setting dual wan ecmp

mikeleord · September 24, 2023, 6:48pm

Hello everyone!
I need some help to best configure 2 wans on my RB750Gr3 with routerOS 7.11.2.

This is the situation:
WAN 1 = pppoe with dynamic ip contracted by 1gpbs
WAN 2 = vlan 35 with fixed ip but only via dhcp client 1.8 gpbs contract (used only 1)
LAN = single lan

i tried to configure the router, and it works i can’t say no, if i disconnect wan1 or wan2 internet keeps working and that was the mission, BUT, internet is slow.

if i try to do speed test with both wan active the maximum download speed is 500/600mbps upload 700/800.

if i disconnect wan1 i go 950mbps if i disconnect wan2 the speed is 850/900mbps.

So I think there is something wrong with my configuration.

I am reading many posts about a similar configuration but I can’t get the speed to work right, it seems too much bandwidth loss.

I will paste the configuration here, if anyone can give me a tip I thank you!

Thank you Michele

# 2023-09-24 21:21:35 by RouterOS 7.11.2
# software id = 4IH8-5TXK
#
# model = RB750Gr3
# serial number = 8B00097BBA38

/interface bridge
add admin-mac=xx:xx:xx:xx:xx:xx auto-mac=no comment=defconf name=bridge
/interface ethernet
set [ find default-name=ether1 ] comment="WAN1"
set [ find default-name=ether2 ] comment="WAN2"
set [ find default-name=ether3 ] comment=SWITCH1
set [ find default-name=ether4 ] disabled=yes
set [ find default-name=ether5 ] disabled=yes
/interface pppoe-client
add add-default-route=yes disabled=no interface=ether1 name=wan-digi user=\
    username
/interface vlan
add interface=ether2 name=vlan-WAN2 vlan-id=35
/interface list
add comment=defconf name=WAN
add comment=defconf name=LAN
add name=WAN2
/routing table
add disabled=no fib name=to_wan1
add disabled=no fib name=to_wan2
/interface bridge port
add bridge=bridge comment=defconf ingress-filtering=no interface=ether3
add bridge=bridge comment=defconf ingress-filtering=no interface=ether4
add bridge=bridge comment=defconf ingress-filtering=no interface=ether5
/interface list member
add comment=defconf interface=bridge list=LAN
add interface=wan-digi list=WAN
add interface=vlan-WAN2 list=WAN2
/ip address
add address=10.29.22.1/24 comment=defconf interface=bridge network=10.29.22.0
/ip dhcp-client
add interface=vlan-WAN2 use-peer-dns=no use-peer-ntp=no
/ip firewall mangle
add action=mark-connection chain=output connection-mark=no-mark \
    connection-state=new new-connection-mark=digi_conn out-interface=wan-digi \
    passthrough=yes
add action=mark-connection chain=output connection-mark=no-mark \
    connection-state=new new-connection-mark=orange_conn out-interface=\
    vlan-WAN2 passthrough=yes
add action=mark-routing chain=output connection-mark=digi_conn \
    new-routing-mark=to_wan1 out-interface=wan-digi passthrough=yes
add action=mark-routing chain=output connection-mark=orange_conn \
    new-routing-mark=to_wan2 out-interface=vlan-WAN2 passthrough=yes
/ip firewall nat
add action=masquerade chain=srcnat comment="defconf: masquerade" \
    ipsec-policy=out,none out-interface=wan-digi
add action=masquerade chain=srcnat comment="defconf: masquerade" \
    ipsec-policy=out,none out-interface=vlan-WAN2
/ip route
add comment=test disabled=no distance=1 dst-address=8.8.8.8/32 gateway=\
    wan-digi pref-src="" routing-table=main scope=10 suppress-hw-offload=no \
    target-scope=10
add comment=test disabled=no distance=1 dst-address=8.8.8.8/32 gateway=\
    vlan-WAN2 pref-src="" routing-table=main scope=10 suppress-hw-offload=\
    no target-scope=10

I hope I’ve included everything you need

anav · September 24, 2023, 7:50pm

With a hex router one should not expect 1gig.
For that you should look at hapax3 as a cheap way to get there.

With a hex one should expect no more than 600-700 or even less.

++++++++++++++++++++++++++++++++++++++++++

Finally what is your plan it is not evident?

Primary/secondary Wan approach use one fail over to the other?
PCC to share between both WANs available?
Any vpns coming in or going out?
ANy external users coming in (port forwarding).

mikeleord · September 25, 2023, 6:41am

Hi Anav,
thanks for answering me, yes with this modem I know I can’t expect 1gig and I plan to change it.

To answer what you asked:

yes for failover, load balancing
yes
3.yes I have an incoming vpn and I put these filters in:

add action=accept chain=input comment=wireguard dst-port=13231 \
    in-interface-list=WAN protocol=udp
add action=accept chain=input comment="wireguard WAN2" dst-port=13231 \
    in-interface-list=WAN2 protocol=udp

yes i set up port forwarding i inserted this:

add action=dstst-nat chain=dstnat comment="port 80 WAN" dst-port=80 \
    in-interface=wan-digi protocol=tcp to-addresses=10.29.22.248 to-ports=80
add action=dstst-nat chain=dstnat comment="port 80 WAN2" dst-port=80 \
    in-interface=vlan-orange protocol=tcp to-addresses=10.29.22.248 to-ports=\
    80