Hi,
Apologies if this should be in the ‘Beginner Basics’ group; Admin, Please move if necessary.
Background
RB4011, Router OS v7.12rc2
WinBox v3.4 64bit
I have two DHCP ISPs, LTE Primary, VDSL Failover, both presenting public IP addresses. The FTTC VDSL requires IPv6 MER (MAC Encapsulated Routing) authentication but currently I only use the IPv4 address.
The configuration is built off the default configuration of the RB4011.
I have setup Recursive Routing broadly with the help of Wilmer Almazan / The Network Trip from this helpful video: https://www.youtube.com/watch?v=eTmpBAAW_pQ
At 18:20 in the video Wilmer demonstrates testing the failover by introducing a firewall filter to drop traffic exiting ISP1’s Internet interface.
I have tried to replicate this function in my RB4011 firewall but without success because, presumably, I still have an Internet connection to & via my ISP? Therefore the failover does not occur. If I disable the Ethernet 10 interface to my LTE modem (RBM33G in passthrough with RM502Q-AE) then failover does occur.
However, I have tried to filter traffic to:
Chain: forward, Dst. Address: 1.0.0.1, Out. Interface: ether10-LTE, Action: Drop
but it doesn’t failover. I have tried the rule at the top and bottom of the firewall Filter Rules but without success.
Is what I’m trying to do possible?
I’m making a big assumption, of course, that my configuration, which through the learning process I have laboured over, is correct?
(I’m planning to add Policy Based Routing to, hence the toLTE & toVDSL routing table entries - but one step at a time.)
Any kind and helpful responses will be welcomed as I’m keen to learn.
Thank you in anticipation.
My ‘privatised’ config attached.
How do network professionals, without control of their ISP(s) test their recursive routing failover?
# 2023-10-26 16:11:01 by RouterOS 7.12rc2
# software id = <my value>
#
# model = RB4011iGS+
# serial number = <my serial #>
/interface bridge
add admin-mac=<my MAC address> auto-mac=no comment=defconf name=bridge
/interface ethernet
set [ find default-name=ether10 ] name=ether10-LTE
set [ find default-name=sfp-sfpplus1 ] auto-negotiation=no name=\
sfp-sfpplus1-VDSL speed=100M-baseT-full
/interface wireguard
add listen-port=13231 mtu=1420 name=HomeNetWG
/interface list
add comment=defconf name=WAN
add comment=defconf name=LAN
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
/ip dhcp-client option
add code=79 name=client_duid79 value=<my value>
/ip pool
add name=dhcp ranges=192.168.1.53-192.168.1.253
/ip dhcp-server
add address-pool=dhcp interface=bridge lease-time=10m name=defconf
/ipv6 dhcp-client option
add code=79 name=client_duid79 value=<my value>
add code=61 name=clientid_duid61 value=<my value>
add code=61 name=clientid value=<my value>
/port
set 0 name=serial0
set 1 name=serial1
/routing table
add disabled=no fib name=toLTE
add disabled=no fib name=toVDSL
/interface bridge port
add bridge=bridge comment=defconf interface=ether2
add bridge=bridge comment=defconf interface=ether3
add bridge=bridge comment=defconf interface=ether4
add bridge=bridge comment=defconf interface=ether5
add bridge=bridge comment=defconf interface=ether6
add bridge=bridge comment=defconf interface=ether7
add bridge=bridge comment=defconf interface=ether8
add bridge=bridge comment=defconf interface=ether9
add bridge=bridge interface=ether1
/ip neighbor discovery-settings
set discover-interface-list=LAN
/interface list member
add comment=defconf interface=bridge list=LAN
add interface=sfp-sfpplus1-VDSL list=WAN
add interface=ether10-LTE list=WAN
/interface wireguard peers
add allowed-address=192.168.10.2/32 interface=HomeNetWG public-key=<my value>
/ip address
add address=192.168.1.254/24 comment=defconf interface=bridge network=\
192.168.1.0
add address=192.168.10.1/24 interface=HayloftNetWG network=192.168.10.0
/ip cloud
set ddns-enabled=yes
/ip dhcp-client
add comment=defconf default-route-distance=2 !dhcp-options interface=\
sfp-sfpplus1-VDSL script="# Recursive via sfp-sfpplus1-VDSL\r\
\n\r\
\n:if (\$bound=1) do={/ip route set [find where dst-address=4.2.2.2/32 and\
\_comment=\"Recursive via sfp-sfpplus1-VDSL\" ] gateway=( \$\"gateway-addr\
ess\" . \"%sfp-sfpplus1-VDSL\" ) }\r\
\n\r\
\n\r\
\n# :if (\$bound=1) do={/ip route set [find where dst-address=0.0.0.0/0 an\
d comment=\"sfp-sfpplus1-VDSL\" ] gateway=( \$\"gateway-address\" . \"%sfp\
-sfpplus1-VDSL\" ) }" use-peer-dns=no
add !dhcp-options interface=ether10-LTE script="# Recursive via ether10-LTE\r\
\n\r\
\n:if (\$bound=1) do={/ip route set [find where dst-address=1.0.0.1/32 and\
\_comment=\"Recursive via ether10-LTE\" ] gateway=( \$\"gateway-address\" \
. \"%ether10-LTE\" ) }\r\
\n\r\
\n# :if (\$bound=1) do={/ip route set [find where dst-address=0.0.0.0/0 an\
d comment=\"ether10-LTE\" ] gateway=( \$\"gateway-address\" . \"%ether10-L\
TE\" ) }" use-peer-dns=no
/ip dhcp-server network
add address=192.168.1.0/24 comment=defconf dns-server=192.168.1.254 gateway=\
192.168.1.254 netmask=24
/ip dns
set allow-remote-requests=yes servers=8.8.8.8,8.8.4.4
/ip dns static
add address=192.168.1.254 comment=defconf name=router.lan
/ip firewall filter
add action=drop chain=forward comment=\
"For Test Only - Drop Traffic out of sfp-sfpplus1-VDSL" disabled=yes \
dst-address=4.2.2.2 dst-address-list="" out-interface=sfp-sfpplus1-VDSL
add action=drop chain=forward comment=\
"For Test Only - Drop Traffic out of ether10-LTE" disabled=yes \
dst-address=1.0.0.1 out-interface=ether10-LTE
add action=accept chain=input comment="Allow WireGuard" dst-port=13231 \
protocol=udp
add action=accept chain=input comment="Allow WireGuard traffic" src-address=\
192.168.10.0/24
add action=accept chain=input comment=\
"defconf: accept established,related,untracked" connection-state=\
established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=\
invalid
add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp
add action=accept chain=input comment=\
"defconf: accept to local loopback (for CAPsMAN)" dst-address=127.0.0.1
add action=drop chain=input comment="defconf: drop all not coming from LAN" \
in-interface-list=!LAN
add action=accept chain=forward comment="defconf: accept in ipsec policy" \
ipsec-policy=in,ipsec
add action=accept chain=forward comment="defconf: accept out ipsec policy" \
ipsec-policy=out,ipsec
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" \
connection-state=established,related hw-offload=yes
add action=accept chain=forward comment=\
"defconf: accept established,related, untracked" connection-state=\
established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" \
connection-state=invalid
add action=drop chain=forward comment=\
"defconf: drop all from WAN not DSTNATed" connection-nat-state=!dstnat \
connection-state=new in-interface-list=WAN
/ip firewall nat
add action=masquerade chain=srcnat comment="defconf: masquerade" \
ipsec-policy=out,none out-interface-list=WAN
/ip route
add check-gateway=ping comment=ether10-LTE disabled=no distance=1 \
dst-address=0.0.0.0/0 gateway=1.0.0.1 pref-src=0.0.0.0 routing-table=main \
scope=30 suppress-hw-offload=no target-scope=11
add check-gateway=ping comment=sfp-sfpplus1-VDSL disabled=no distance=2 \
dst-address=0.0.0.0/0 gateway=4.2.2.2 pref-src=0.0.0.0 routing-table=main \
scope=30 suppress-hw-offload=no target-scope=11
add comment="Recursive via ether10-LTE" disabled=no distance=1 dst-address=\
1.0.0.1/32 gateway=94.197.30.22%ether10-LTE pref-src=0.0.0.0 \
routing-table=main scope=10 suppress-hw-offload=no target-scope=10
add comment="Recursive via sfp-sfpplus1-VDSL" disabled=no distance=1 \
dst-address=4.2.2.2/32 gateway=94.1.176.1%sfp-sfpplus1-VDSL pref-src=\
0.0.0.0 routing-table=main scope=10 suppress-hw-offload=no target-scope=\
10
/ipv6 dhcp-client
add add-default-route=yes dhcp-options=client_duid79,clientid_duid61,clientid \
dhcp-options=client_duid79,clientid_duid61,clientid interface=\
sfp-sfpplus1-VDSL pool-name=IPv6 pool-prefix-length=56 request=prefix
/ipv6 firewall address-list
add address=::/128 comment="defconf: unspecified address" list=bad_ipv6
add address=::1/128 comment="defconf: lo" list=bad_ipv6
add address=fec0::/10 comment="defconf: site-local" list=bad_ipv6
add address=::ffff:0.0.0.0/96 comment="defconf: ipv4-mapped" list=bad_ipv6
add address=::/96 comment="defconf: ipv4 compat" list=bad_ipv6
add address=100::/64 comment="defconf: discard only " list=bad_ipv6
add address=2001:db8::/32 comment="defconf: documentation" list=bad_ipv6
add address=2001:10::/28 comment="defconf: ORCHID" list=bad_ipv6
add address=3ffe::/16 comment="defconf: 6bone" list=bad_ipv6
/ipv6 firewall filter
add action=accept chain=input comment=\
"defconf: accept established,related,untracked" connection-state=\
established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=\
invalid
add action=accept chain=input comment="defconf: accept ICMPv6" protocol=\
icmpv6
add action=accept chain=input comment="defconf: accept UDP traceroute" port=\
33434-33534 protocol=udp
add action=accept chain=input comment=\
"defconf: accept DHCPv6-Client prefix delegation." dst-port=546 protocol=\
udp src-address=fe80::/10
add action=accept chain=input comment="defconf: accept IKE" dst-port=500,4500 \
protocol=udp
add action=accept chain=input comment="defconf: accept ipsec AH" protocol=\
ipsec-ah
add action=accept chain=input comment="defconf: accept ipsec ESP" protocol=\
ipsec-esp
add action=accept chain=input comment=\
"defconf: accept all that matches ipsec policy" ipsec-policy=in,ipsec
add action=drop chain=input comment=\
"defconf: drop everything else not coming from LAN" in-interface-list=\
!LAN
add action=accept chain=forward comment=\
"defconf: accept established,related,untracked" connection-state=\
established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" \
connection-state=invalid
add action=drop chain=forward comment=\
"defconf: drop packets with bad src ipv6" src-address-list=bad_ipv6
add action=drop chain=forward comment=\
"defconf: drop packets with bad dst ipv6" dst-address-list=bad_ipv6
add action=drop chain=forward comment="defconf: rfc4890 drop hop-limit=1" \
hop-limit=equal:1 protocol=icmpv6
add action=accept chain=forward comment="defconf: accept ICMPv6" protocol=\
icmpv6
add action=accept chain=forward comment="defconf: accept HIP" protocol=139
add action=accept chain=forward comment="defconf: accept IKE" dst-port=\
500,4500 protocol=udp
add action=accept chain=forward comment="defconf: accept ipsec AH" protocol=\
ipsec-ah
add action=accept chain=forward comment="defconf: accept ipsec ESP" protocol=\
ipsec-esp
add action=accept chain=forward comment=\
"defconf: accept all that matches ipsec policy" ipsec-policy=in,ipsec
add action=drop chain=forward comment=\
"defconf: drop everything else not coming from LAN" in-interface-list=\
!LAN
/system clock
set time-zone-name=Europe/London
/system identity
set name=Router_RB4011_PoE24v
/system note
set show-at-login=no
/system scheduler
add disabled=yes interval=1h30m name=sfp-sfpplus1-VDSL_Ping&Release on-event=\
"/system script run sfp-sfpplus1-VDSL_Ping&Release" policy=\
ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon \
start-date=2023-10-22 start-time=21:50:00
add disabled=yes interval=1h30m name=ether10-LTE_Ping&Release on-event=\
"/system script run ether10-LTE_Ping&Release" policy=\
ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon \
start-date=2023-10-23 start-time=17:00:00
/system script
add dont-require-permissions=no name=sfp-sfpplus1-VDSL_Ping&Release owner=\
admin policy=\
ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon source=":\
if ( [/ping 8.8.8.8 interface=sfp-sfpplus1-VDSL count=10 ] = 0 ) do={/ip d\
hcp-client release sfp-sfpplus1-VDSL}"
add dont-require-permissions=no name=ether10-LTE_Ping&Release owner=admin \
policy=ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon \
source=":if ( [/ping 8.8.8.8 interface=ether10-LTE count=10 ] = 0 ) do={/i\
p dhcp-client release ether10-LTE}"
/tool mac-server
set allowed-interface-list=LAN
/tool mac-server mac-winbox
set allowed-interface-list=LAN