(1) Just so I understand it appears you have a Bridge called lineout which has three vlans, so I dont understand why you see the need to have the bridge itself give out DHCP??
Just use the bridge as a bridge period is my recommendation and if you need to run more data on the bridge just call it vlanhome or something.
What is the purpose of the line out address and network??
(2) Remove this, its rarely needed and can cause issues. The normal firewall rules under IP firewall filter suffice for 98% of scenarios.
/interface bridge settings
set use-ip-firewall=yes
(3) Missing dhcp-server for ether8 brasovia
(4) Missing dhcp-server for production network (vlan30)
(5) Missing ip pool for production network (vlan30)
(6) Just confirming all the lineout bridge ports are heading to smart devices which can read vlan tags.
(7) I am not savvy with NAT rules but it seems to me you have way too many sourcnat rules.
Typically with two WANs one can
a. use a single rule,
add chain=srcnat action=masquerade out-interface-list=WAN
or
b. use two rules one per WAN
add chain=srcnnat action=masquerade out-interface=ether1 (the active interface which may be a pppoe-name or vlan associated interface)
add chain-srcnat action=masquerade out-interface=ether2
IF one or both of the WANIP is actually a static/fixed WANIP then be is a better approach and the static IP should look like
add chain=srcnat action=srcnat out-interface=etherx to-addressses=WANIP
For the most part that covers 98% of cases…
(8) Where are all the firewall rules. without them
a. You should not be connected to the internet
and
b. By not showing them the config being interrelated is not really of much use for me to see what is going on.
(9) Your IP routes, is one thing to be careful so dont use real numbers, and if necessary edit your previous post.
(a) So a very basic Dual wan setup is.
add dst-address=0.0.0.0/0 check-gateway=ping distance=5 gateway=IP of WAN1
add dst-address=0.0.0.0/0 distance=10 gateway=IP of WAN2 gateway
What this is saying is that the router will check your routing when traffic is headed outbound and it will see that both routes are reachable but will pick the one with the lower distance (WAN1).
If the lower distance table is not available it will pick the next available table and will switch to WAN2. In the meantime it will keep checking to see if WAN1 is up and when it is will switch back to WAN1.
(b) one can make this recursive and by that I mean the router checks that an internet address is reachable vice the router interface because on some occasions the link to the ISP works but the link to the internet from them does not and therefore your router thinks the route is up but in fact it is not. So its a superior method of route setting upl
In simple terms, recursive means using the gateway of the IP to check an internet address to see if the route is reachable.
add check-gateway=ping distance=5 gateway=9.9.9.9
add distance=5 dst-address=9.9.9.9/32 gateway=IP of WAN1 gateway.
add distance=10 gateway=IP of WAN2 gateway
(c) However I am currently lost on how to easily create the WAN1 bypass AND still use wan1 if wan 2 is down. The bypass is easy the second part I am not sure of.
