So my isp sometimes has odd issues where local loop latency spike to 2000ms+ on fiber and can last for few minutes to hours, packet loss etc. (hAP Lite, 6.41)
So what I have done to help bypass some this is type have my android phone host a hotspot over its cell network, lte/3g..etc. So far I have it as Virtual wifi interface (wlan2) under wlan1 as master,
mode=station, masterinterface=wlan1, securityprofile=(wpa2 psk profile for key of phone), made a masq rule under NAT chain=scrnat, outinterface=wlan2, action=masquerade, it connects it passes traffic though that instead of my (wan1) fibre, and it auto creates routes in route list in image below;
However I DO NOT want it route all of my networks traffic to it, just one ip address, in this case 10.0.0.8, I created a mangle rule with packet marking, chain=prerouting scraddress=10.0.0.8 action=markrouting new routing mark=3G passthrough=enabled, created route, dst-address=192.168.43.0/24 gateway=wlan2(reachable) distance=1 (cant set to 0) scope=10 targetscope=10 routing mark=3G, pref.source= 192.168.43.23 (tried leaving it blank, or 192.168.43.0)
This does not work for some reason any ideas? am I missing something?
I am able to do the same setup with pptp or l2tp vpn setup and it works fine I am able to route traffic from the src ip 10.0.0.8 but not over wlan2 interface.
------------------------------------------------- update for previous post -------------------------------------------------------
So it does actually stop this route from being added
however when ever I set the routing marking the route list (3G) it doesn't work, when I remove the marking it works, by work I mean its passing all traffic its not routing out 10.0.0.8 traffic only.
but.. I cannot stop this route from being created (it's created when the virtual station wifi mode connects)
Actually, if you are using the router for DNS, disabling all default routes will cause the router to not be able to resolve DNS. Add a route for ether1 with a routing mark and then add another mangle rule for the whole 10.0.0.0/24 with the same routing mark. And then re-enable the add default route on the dhcp-client.
I have quicker way to check if its dns related, I cannot ping 8.8.8.8
but I’m not sure what you mean by “Add a route for ether1 with a routing mark and then add another mangle rule for the whole 10.0.0.0/24 with the same routing mark” my Ether1 is my ONT/fibre
device with its own IP, could you elaborate?
tracert with mangling disabled or no routing mark on the rule
1 <1 ms <1 ms <1 ms 10.0.0.64
2 6 ms 3 ms 2 ms 192.168.43.1
3 * * * Request timed out.
4 142 ms 19 ms 18 ms 10.104.38.78
5 * * * Request timed out.
6 53 ms 17 ms 21 ms 10.104.195.35
…etc
1 <1 ms <1 ms <1 ms 10.0.0.64
2 4 ms 2 ms 2 ms 192.168.43.1
3 * * * Request timed out.
4 * * * Request timed out.
5 * * * Request timed out.
rest all timed out for 19hops
From a routing perspective, above should work
If this does not work, check if you have fasttrack enable, if so disable it as it does not work with policy routing (It can, but gets complicated).
I have limited experience with phone hotspots, but with normal hotspots you have what they call “walled garden” settings, you might need to dig deeper into those settings if they exist
Shouldn’t the 192.168.43.1 be 3G marking not WAN on the routes ?
add gateway=192.168.43.1 routing-mark=WAN
Also the 10.0.0.64 is my Mikrotiks IP, guess its just windows/Cmd not showing the local ip first of the computer, but it is 10.0.0.8 as the src (the computer I’m on every day )
and those rules didn’t work either just getting no traffic through put
I’ll try export and remove sensitive data, like mac white-lists and scripts some port knocking stuff and I’ll post it here.
Its MTN network (South Africa as well), anyway reason its not a walled garden is because if I don’t do any sort of packetmarking & routing the entire network works fine, I can access anything over Hotspot network just when I start doing route marking ..etc it derps.
So I was testing by cutting wifi connection out completely and using a dialed L2TP vpn conneciton on the router and a mangle rule, routes, nat…etc the basic stuff, and its not working either now… something is actively stopping the routing… its weird. Firewall rules prehaps?
firewall dump below, I’ve removed disabled and sensitive rules.
turns out this is a bad idea Reverse Path Filtering (and should be set to no), guess the router thought it was being spoofed or something and just dropping packets no wonder my graph looked weird in traffic under the interface it was sending out packets (tx) but not allowing to be received (rx)?
)