn
add action=drop chain=input comment="Drop to syn flood list" src-address-list=\
    Syn_Flooder
add action=add-src-to-address-list address-list=Port_Scanner \
    address-list-timeout=1w chain=input comment="Port Scanner Detect" protocol=\
    tcp psd=21,3s,3,1
add action=drop chain=input comment="Drop to port scan list" src-address-list=\
    Port_Scanner
add action=jump chain=input comment="Jump for icmp input flow" jump-target=ICMP \
    protocol=icmp
add action=drop chain=input comment="Block all access to the winbox - except to \
    support list # DO NOT ENABLE THIS RULE BEFORE ADD YOUR SUBNET IN THE SUPPORT\
    \_ADDRESS LIST" dst-port=8291 protocol=tcp src-address-list=!LAN
add action=jump chain=forward comment="Jump for icmp forward flow" jump-target=\
    ICMP protocol=icmp
add action=drop chain=forward comment="Drop to bogon list" dst-address-list=\
    bogons
add action=add-src-to-address-list address-list=spammers address-list-timeout=\
    3h chain=forward comment="Add Spammers to the list for 3 hours" \
    connection-limit=30,32 dst-port=25,587 limit=30/1m,0 protocol=tcp
add action=drop chain=forward comment="Avoid spammers action" dst-port=25,587 \
    protocol=tcp src-address-list=spammers
add action=accept chain=input comment="Accept DNS - UDP" port=53 protocol=udp
add action=accept chain=input comment="Accept DNS - TCP" port=53 protocol=tcp
add action=accept chain=input comment="Accept to established connections" \
    connection-state=established
add action=accept chain=input comment="Accept to related connections" \
    connection-state=related
add action=accept chain=input comment="Full access to LAN address list" \
    src-address-list=LAN
add action=drop chain=input comment="Drop anything else! # DO NOT ENABLE THIS RU\
    LE BEFORE YOU MAKE SURE ABOUT ALL ACCEPT RULES YOU NEED"
add action=accept chain=ICMP comment="Echo request - Avoiding Ping Flood" \
    icmp-options=8:0 limit=1,5 protocol=icmp
add action=accept chain=ICMP comment="Echo reply" icmp-options=0:0 protocol=\
    icmp
add action=accept chain=ICMP comment="Time Exceeded" icmp-options=11:0 \
    protocol=icmp
add action=accept chain=ICMP comment="Destination unreachable" icmp-options=\
    3:0-1 protocol=icmp
add action=accept chain=ICMP comment=PMTUD icmp-options=3:4 protocol=icmp
add action=drop chain=ICMP comment="Drop to the other ICMPs" protocol=icmp
add action=jump chain=output comment="Jump for icmp output" jump-target=ICMP \
    protocol=icmp
/ip firewall mangle
add action=mark-routing chain=prerouting dst-address=10.0.1.249 dst-port=1433 \
    in-interface=ether1 new-routing-mark=sql passthrough=yes protocol=tcp
add action=mark-connection chain=input in-interface=ether1 new-connection-mark=\
    WAN1_conn
add action=mark-connection chain=input in-interface=ether2 new-connection-mark=\
    WAN2_conn
add action=mark-routing chain=output connection-mark=WAN1_conn \
    new-routing-mark=to_WAN1
add action=mark-routing chain=output connection-mark=WAN2_conn \
    new-routing-mark=to_WAN2
add action=accept chain=prerouting dst-address=10.0.1.0/24 in-interface=bridge1
add action=accept chain=prerouting dst-address=10.0.4.0/24 in-interface=bridge1
add action=mark-connection chain=prerouting dst-address-type=!local \
    in-interface=bridge1 new-connection-mark=WAN1_conn passthrough=yes \
    per-connection-classifier=both-addresses-and-ports:2/0
add action=mark-connection chain=prerouting dst-address-type=!local \
    in-interface=bridge1 new-connection-mark=WAN2_conn passthrough=yes \
    per-connection-classifier=both-addresses-and-ports:2/1
add action=mark-routing chain=prerouting connection-mark=WAN1_conn \
    in-interface=bridge1 new-routing-mark=to_WAN1
add action=mark-routing chain=prerouting connection-mark=WAN2_conn \
    in-interface=bridge1 new-routing-mark=to_WAN2
add action=mark-connection chain=input in-interface=ether1 new-connection-mark=\
    WAN1_conn passthrough=no
add action=mark-connection chain=input in-interface=ether2 new-connection-mark=\
    WAN2_conn passthrough=no
add action=mark-connection chain=prerouting dst-address-type=!local \
    in-interface=bridge1 new-connection-mark=WAN1_conn passthrough=yes \
    per-connection-classifier=both-addresses-and-ports:2/0
add action=mark-connection chain=prerouting dst-address-type=!local \
    in-interface=bridge1 new-connection-mark=WAN2_conn passthrough=yes \
    per-connection-classifier=both-addresses-and-ports:2/1
/ip firewall nat
add action=masquerade chain=srcnat out-interface=ether1
add action=masquerade chain=srcnat disabled=yes out-interface=ether1
add action=masquerade chain=srcnat out-interface=ether2
add action=dst-nat chain=dstnat disabled=yes dst-address=192.168.10.1 dst-port=\
    1433 protocol=tcp src-address=192.168.10.110 to-addresses=192.168.10.1 \
    to-ports=1433
add action=dst-nat chain=dstnat disabled=yes dst-port=1433 protocol=udp \
    to-addresses=192.168.10.1 to-ports=1433
add action=dst-nat chain=dstnat disabled=yes dst-port=1434 protocol=udp \
    to-addresses=192.168.10.1 to-ports=1434
add action=src-nat chain=srcnat disabled=yes src-address=192.168.10.1 \
    to-addresses=10.0.1.249
add action=dst-nat chain=dstnat dst-port=1433 in-interface=ether1 log=yes \
    log-prefix=SQLSERVER protocol=tcp to-addresses=192.168.10.1 to-ports=1433
add action=dst-nat chain=dstnat dst-port=1433 in-interface=ether1 log=yes \
    log-prefix=SQLSERVER protocol=udp to-addresses=192.168.10.1 to-ports=1433
add action=dst-nat chain=dstnat dst-port=1433 in-interface=ether1 log=yes \
    log-prefix=SQLSERVER protocol=tcp to-addresses=192.168.10.1 to-ports=1433
add action=dst-nat chain=dstnat dst-port=1433 in-interface=ether1 log=yes \
    log-prefix=SQLSERVER protocol=udp to-addresses=192.168.10.1 to-ports=1433
add action=dst-nat chain=dstnat dst-port=54548 in-interface=bridge1 protocol=\
    tcp to-addresses=192.168.10.130 to-ports=54548
add action=dst-nat chain=dstnat dst-port=54548 in-interface=bridge1 protocol=\
    udp to-addresses=192.168.10.130 to-ports=54548
/ip route
add check-gateway=ping disabled=yes distance=1 dst-address=0.0.0.0/32 gateway=\
    ether1 routing-mark=sql
add check-gateway=ping distance=1 gateway=10.0.1.241 routing-mark=to_WAN1
add check-gateway=ping distance=1 gateway=10.0.4.33 routing-mark=to_WAN2
add check-gateway=ping distance=1 gateway=10.0.1.241
add check-gateway=ping distance=2 gateway=10.0.4.33
/ppp profile
add dns-server=208.67.222.123,8.8.8.8 local-address=192.168.10.110 name=vpn \
    remote-address=*2
/ppp secret
add local-address=192.168.10.120 name=sector93 remote-address=192.168.10.121
add local-address=192.168.10.122 name=mohit1 remote-address=192.168.10.123
/system clock
set time-zone-name=Asia/Kolkata
11

I see some problems:

  1. Marking of incoming connections. You just duplicated original rules, so you now have double marking in input chain, but still none in prerouting.
  2. Skipping PCC marking for already marked connections. You again duplicated existing rules, but you did not add suggested connection-mark=no-mark to them, so even if you had 1) ok, it would not work.
  3. You are still open resolver.

It almost looks like you just pasted the code without paying much attention to description.

12

As I had mentioned earlier, that I am completely new to this routeros scenario and bought Mikrotik router on advice of my friend.
So I request the kind experts to guide me on how to resolve this issue. I would like you to post the exact commands so that the thing works. I can reset the configuration if you want and then again configure it based on your inputs.

Thanks