problem with VPN trafic and load balancing

RouterOS General
1

Hello
I have problems with VPN traffic and Load Balancing, i use the vpn for RDP connections, but no work

I have mkt router with 2 FTTH lines and use mangles to balance the traffic, i have the next problem with VPN L2TP
the connection is established correctly, the connection to the winbox via VPN works correctly, but when I try to establish a connection to the RDP of any computer it does not work
After investigating I have bought that the computer receives the RDP request but I do not know that the response is sent, I suspect that the problem is in the load balancing
How can I exclude that traffic that comes and goes for VPNs is affected?
This is the current configuration of mangle

/ip firewall mangle
add action=mark-routing chain=prerouting comment=“EXCLUSION DEL BALANCEO SALIENDO POR ISP1” new-routing-mark=to_ISP1 passthrough=no src-address-list=ExclusionBalanceoISP1
add action=mark-routing chain=prerouting comment=“EXCLUSION DEL BALANCEO SALIENDO POR ISP2” new-routing-mark=to_ISP2 passthrough=no src-address-list=ExclusionBalanceoISP2
add action=mark-connection chain=prerouting comment="REGLAS BALANCEO " connection-mark=no-mark in-interface=ISP1 new-connection-mark=ISP1_conn passthrough=yes
add action=mark-connection chain=prerouting connection-mark=no-mark in-interface=ISP2 new-connection-mark=ISP2_conn
add action=mark-connection chain=prerouting connection-mark=no-mark dst-address-type=!local in-interface=LAN new-connection-mark=ISP1_conn passthrough=yes per-connection-classifier=both-addresses:2/0
add action=mark-connection chain=prerouting connection-mark=no-mark dst-address-type=!local in-interface=LAN new-connection-mark=ISP2_conn passthrough=yes per-connection-classifier=both-addresses:2/1
add action=mark-routing chain=prerouting connection-mark=ISP1_conn in-interface=LAN new-routing-mark=to_ISP1 passthrough=yes
add action=mark-routing chain=prerouting connection-mark=ISP2_conn in-interface=LAN new-routing-mark=to_ISP2
add action=mark-routing chain=output connection-mark=ISP1_conn new-routing-mark=to_ISP1
add action=mark-routing chain=output connection-mark=ISP2_conn new-routing-mark=to_ISP2

Is it possible that this is affecting the traffic going to the VPNs? If I have the range 192.168.200.0/24 that I assign to the L2TP connections, how can I tell mangle that everything that goes from the local network to this range does not check it?

2

Possible solution (work, yes!)

add action=mark-connection chain=prerouting comment="REGLAS BALANCEO " connection-mark=no-mark dst-address=!192.168.200.0/24 in-interface=ISP1 new-connection-mark=ISP1_conn passthrough=yes
add action=mark-connection chain=prerouting connection-mark=no-mark dst-address=!192.168.200.0/24 in-interface=ISP2 new-connection-mark=ISP2_conn passthrough=yes
add action=mark-connection chain=prerouting connection-mark=no-mark dst-address=!192.168.200.0/24 dst-address-type=!local in-interface=LAN new-connection-mark=ISP1_conn passthrough=yes per-connection-classifier=both-addresses:2/0
add action=mark-connection chain=prerouting connection-mark=no-mark dst-address=!192.168.200.0/24 dst-address-type=!local in-interface=LAN new-connection-mark=ISP2_conn passthrough=yes per-connection-classifier=both-addresses:2/1
It works, this excludes VPN traffic
but is there any way to list IP or ranges to exclude?
for example list
NoBalancingList = 192.168.200.0/2 192.168.201.0/24 …

3

Sure, you can use src-address-list and/or dst-address-list everywhere where you can use src-address and/or dst-address.

/interface firewall address-list
add list=NoBalancingList address=192.168.200.0/24
add list=NoBalancingList address=192.168.201.0/24

(in fact, here a single item 192.168.200.0/23 is sufficient, and both a prefix and a range may be used as dst-address directly, but we both know it is just an example).