Hello all, I have a RB2011 setup and I want to use PBR.
The problem I am facing is that whenever I try to let a device use a secondary connection (using PBR/routing mark) the device looses internet connection.
I tried the RB1100AHx4 and the RB2011, both with the same issue.
Not sure what is going wrong.
Something I also noticed is that if I don’t have a bridge interface to merge all LAN ports and EOIP, it works normally, but I need to use bridge in this case.
# 2023-11-01 22:29:43 by RouterOS 7.11.2
# software id = 52GL-9MBM
#
# model = RB2011UiAS
# serial number = 77AD0725DF05
/interface bridge
add name="Bridge Local" protocol-mode=none
add name="Bridge Wise"
/interface ethernet
set [ find default-name=ether1 ] name="ether1-Wise "
set [ find default-name=ether2 ] name="ether2-Showroom Switch"
set [ find default-name=ether3 ] name="ether3-Elna Switch"
set [ find default-name=ether4 ] name="ether4-Showroom Wireless"
set [ find default-name=ether5 ] disabled=yes
set [ find default-name=ether6 ] disabled=yes name=ether6-DSL1
set [ find default-name=ether7 ] disabled=yes name=ether7-DSL2
set [ find default-name=ether8 ] disabled=yes name=ether8-DSL3
set [ find default-name=ether9 ] disabled=yes
set [ find default-name=ether10 ] disabled=yes
set [ find default-name=sfp1 ] name=sfp1-VCoreFiber
/interface eoip
add allow-fast-path=no disabled=yes !keepalive local-address=46.227.252.173 \
mac-address=02:25:D7:46:10:2F mtu=1500 name=eoip-DawraBranch \
remote-address=93.185.236.123 tunnel-id=25
add allow-fast-path=no disabled=yes !keepalive local-address=46.227.252.173 \
mac-address=02:44:A0:6C:DD:19 name=eoip-VCoreTabarja remote-address=\
141.138.178.98 tunnel-id=30
/interface vlan
add interface=sfp1-VCoreFiber name="vlan20-Wise to VCore" vlan-id=20
add interface=sfp1-VCoreFiber name="vlan21-MacroLan to VCore" vlan-id=21
add interface=sfp1-VCoreFiber name="vlan22-Local from VCore" vlan-id=22
/interface pppoe-client
add interface=ether6-DSL1 name=pppoe-out1 user=D146092@ogeronet-Max.com
add interface=ether7-DSL2 name=pppoe-out2 user=D146091@ogeronet-Max.com
add interface=ether8-DSL3 name=pppoe-out3 use-peer-dns=yes user=\
D146093@ogeronet-Max.com
/interface lte apn
set [ find default=yes ] ip-type=ipv4 use-network-apn=no
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
/ip pool
add name="DHCP Pool" ranges=192.168.1.2-192.168.1.50
/ip dhcp-server
add address-pool="DHCP Pool" interface="Bridge Local" lease-time=1d name=\
"DHCP Server"
/port
set 0 name=serial0
/queue simple
add max-limit=3M/1M name="PTZ CAM" target=192.168.1.222/32
add max-limit=1M/1M name="Softmind Server" target=192.168.1.200/32
add max-limit=3M/3M name="Flex Laptop (Rami)" target=192.168.1.9/32
add max-limit=3M/1M name="Accounting PC (Aida)" target=192.168.1.17/32
add max-limit=3M/1M name="POS PC1 (Julien)" target=192.168.1.6/32
add max-limit=3M/1M name="POS PC2 (Tatiana)" target=192.168.1.50/32
add max-limit=2M/1M name="Macro NVR" target=192.168.1.80/32
add max-limit=2M/1M name="Home NVR" target=192.168.1.195/32
/queue type
set 5 pcq-rate=1M
set 6 pcq-rate=2M
/queue simple
add max-limit=1M/256k name="Rest of IPs" queue=\
pcq-upload-default/pcq-download-default target=192.168.1.0/24
/routing bgp template
set default disabled=no output.network=bgp-networks
/routing ospf instance
add disabled=no name=default-v2
/routing ospf area
add disabled=yes instance=default-v2 name=backbone-v2
/routing table
add fib name=Ogero1
add fib name=Ogero2
add fib name=Ogero3
add fib name=VCoreLocal
add fib name=Wise
/interface bridge port
add bridge="Bridge Local" ingress-filtering=no interface=\
"ether2-Showroom Switch"
add bridge="Bridge Wise" ingress-filtering=no interface="ether1-Wise "
add bridge="Bridge Local" ingress-filtering=no interface=eoip-DawraBranch
add bridge="Bridge Local" ingress-filtering=no interface="ether3-Elna Switch"
add bridge="Bridge Wise" ingress-filtering=no interface=\
"vlan20-Wise to VCore"
add bridge="Bridge Local" ingress-filtering=no interface=\
"vlan21-MacroLan to VCore"
add bridge="Bridge Local" ingress-filtering=no interface=\
"ether4-Showroom Wireless"
add bridge="Bridge Local" ingress-filtering=no interface=eoip-VCoreTabarja
add bridge=*1E interface="vlan22-Local from VCore"
/interface bridge settings
set allow-fast-path=no
/ip neighbor discovery-settings
set discover-interface-list=!dynamic
/ip settings
set max-neighbor-entries=8192
/ipv6 settings
set max-neighbor-entries=8192
/interface ovpn-server server
set auth=sha1,md5
/ip address
add address=46.227.252.173/29 interface="Bridge Wise" network=46.227.252.168
add address=192.168.1.1/24 interface="Bridge Local" network=192.168.1.0
add address=192.168.7.1/24 interface="Bridge Local" network=192.168.7.0
add address=10.1.1.253/24 interface="vlan22-Local from VCore" network=\
10.1.1.0
/ip arp
add address=192.168.1.49 interface="Bridge Local" mac-address=\
90:8D:6E:5F:7C:C0
add address=192.168.1.6 comment=Julien interface="Bridge Local" mac-address=\
90:8D:6E:5F:65:4E
add address=192.168.1.5 interface="Bridge Local" mac-address=\
10:FE:ED:40:5A:7D
add address=192.168.1.7 interface="Bridge Local" mac-address=\
D8:5E:D3:E1:84:43
add address=192.168.1.17 interface="Bridge Local" mac-address=\
08:62:66:9C:F4:33
add address=192.168.1.200 interface="Bridge Local" mac-address=\
18:D6:C7:01:7F:36
add address=192.168.1.9 comment=Rami interface="Bridge Local" mac-address=\
04:BF:1B:2D:50:A1
/ip dhcp-server lease
add address=192.168.1.30 client-id=1:c8:3a:35:2e:fb:89 mac-address=\
C8:3A:35:2E:FB:89 server="DHCP Server"
add address=192.168.1.36 client-id=1:2c:fd:a1:6f:ae:5c mac-address=\
2C:FD:A1:6F:AE:5C server="DHCP Server"
add address=192.168.1.10 client-id=1:38:14:28:d2:93:4d mac-address=\
38:14:28:D2:93:4D server="DHCP Server"
/ip dhcp-server network
add address=192.168.1.0/24 gateway=192.168.1.1
/ip dns
set allow-remote-requests=yes servers=8.8.8.8,1.1.1.1
/ip firewall address-list
add address=192.168.1.0/24 list=Local
add address=192.168.7.0/24 list=Local
/ip firewall filter
add action=drop chain=input dst-port=53 in-interface="Bridge Wise" protocol=\
udp
/ip firewall mangle
add action=mark-connection chain=prerouting disabled=yes dst-address-type=\
!local in-interface="Bridge Local" new-connection-mark=Browser1-Conn \
passthrough=yes per-connection-classifier=both-addresses-and-ports:3/0 \
src-address=192.168.1.0/24
add action=mark-connection chain=prerouting disabled=yes dst-address-type=\
!local in-interface="Bridge Local" new-connection-mark=Browser1-Conn \
passthrough=yes per-connection-classifier=both-addresses-and-ports:3/0 \
src-address=192.168.7.0/24
add action=mark-connection chain=prerouting disabled=yes dst-address-type=\
!local in-interface="Bridge Local" new-connection-mark=Browser2-Conn \
passthrough=yes per-connection-classifier=both-addresses-and-ports:3/1 \
src-address=192.168.1.0/24
add action=mark-connection chain=prerouting disabled=yes dst-address-type=\
!local in-interface="Bridge Local" new-connection-mark=Browser2-Conn \
passthrough=yes per-connection-classifier=both-addresses-and-ports:3/1 \
src-address=192.168.7.0/24
add action=mark-connection chain=prerouting disabled=yes dst-address-type=\
!local in-interface="Bridge Local" new-connection-mark=Browser3-Conn \
passthrough=yes per-connection-classifier=both-addresses-and-ports:3/2 \
src-address=192.168.1.0/24
add action=mark-connection chain=prerouting disabled=yes dst-address-type=\
!local in-interface="Bridge Local" new-connection-mark=Browser3-Conn \
passthrough=yes per-connection-classifier=both-addresses-and-ports:3/2 \
src-address=192.168.7.0/24
add action=mark-routing chain=prerouting connection-mark=Browser1-Conn \
disabled=yes in-interface="Bridge Local" new-routing-mark=Ogero1 \
passthrough=yes
add action=mark-routing chain=prerouting connection-mark=Browser2-Conn \
disabled=yes in-interface="Bridge Local" new-routing-mark=Ogero2 \
passthrough=yes
add action=mark-routing chain=prerouting connection-mark=Browser3-Conn \
disabled=yes in-interface="Bridge Local" new-routing-mark=Ogero3 \
passthrough=yes
/ip firewall nat
add action=masquerade chain=srcnat out-interface="Bridge Wise"
add action=masquerade chain=srcnat out-interface="vlan22-Local from VCore"
# pppoe-out1 not ready
add action=masquerade chain=srcnat out-interface=pppoe-out1 src-address-list=\
Local
# pppoe-out3 not ready
add action=masquerade chain=srcnat out-interface=pppoe-out3 src-address-list=\
Local
# pppoe-out2 not ready
add action=masquerade chain=srcnat out-interface=pppoe-out2 src-address-list=\
Local
add action=masquerade chain=srcnat
add action=dst-nat chain=dstnat comment="Macro NVR" dst-address=\
46.227.252.173 dst-port=8003 protocol=tcp to-addresses=192.168.1.80 \
to-ports=8003
add action=dst-nat chain=dstnat comment="Macro Server" dst-address=\
46.227.252.173 dst-port=6969 protocol=tcp to-addresses=192.168.1.200 \
to-ports=3389
add action=dst-nat chain=dstnat comment="Home NVR" dst-address=46.227.252.173 \
dst-port=8007 protocol=tcp to-addresses=192.168.1.195 to-ports=8007
add action=dst-nat chain=dstnat comment=PTZ dst-address=46.227.252.173 \
dst-port=555 protocol=tcp to-addresses=192.168.1.222 to-ports=90
add action=dst-nat chain=dstnat comment="Camera iVMS" dst-address=\
46.227.252.173 dst-port=556 protocol=tcp to-addresses=192.168.1.222 \
to-ports=9000
add action=dst-nat chain=dstnat dst-address=46.227.252.173 dst-port=500 \
protocol=tcp to-addresses=192.168.7.243
add action=redirect chain=dstnat comment=\
"Redirect DNS traffic to Mikrotik DNS" dst-port=53 protocol=udp to-ports=\
53
/ip firewall service-port
set sip disabled=yes
/ip route
add disabled=no dst-address=0.0.0.0/0 gateway=46.227.252.169
add disabled=no dst-address=0.0.0.0/0 gateway=10.1.1.1 routing-table=\
VCoreLocal
add disabled=no dst-address=0.0.0.0/0 gateway=pppoe-out1 routing-table=Ogero1
add disabled=no dst-address=0.0.0.0/0 gateway=pppoe-out2 routing-table=Ogero2
add disabled=no dst-address=0.0.0.0/0 gateway=pppoe-out3 routing-table=Ogero3
add disabled=no dst-address=0.0.0.0/0 gateway=46.227.252.169 routing-table=\
Wise
/ip service
set telnet disabled=yes
set ftp disabled=yes
set www port=81
set ssh disabled=yes
set api disabled=yes
set winbox port=8292
set api-ssl disabled=yes
/routing bfd configuration
add disabled=no interfaces=all min-rx=200ms min-tx=200ms multiplier=5
/system clock
set time-zone-name=Asia/Beirut
/system identity
set name="Macrotronics Kfarhbab"
/system note
set show-at-login=no