Statis routes vs mangle

RouterOS General
1

Hi there,

just found “Mangle world” but I have one question:

I have MicroTik in an external location. There is a VPN connection to our office (another MikroTik). I need to connect to some servers from office’s IP address, so thru the VPN connection. So for each of those servers, I have a static route for each IP address and it’s routed via VPN. This scenario works.

There is only trouble that for each server I need to have and separate route. So I’m just playing with Mangle, generally inspired here: https://wiki.mikrotik.com/wiki/Policy_Base_Routing
So I’m using:

  • /ip firewall address-list for adding each server to named address list
  • /ip firewall mangle rule to “mark route” each packet for this Dst. Address List
  • /ip route rule for packets with “routing mark” to send them via VPN

It works, but compared to direct static routing, the connection is very slow/laggy. I can see it even from the terminal when using SSH. The original method is fast in a normal way. Any clues? Thank you all!

2

If you have S2S tunnel, i doubt you need any additional routes. Router should see theese networks as directly connected. If you are experiencing performance issues, first thing that comes to my mind is MTU, but could be a NAT also. Can you draw a simple diagram of your topology, so we could help?

3

The reason is 99% that you have a rule with ****

action=fasttrack-connection

in your

/ip firewall filter

. Packet marking is incompatible with fasttracking because fasttracked packets bypass the mangle table and several other stages of packet processing. However, not all packets of fastracked connections are actually fasttracked, so the

action=accept

rule right after the

action=fasttrack-connection

one which explains why the connection is terribly slow but not totally dead.

To check this, just disable the fasttracking rule; if doing so confirms that it is the reason, you’ll need add an ****

action=accept

rule for packets to and from these servers before the

action=fasttrack-connection

rule before re-enabling it.

One way would be to have two rules for that, one with your ****

address-list

as

src-address-list

and the other one as

dst-address-list

.

A better way would be to use a ****

connection-mark

on top of (or rather as a base of)

routing-mark

.

In your mangle table rules, instead of ****

action=mark-routing

, you would use

action=mark-connection

with

passthrough=yes

,

new-connection-mark=your-conn-mark

and

connection-state=new

in your current marking rule evaluating the

dst-address-list

. Next to it, you would add a mangle rule

action=mark-routing connection-mark=your-conn-mark new-routing-mark=your-routing-mark

. And instead of the two rules in the /ip firewall filter as mentioned above, you would use a single rule

action=accept connection-mark=your-conn-mark

The point is that instead of matching every packet of the marked connections against an ****

address-list

two to three times, which is an expensive operation, you would match only the first packet of each connection against the

address-list

, and match each subsequent one only twice against

connection-mark

which is a bit faster.