Recursive routing for failover.

RouterOS General
1

Ive watched a few videos trying to recreate this process so I can have an active failover if a directly connected Wan losing connection to the internet. Not just if lets say its power goes out.. I thought I followed the instructions pretty well but apparently I haven’t been able to change the routes to recursive. Maybe someone could point out what im missing. Ill add that both ways are coming from the same router on different vlans but ive set firewall rules on them to not respond to the others networks.

[admin@MikroTik] > export
# oct/24/2022 21:00:51 by RouterOS 6.48
# software id = 7XHG-9DN7
#
# model = RB760iGS
# serial number = E1F20DBE9019
/interface bridge
add admin-mac=08:55:31:FE:65:6C auto-mac=no comment=defconf name=bridge
/interface list
add comment=defconf name=WAN
add comment=defconf name=LAN
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
/ip hotspot profile
set [ find default=yes ] html-directory=hotspot
/ip pool
add name=default-dhcp ranges=192.168.88.10-192.168.88.254
/ip dhcp-server
add address-pool=default-dhcp disabled=no interface=bridge name=defconf
/interface bridge port
add bridge=bridge comment=defconf interface=ether3
add bridge=bridge comment=defconf interface=ether4
add bridge=bridge comment=defconf interface=ether5
add bridge=bridge comment=defconf interface=sfp1
/ip neighbor discovery-settings
set discover-interface-list=LAN
/interface list member
add comment=defconf interface=bridge list=LAN
add comment=defconf interface=ether1 list=WAN
add interface=ether2 list=WAN
/ip address
add address=192.168.88.1/24 comment=defconf interface=bridge network=192.168.88.0
add address=192.168.2.188/24 interface=ether1 network=192.168.2.0
add address=172.25.1.11/24 interface=ether2 network=172.25.1.0
/ip dhcp-client
add add-default-route=no comment=defconf interface=ether1
add add-default-route=no interface=ether2
/ip dhcp-server network
add address=192.168.88.0/24 comment=defconf gateway=192.168.88.1
/ip dns
set allow-remote-requests=yes servers=8.8.8.8
/ip dns static
add address=192.168.88.1 comment=defconf name=router.lan
/ip firewall filter
add action=accept chain=input dst-port=8291 in-interface=ether1 protocol=tcp src-port=""
add action=accept chain=input comment="defconf: accept established,related,untracked" connection-state=established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=invalid
add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp
add action=accept chain=input comment="defconf: accept to local loopback (for CAPsMAN)" dst-address=127.0.0.1
add action=drop chain=input comment="defconf: drop all not coming from LAN" in-interface-list=!LAN
add action=accept chain=forward comment="defconf: accept in ipsec policy" ipsec-policy=in,ipsec
add action=accept chain=forward comment="defconf: accept out ipsec policy" ipsec-policy=out,ipsec
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" connection-state=established,related
add action=accept chain=forward comment="defconf: accept established,related, untracked" connection-state=established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" connection-state=invalid
add action=drop chain=forward comment="defconf: drop all from WAN not DSTNATed" connection-nat-state=!dstnat connection-state=new in-interface-list=WAN
/ip firewall nat
add action=masquerade chain=srcnat comment="defconf: masquerade" ipsec-policy=out,none out-interface-list=WAN
/ip route
add distance=1 gateway=192.168.2.1 target-scope=11
add distance=2 gateway=172.25.1.1 target-scope=11
add check-gateway=ping distance=1 dst-address=1.0.0.1/32 gateway=192.168.2.1 scope=10
add check-gateway=ping distance=2 dst-address=8.8.8.8/32 gateway=172.25.1.1 scope=10
/system clock
set time-zone-name=America/New_York
/tool mac-server
set allowed-interface-list=LAN
/tool mac-server mac-winbox
set allowed-interface-list=LAN
2

initially I did have the address obtained by dhcp but then set them to static

3

Don’t watch, read:

Advanced Routing Failover without Scripting

Pay attention to differences between dst-address/gateway and HostX/GWX.

If you have dynamic addresses and it’s possible that they could change, don’t use static ones, they could break (that’s quite obvious). But you can use same config and update addresses using DHCP lease script.

4

Ok that worked.. I noticed that my pings would drop and not come back until I started a new session. I wondering if that is something that can be fixed.. wow there is just so much to learn. Im having sillier problem.. I tried to upgrade the firmware.. and dragged and dropped the file I download and it just disappear in files but the hard drive space still got used up.. :frowning:

5

and now all I did was upgrade the firmware and the recursive routes disappear.. I dont get it.. these Mikrotik are a missssssssssion..

6

I don’t use recursive routing, but did you see this recent thread?

recursive routing not wokring

7

I was able to get this to work, Part of the problem was that in v7 it doesnt look like it actually displayed visually that recursive routes are actually happy ( routing to x recursively) like I v6 but testing proved that in fact it was working. the solution was working with score and target scope.

/ip route
add comment="Monitor Internet 1" disabled=no distance=1 dst-address=1.0.0.1/32 gateway=192.168.2.1 pref-src="" routing-table=main scope=10 suppress-hw-offload=no target-scope=10
add comment="Monitor Internet 2" disabled=no distance=2 dst-address=4.2.2.2/32 gateway=172.25.1.1 pref-src="" routing-table=main scope=10 suppress-hw-offload=no target-scope=10
add check-gateway=ping comment="Default Route" disabled=no distance=1 dst-address=0.0.0.0/0 gateway=1.0.0.1 pref-src=0.0.0.0 routing-table=main scope=30 suppress-hw-offload=no \
    target-scope=11
add check-gateway=ping comment="BackUp Route" disabled=no distance=2 dst-address=0.0.0.0/0 gateway=4.2.2.2 pref-src=0.0.0.0 routing-table=main scope=30 suppress-hw-offload=no \
    target-scope=11

Target scope being higher the scope on recursive routes.