Recursive routing working in 7.6?

I have not used recursive routing since moving to 7.X.

I tried using this page as a template to get started
https://help.mikrotik.com/docs/pages/viewpage.action?pageId=26476608

I added 2 scripts to my DHCP CLIENTS on my 2 interfaces to update the Gateway on a new DHCP request. Basically pulling my Gateway from the DHCP client and punching it into the routing rules were 10.111.0.1 and 10.112.0.1 where in the sample.

It doesn’t work.

This config looks pretty different from how I had to do it in 6.x

I guess the main question is… is this one of these things that is “Flakey/Broken” in 7.x?

Yes, why would you use their ref material LOL.

Para I - https://forum.mikrotik.com/viewtopic.php?t=182373

When i follow “what used to work” and it doesn’t… my first instinct is to check the documentation. SHAME ON ME!

That box I have been working on that actually uses both feeds at once made think… “Why would I mess with that old stuff???”

Downgraded to 6.49.7 And things work again…

Since I wasted hours on it…

/system scheduler
add interval=10s name=CheckGatewayStatus on-event=CheckGateway policy=\
    ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon start-date=dec/22/2022 start-time=\
    00:00:00
/system script
add dont-require-permissions=no name=CheckGateway owner=admin policy=\
    ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon source="### If 2 is active ####\r\
    \n:global 2ndIP\r\
    \n:local result2 [/ip route get [find gateway=10.10.10.12] active]\r\
    \n\r\
    \n:if (\$2ndIP = \$result2) do={\r\
    \n    #:log info \"No Change\"\r\
    \n} else= {\r\
    \n    /ip firewall connection remove [find]\r\
    \n    set \$2ndIP \$result2\r\
    \n    :log info \"Flushing Connections\"\r\
    \n}\r\
    \n"

recommended reading about changes in Routeros 7

https://help.mikrotik.com/docs/display/ROS/IP+Routing#IPRouting-NexthopLookup


There are changes in RouterOS v7 nexthop lookup.

Routes are processed in scope order, and updates to routes with a larger scope cannot affect the state of nexthop lookup for routes with a smaller scope.

chechito

Does that other page explain why the page about recursive routes doesn’t work?
Failover (WAN Backup)

Wrong question.
The question you should be asking is why isnt the recursive routing information you should have followed here not working.
If its not working, then I need to fix the documentation. :slight_smile:

In other words, all you are doing is spouting conjecture.,
Prove it!
Please post your config!!
/export file=anynameyouwish ( minus serial number and any public WANIP Info )

Your version 6 working recursive will be fine, I can build working V7 from that, and the version I provide will work for both!
Its the least I can for a neighbour!! But please try to warm up all that cold canadian air before it circles back to the east coast LOL

Anav.

I am not from Canada

/ip route
add comment=Backup distance=10 gateway=192.168.234.1 routing-mark=4Cell
add comment=Main distance=2 gateway=10.10.10.11
add comment=Second distance=3 gateway=10.10.10.12
add comment=Backup distance=1 dst-address=8.20.247.20/32 gateway=\
    192.168.234.1 scope=10
add comment=Primary distance=1 dst-address=8.26.56.26/32 gateway=172.16.14.1 \
    scope=10
add check-gateway=ping comment=Suck1 distance=1 dst-address=10.10.10.11/32 \
    gateway=8.26.56.26 scope=10
add check-gateway=ping comment=Suck1 distance=1 dst-address=10.10.10.11/32 \
    gateway=208.67.222.222 scope=10
add check-gateway=ping comment=Suck2 distance=1 dst-address=10.10.10.12/32 \
    gateway=208.67.220.220 scope=10
add check-gateway=ping comment=Suck2 distance=1 dst-address=10.10.10.12/32 \
    gateway=8.20.247.20 scope=10
add comment=Backup distance=1 dst-address=208.67.220.220/32 gateway=\
    192.168.234.1 scope=10
add comment=Primary distance=1 dst-address=208.67.222.222/32 gateway=\
    172.16.14.1 scope=10
/system scheduler
add interval=10s name=CheckGatewayStatus on-event=CheckGateway policy=\
    ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon \
    start-date=dec/22/2022 start-time=00:00:00
/system script
add dont-require-permissions=no name=CheckGateway owner=admin policy=\
    ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon source="#\
    ## If 2 is active ####\r\
    \n:global 2ndIP\r\
    \n:local result2 [/ip route get [find gateway=10.10.10.12] active]\r\
    \n\r\
    \n:if (\$2ndIP = \$result2) do={\r\
    \n    #:log info \"No Change\"\r\
    \n} else= {\r\
    \n    /ip firewall connection remove [find]\r\
    \n    set \$2ndIP \$result2\r\
    \n    :log info \"Flushing Connections\"\r\
    \n}\r\
    \n"

I know, you are a neighbour to the south LOL, getting a nice bout of canadian cold air ;-P.

So how many WANS do you have two or three?

You note two interfaces but four routes, a tad confusing…

main
second
backup
Primary

???

Also I will ignore the mangling you are doing for now…

There are 2 now.

But the labels are used to allow scripts to update variables that change with DHCP requests.

And to flush the connections when the back up changes status.

The mangle was to allow a connection on the back up when it is not the primary. Connect to the system over the backup ISP even though the main is active.

Okay lets call it Primary and Backup.

Since you have WAN1 which is the primary its distance should be shorter than the Backup and thus all users will get routed to WAN1 when available.
It appears you are comfortable using a common DNS provider for the “in between” recursive routing.

This will work as a basic recursive setup… The secondary route, the backup does NOT need recursive as if the primary is down, the secondary is all you have…
/ip route
add check-gateway=ping distance=3 dst-address=0.0.0.0/0 gateway=1.0.0.1 scope=10 target-scope=12
add distance=3 dst-address=1.0.0.1/32 gateway=PrimaryISP-gatewayIP scope=11 target-scope=11
add comment=SecondaryISP distance=10 dst-address=0.0.0.0/0 gateway=SecondaryISP-gatewayIP scope=10 target-scope=30


You can add to this by using two different addresses recursively and in this case you do this by increasing the distance between the two recursive check so one is done and if no connection it moves to a second checkpoint on the www.

/ip route
add check-gateway=ping distance=3 dst-address=0.0.0.0/0 gateway=1.0.0.1 scope=10 target-scope=12
add distance=3 dst-address=1.0.0.1/32 gateway=PrimaryISP-gatewayIP scope=10 target-scope=11
+++++++++++++++++++
add check-gateway=ping distance=4 dst-address=0.0.0.0/0 gateway=9.9.9.9 scope=10 target-scope=12
add distance=4 dst-address=9.9.9.9/32 gateway=PrimaryISP-gatewayIP scope=10 target-scope=11
+++++++++++++++++++
add comment=SecondaryISP distance=10 dst-address=0.0.0.0/0 gateway=SecondaryISP-gatewayIP scope=10 target-scope=30

+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

Now it appears you wish to run recursives on both Primary and backup ISPs…
/ip route
add check-gateway=ping distance=3 dst-address=0.0.0.0/0 gateway=1.0.0.1 scope=10 target-scope=12
add distance=3 dst-address=1.0.0.1/32 gateway=PrimaryISP-gatewayIP scope=11 target-scope=11
add check-gateway=ping distance=10 dst-address=0.0.0.0/0 gateway=9.9.9.9 scope=10 target-scope=12
add distance=10 dst-address=9.9.9.9/32 gateway=SecondaryISP-gatewayIP scope=11 target-scope=11

If you want to try two have two recursive checkpoints per ISP…
add check-gateway=ping distance=3 dst-address=0.0.0.0/0 gateway=1.0.0.1 scope=10 target-scope=12
add distance=3 dst-address=1.0.0.1/32 gateway=PrimaryISP-gatewayIP scope=10 target-scope=11
+++++++++++++++++++
add check-gateway=ping distance=4 dst-address=0.0.0.0/0 gateway=208.67.220.220 scope=10 target-scope=12
add distance=4 dst-address=208.67.220.220/32 gateway=PrimaryISP-gatewayIP scope=10 target-scope=11
+++++++++++++++++++
add check-gateway=ping distance=8 dst-address=0.0.0.0/0 gateway=9.9.9.9 scope=10 target-scope=12
add distance=8 dst-address=9.9.9.9/32 gateway=SecondaryISP-gatewayIP scope=10 target-scope=11
+++++++++++++++++++
add check-gateway=ping distance=9 dst-address=0.0.0.0/0 gateway=208.67.222.222 scope=10 target-scope=12
add distance=9 dst-address=208.67.222.222/32 gateway=SecondaryISP-gatewayIP scope=10 target-scope=11

+++++++++++++++++++++++++++++++++++++++++++

Then you can do a nested approach… for two recursives, for the primary only in this case. Which is what I think you are attempting!!!

/ip route
dst-address=0.0.0.0/0 gateway=10.10.10.10 scope=10 target-scope=14
++++++++++++++++
add check-gateway=ping dst-address=10.10.10.10/32 gateway=9.9.9.9 scope=10 target-scope=13
add dst-address=9.9.9.9/32 gateway=PrimaryISP-gatewayIP scope=10 target-scope=12
+++++++++++++++
add check-gateway=ping dst-address=10.10.10.10/32 gateway=1.0.0.1 scope=10 target-scope=13
add dst-address=1.0.0.1/32 gateway=PrimaryISP-gatewayIP scope=10 target-scope=12
++++++++++++++++++++++++++++++++++++++
add comment=SecondaryISP distance=10 dst-address=0.0.0.0/0 gateway=SecondaryISP-gatewayIP scope=10 target-scope=30

Will have to run through this.

Thanks for the help.

This is just plain creepy…

I updated from 6.x to 7.x and Router OS changed my external hosts, removed my profanity, and got rid of my mark routing route.

Yeah I went back into my config put in the right stuff for vers7 and deleted the remnants of vers 6. It is weird.

/ip route
add comment=Primary disabled=no distance=2 dst-address=8.26.56.26/32 gateway=1.2.3.5 pref-src="" routing-table=main scope=10 suppress-hw-offload=no target-scope=10
add comment=Primary disabled=no distance=2 dst-address=208.67.222.222/32 gateway=1.2.3.5 pref-src="" routing-table=main scope=10    suppress-hw-offload=no target-scope=10
add comment=Backup disabled=no distance=2 dst-address=8.20.247.20/32 gateway=1.2.3.4 pref-src="" routing-table=main scope=10 suppress-hw-offload=no target-scope=10
add comment=Backup disabled=no distance=2 dst-address=208.67.220.220/32 gateway=1.2.3.4 pref-src="" routing-table=main scope=10 suppress-hw-offload=no target-scope=10
add check-gateway=ping disabled=no distance=2 dst-address=10.10.10.11/32 gateway=8.26.56.26 pref-src="" routing-table=main scope=10 suppress-hw-offload=no target-scope=11
add check-gateway=ping disabled=no distance=2 dst-address=10.10.10.11/32 gateway=208.67.222.222 pref-src="" routing-table=main scope=10 suppress-hw-offload=no target-scope=11
add check-gateway=ping disabled=no distance=2 dst-address=10.10.10.12/32 gateway=8.20.247.20 pref-src="" routing-table=main scope=10 suppress-hw-offload=no target-scope=11
add check-gateway=ping disabled=no distance=2 dst-address=10.10.10.12/32 gateway=208.67.220.220 pref-src="" routing-table=main scope=10 suppress-hw-offload=no target-scope=11
add disabled=no distance=2 dst-address=0.0.0.0/0 gateway=10.10.10.11 pref-src="" routing-table=main scope=30 suppress-hw-offload=no target-scope=12
add disabled=no distance=3 dst-address=0.0.0.0/0 gateway=10.10.10.12 pref-src="" routing-table=main scope=30 suppress-hw-offload=no target-scope=12

Update your gateways and try this

For the record, it’s working. But I don’t get why we’re testing 10.10.10.11 and 10.10.10.12 … And why it’s working this way.

Whatever gotsprings did there, its complete BS IMHO.

What are your requirements 2 WANs, 3 WANs… ?
Both public or private IPs, dynamic/static?

There are two approaches to recursive…
FLAT
NESTED

Flat is basically one DNS server IP to one WAN ISP
You can can add more DNS per WAN ISP

Nested is basically using a faux address going nowhere and then use DNS all pointing to the Faux IP.
Its a bit more efficient when you have many WANs and want more than one recursive per WAN.

Not complete BS since it’s working, where many exemples on the forum are not working anymore with Ros7 (was working in RoS6). My setup is pretty simple, 2 wans,1 fiber and 1 lte, and the active link should switch to lte when the fiber is down. My gateways are local equipements, so It will answer to ping even if the service is down. I saw other way to do it with different routing table, or mangle, but this way is simpler imo and kind of like the way I did it in RoS6. The main difference seems to be the “scope”. And the fake addresses…

I am coming around to the idea that I am not going to let customers or clients convince me to use recursive rollover.

Its just NOT GOOD ENOUGH anymore…
VoIP
VIDEO over IP
Internet delivered video services
Hell logging me out of connections because the public IP not only changed… it changed geographic location…

And I am not the sort to start my explanation with.. “Well I know this sucks and has problems with ABCDEF. But it costs money to do it right…”

anav, I think you deserve - besides Forum Guru - the (unofficial) title of resident floccinaucinihilipilification expert :open_mouth: :laughing:

https://en.wiktionary.org/wiki/floccinaucinihilipilification