I am lookong for some help in where I’ve gone wrong in my configuration.
What I want is for all traffic from ether1_desktops to go down the ether9_virgin interface and interface ether2_servers and ether3_server2 to go down zen_pppoe. Currently the traffic from ether2 and ether3 is doing what I want it to do. However cannot get the traffic from ether1 to go through ether9. I have been searching through this fourm and through the Wiki but havent found any solutions that have worked yet.
See below for configuration the firewall and routes
/ip route print
Flags: X - disabled, A - active, D - dynamic,
C - connect, S - static, r - rip, b - bgp, o - ospf, m - mme,
B - blackhole, U - unreachable, P - prohibit
# DST-ADDRESS PREF-SRC GATEWAY DISTANCE
0 A S 0.0.0.0/0 ether9_virgin 1
1 A S 0.0.0.0/0 zen_pppoe 1
2 ADC 51.148.72.22/32 51.148.140.134 zen_pppoe 0
3 ADC 172.28.0.0/24 172.28.0.1 ether1_desktop 0
4 ADC 172.28.1.0/24 172.28.1.1 servers 0
5 ADC 172.28.2.0/24 172.28.2.1 servers 0
6 ADC 192.168.0.0/24 192.168.0.23 ether9_virgin 0
/ip route rule print
Flags: X - disabled, I - inactive
0 routing-mark=virgin action=lookup table=virgin
/ip firewall nat print
Flags: X - disabled, I - invalid, D - dynamic
0 chain=srcnat action=masquerade out-interface=ether9_virgin log=no log-prefix=""
1 chain=srcnat action=masquerade out-interface=zen_pppoe log=no log-prefix=""
2 chain=dstnat action=dst-nat to-addresses=172.28.2.247 to-ports=25 protocol=tcp in-interface=zen_pppoe dst-port=25 log=yes log-prefix="SMTP"
3 chain=dstnat action=dst-nat to-addresses=172.28.2.247 to-ports=993 protocol=tcp in-interface=zen_pppoe dst-port=993 log=no log-prefix=""
4 chain=dstnat action=dst-nat to-addresses=172.28.2.247 to-ports=143 protocol=tcp in-interface=zen_pppoe dst-port=143 log=yes log-prefix="IMAP"
5 chain=dstnat action=dst-nat to-addresses=172.28.2.247 to-ports=110 protocol=tcp in-interface=zen_pppoe dst-port=110 log=no log-prefix=""
6 chain=dstnat action=dst-nat to-addresses=172.28.2.247 to-ports=587 protocol=tcp in-interface=zen_pppoe dst-port=587 log=no log-prefix=""
7 chain=dstnat action=dst-nat to-addresses=172.28.2.247 to-ports=8443 protocol=tcp in-interface=zen_pppoe dst-port=8443 log=no log-prefix=""
/ip firewall mangle print
Flags: X - disabled, I - invalid, D - dynamic
0 chain=prerouting action=mark-connection new-connection-mark=virgin passthrough=yes connection-mark=no-mark in-interface=ether9_virgin log=no log-prefix=""
1 chain=prerouting action=mark-connection new-connection-mark=virgin passthrough=yes dst-address-type=!local connection-mark=no-mark in-interface=ether1_desktop log=no
log-prefix=""
2 chain=prerouting action=mark-routing new-routing-mark=virgin passthrough=yes dst-address-type=!local connection-mark=virgin in-interface=ether1_desktop log=no
log-prefix=""
3 chain=output action=mark-routing new-routing-mark=virgin passthrough=yes connection-mark=virgin log=no log-prefix=""
If anything other config output is require please ask.
You have configured ether9 (the interface name) as the gateway value for the first default route, but that doesn’t work well with Mikrotik with point-to-multipoint connections, so use the IP address of the other router as the gateway value there.
If that doesn’t help, use /export hide-sensitive Instead of print to export the complete configuration.
As I’ve said before - you cannot use interface name as route’s gateway unless that interface connects the router to a point-to-point link. This is not the case of ether9_virgin. So you have to use an IP address provided by the DHCP server as the gateway of the default route in routing table virgin.
If that address doesn’t change with each DHCP lease renewal, it is enough to change the settings of the /ip dhcp-client attached to interface=ether9_virgin to add-default-route=yes default-route-distance=9 and renew the lease. Then, copy the IP address of the gateway from the default route with distance=9 and use it in the route with routing-mark=virgin. After that, you can revert the /ip dhcp-client settings to add-default-route=no.
If Virgin assigns you addresses from different subnets and thus changes the gateway IP address, you’ll need to attach a script to the dhcp client, which will fetch the address from the default routing table and update the route with routing-mark=virgin on each address assignment and/or renewal.
Other than that, the distance=2 in the default route with routing-mark=virgin is useless but not harmful.
