Tool Netwatch settings

Hello, there

I've configured the client MtK router with two ISPs. I did put the script in there with my e-mail credentials with the idea, to send me a mail when WAN1 is offline, online, WAN2 is offline, online. But the problem is - the IP-addresses for the netwatch to follow. I did try almost every single IP saw in the traseroute but, without any success. IP-addresses are visible for both ISPs. Let's say I put the DNS, when WAN1 is down, WAN2 see the IP is online (have ping to it)and didn`t work as it should. Here's the all script I have ot this one:

> /interface bridge
> add name=bridgeLAN
>
> /interface ethernet
> set \[find default-name=ether1\] name=ether1-ISP1
> set \[find default-name=ether2\] name=ether2-ISP2
> set \[find default-name=sfp1\] disabled=yes
>
> /interface bridge port
> add bridge=bridgeLAN interface=ether3
> add bridge=bridgeLAN interface=ether4
> add bridge=bridgeLAN interface=ether5
>
> /ip address
> add address=192.168.9.1/24 interface=bridgeLAN network=192.168.9.0
>
> /ip pool
> add name=dhcp_pool0 ranges=192.168.9.100-192.168.9.254
>
> /ip dhcp-server
> add address-pool=dhcp_pool0 interface=bridgeLAN name=dhcp1
>
> /ip dhcp-server network
> add address=192.168.9.0/24 gateway=192.168.9.1
>
> /ip dns
> set allow-remote-requests=yes servers=8.8.8.8,8.8.4.4,1.1.1.1
>
> /ip dhcp-client
> add interface=ether1-ISP1 add-default-route=no use-peer-dns=no use-peer-ntp=no
> add interface=ether2-ISP2 add-default-route=no use-peer-dns=no use-peer-ntp=no
>
> /ip firewall nat
> add chain=srcnat action=masquerade out-interface=ether1-ISP1
> add chain=srcnat action=masquerade out-interface=ether2-ISP2
>
> /ip route
> add dst-address=0.0.0.0/0 gateway=192.168.0.1 check-gateway=ping distance=1
> add dst-address=0.0.0.0/0 gateway=192.168.1.1 check-gateway=ping distance=2
>
> /tool netwatch
> add disabled=no down-script=":log warning "WAN1 is DOWN"; /tool e-mail send
> to=mymail@com subject="WAN1 DOWN" body="Primary ISP (WAN1) is not
> reachable. Switching to WAN2)."" host=192.168.0.1 http-codes=""
> interval=10s name=WAN1 test-script="" timeout=1s type=simple up-script=":l
> og warning "WAN1 is UP"; /tool e-mail send to=mymail@com subject="
> WAN1 UP" body="Primary ISP (WAN1) is back online. Restoring default rout
> e.""
> add disabled=no down-script=":log warning "WAN2 is DOWN"; /tool e-mail send
> to=mymail@com subject="WAN2 DOWN" body="Secondary ISP (WAN2) is no
> t reachable. Switching to WAN1."" host=192.168.1.1 http-codes=""
> interval=10s name=WAN2 test-script="" timeout=1s type=simple up-script=":l
> og warning "WAN2 is UP"; /tool e-mail send to=mymail@com subject="
> WAN2 UP" body="Secondary ISP (WAN2) is back online. Restoring default ro
> ute.""

Well, your issue is likely with routes.
You need to have your checked address ONLY reachable through one of the two WAN connections.

With these routes:

/ip route
add dst-address=0.0.0.0/0 gateway=192.168.0.1 check-gateway=ping distance=1
add dst-address=0.0.0.0/0 gateway=192.168.1.1 check-gateway=ping distance=2

all the internet is reachable through both gateways, since the distance is different, all your traffic will normally go through the 192.168.0.1 gateway (if you make an /ip route print the first route will be AS) and - if you disconnect that cable - everything will go through 192.168.1.1.

You need to add two "narrow" routes, with low distance, one for each checked address.

Let's say that you use 1.1.1.1 for the first route and 9.9.9.9 for the second:

/ip route
add dst-address=1.1.1.1/32 gateway=192.168.0.1 distance=1
add dst-address=9.9.9.9/32 gateway=192.168.1.1 distance=1
add dst-address=0.0.0.0/0 gateway=192.168.0.1 check-gateway=ping distance=1
add dst-address=0.0.0.0/0 gateway=192.168.1.1 check-gateway=ping distance=2

Thanks a lot.

Because I use 255.255.255.0 subnet mask, can I use

1.1.1.1/24 and 9.9.9.9/24 respectively?

Both of this IPs should be added in script, right?

In the final variant should be:

/tool netwatch
add disabled=no down-script=":log warning "WAN1 is DOWN"; /tool e-mail send
to=mymail@com subject="WAN1 DOWN" body="Primary ISP (WAN1) is not
reachable. Switching to WAN2)."" host=1.1.1.1 http-codes=""
interval=10s name=WAN1 test-script="" timeout=1s type=simple up-script=":l
og warning "WAN1 is UP"; /tool e-mail send to=mymail@com subject="
WAN1 UP" body="Primary ISP (WAN1) is back online. Restoring default rout
e.""
add disabled=no down-script=":log warning "WAN2 is DOWN"; /tool e-mail send
to=mymail@com subject="WAN2 DOWN" body="Secondary ISP (WAN2) is no
t reachable. Switching to WAN1."" host=9.9.9.9 http-codes=""
interval=10s name=WAN2 test-script="" timeout=1s type=simple up-script=":l
og warning "WAN2 is UP"; /tool e-mail send to=mymail@com subject="
WAN2 UP" body="Secondary ISP (WAN2) is back online. Restoring default ro
ute.""

0.0.0.0/0 means ALL addresses
1.1.1.1/32 means ONLY 1.1.1.1.
1.1.1.1/24 means ANY between 1.1.1.1 and 1.1.1.254.
A narrower route will always take precedence (when distance is the same) ove a wider one.
The fact you have a subnet mask (in LAN) of 255.255.255.0, i.e. a /24 has nothing to do with the above.

And yes, you need to specify the checked host in the netwatch script, this is one of the cases where it is easier to use the GUI to set up the scripts.

Technically, when your WAN2 is UP, nothing happens IF WAN1 is already up, as this latter has a lower distance.

If you run /ip route print with various WAN situations, you will see that WAN1 (if up) will always be AS, independently from the status of WAN2.

If you prefer, the conditions are:

  1. IF WAN1 is up, use WAN1, NO MATTER the status of WAN2
  2. IF WAN1 is down and WAN2 is up, then use WAN2
  3. IF WAN1 is down and WAN2 is also down, no connection to internet

In fact my idea is the following:

  1. If WAN1 is up, and WAN2 is up also => no need to send message

  2. If WAN1 is down, and WAN2 is ip => send message to e-mail “ISP1 is down, switching to ISP2”

  3. if WAN1 is up, and WAN2 is down => send message to e-mail “ISP2 is down”(by default ISP1 is primary)

  4. If some WAN1 or WAN2 restored => send message to e-mail “ISP1/ISP2 has been restored”

    I did try this one, that you suggest me, but when I unplug the cable (no matter ISP1 or ISP2) - nothing happened, the status of both scripts is UP.

Rest assured that when you unplug the cable something happens, whether this is properly sensed by the netwatch scripts, it is another thing, maybe there is some mistake in the scripts or something else preventing the stufff to work as expected.
Usually when using netwatch check-gateway=ping is not used, maybe it is that that is interfering.
Or maybe you need an additional blackhole route, buit that should only be needed in case of dynamic routes.

You need to check using /ip route print what happens to routes in the various cases.

You should normally have the two "narrow" routes AS (Active, Static) and as well the wide one on WAN1 AS, while the WAN2 one should be S (because it has a greater distance).

When you pull out the cable for WAN1 (pulling the cable simulates only part of the possible things that can break the connection) both the routes going through the WAN1 should become S, the narrow route through WAN2 should remain AS, the wide route through WAN2 should become AS.

When you pull out the cable for WAN2, the two routes going through WAN1 should remain AS, the narrow one through WAN2 should become S, and the wide one through WAN2 should remain S.

This is how Ip/Routes looks like in my case. I suppose one of AS should be removed

Yes, that is normal.

You have a AS route for canary address 9.9.9.9 via 192.168.1.1.
The corresponding 0.0.0.0 route is S because of higher distance 2.
Then you have an AS route for canary address 1.1.1.1 via 192.168.0.1.
The corresponding 0.0.0.0 route is also AS because it has (lower) distance 1.

Right now you have worklng connections through BOTH 192.168.1.1 and 192.168.0.1.

Ther point is about what changes when you physically disconnect:

  1. the 192.168.0.1 device from the Mikrotik
  2. the 192.168.1.1 device from the Mikrotik
  3. the 192.168.0.1 from the whatever is upstream
  4. the 192.168.1.1 from the whatever is upstream