It looks like you have the routing marks setup, but you don’t define what to do with them Routing marks should lead to a separate route table for each WAN. Essentially, you need a default route on each route table for each WAN interface.
Is there a reason why you want to have each WAN tied to a LAN and not load balanced?
In other words is it not better use of available bandwidth to make all available to all users and have the router based on load provide the next connection smartly??
Also, what happens if WAN1 goes down, what then?
Are all WANIPs actually from the same cable (not four ISPs but a single ISP with one modem)?
The client wants to have 1 different PPPoE session dedicated for each different Interface / LAN like so:
WAN1>LAN1
WAN2>LAN2
WAN3>LAN3
WAN4>LAN4
Each LAN would be used by a different company, these companies shouldnt be able to reach one another. Also these companies want their own public IP.
( you only see 2 WANS in my setup right now being used )
Instead of buying 4 different routers he would like to do it on one. Giving the question, is this actually possible and how can we do this.
If connection goes offline it just goes offline, no failover whatsover
WANS are from same modem and same ISP but with different PPPoE credentials/port on modem, no vlans used and in total 1Gbps combining all 4 PPPoE session 250Mbps would be dedicated for each LAN interface. ( he would actually like to use one interface on this modem for all 4 pppoe sessions if thats possible )
Never done this kind of config, thats why asking it in here. Client is also still in testing phase, so if a reset is required then thats alright.
Thank for the feedback, much better understanding of the scenario and the challenge.
I am by no means equipped to apply a config, I am more requirements focussed LOL.
Interesting dilemma, I don’t think clients would every say hey I need my own PPPoE connection.
BUTY WHY are they asking for public IP? If they do not control the ROUTER, they cannot setup internal servers or anything fancy.
What are the expectations?
I need to know the why’s of everything, otherwise a design attempt is plain dumb.
In other words, don’t laugh, but I don’t see any gain from a complex approach instead of simply using onee IP address and four VLANS LOL.
There is no more throughput to distribute and if the ISP goes down, they all go down.
Load balancing/queueing can ensure that all four vlans get equal access to available bandwidth for example.
Usually a block of IPs is for a business to have a standard natted LAN, and the other IPs for more public facing SERVERS (one to one NAT) so to speak.
So this is a bit different than I am used to reading about, but could be perfectly normal.
There might be servers in the users natted lan. But take for example, this router is inside a shared patch cabinet for these 4 different clients, we dont have a subnet of public ip’s for disposal and only have the option to use PPPoE sessions. These companies don’t want to spend too much or nothing at all on switching and routing hardware, so my client is renting this out for them. But then instead of having to spend money himself and do maintenance on multiple routers he would like to move them to a single one.
The hardware that the clients do have is outdated and supports only 100Mbps, but the investment for new hardware is too high. They do bring their own servers and are required to have their own ports and stuff, but they dont want to share the ips and change excisting configs.
All in all its a hard client and instead of having to say no I would like to help him. And probably when there are port forwards required and such for the clients config he would be making them (most likely would land on my plate though, but I wouldnt be annoyed by this )
Your client should get out of the way and understand you are the expert on networking and design
Your client should be honest about the requirements.
You just added a potential plateful of work if there are multiple servers that will need to be programmed into the config.
What else is he not telling you?
Don’t think that some client who seems just willing to buy the cheapest hardware is going to have two clues to program an MT router.
Help yourself, by ensuring that the facts are known and that you need the whole picture, otherwise you are being taken advantage of.
For start, reverse passthrough parameters in all chain=prerouting rules. When you have passthrough=yes, it means that processing in given chain will continue. When it’s passthrough=no, it will stop with the rule that has it (if other options match).
So when you mark new incoming connections from internet, it’s ok to have passthrough=no, because you won’t do anything else with those packets. When you mark new outgoing connections from LAN, you immediatelly need to mark routing for same packets, so you need passthrough=yes. And when you mark routing, that’s the end, so it can have passthrough=no.
First two rules mark incoming connections and you don’t need to do anything else with packets in this direction, so you can stop here with passthrough=no (but passthrough=yes won’t break anything).
Next two rules mark outgoing connections and you also need to mark routing for same packets, so here it must be passthrough=yes.
Next two rules are next step after 2). And once you mark routing, you don’t need anything else, so it’s the same case as 1), passthrough=no is enough, but passthrough=yes won’t break anything:
Last two rules are similar to 1) and 3), you mark routing and that’s the end.
But there’s small change, when you want static mapping, you don’t want current 2) and 3), but:
That’s because per-connection-classifier is for load balancing. And if each LAN has own interface, it’s enough to check that, you don’t need to look also at IP addresses.
Not for static config like this. It would be a problem if you e.g. wanted incoming connections (forwarded ports) from WAN, which device in target LAN doesn’t use for outgoing connections. It would need other config to deal with it. It also, as is, effectively blocks access from one LAN to another.
You could say that, it will make traffic from given LAN use different routing table containing only default route, i.e. it won’t be able to find other local subnets. But if you want access between LANs blocked, you probably should add firewall-level blocking anyway, for keeping good habits.
Hopefully you are still around, seems the client wants to have traffic between 2 of the bridges. Is there I could make that happen with the route rules?
)