Two ISP's - Load sharing, not working

RouterOS General
1

What is the best way to do this.

I need to send all the lan traffic… 192168.0.11-254 trhought the PPPoe connection.

I tried just using 0.0.0.0/0 with two gateways, but users can’t get to the exchange server from the outside.

I tried using Mangle and setting the router on a per ip basis, but then nothing works.

what is the right way to do this.

I really would like to have all traffic for web browsing and anything else to go throught the PPPoe connection, and only traffic in and out of the exchange server to go though my other ISP. See JPG
netwrok2.jpg

2

IF I undesteand your question something like (check syntax, I don’t have router here to be sure):

/ ip firewall mangle
add chain=output src-address=!192.168.0.10 action=mark-routing new-routing-mark=to_wan1
add chain=output src-address=192.168.0.10 action=mark-routing new-routing-mark=to_wan2

/ ip route
add dst-address=0.0.0.0/0 gateway=192.168.25.1 routing-mark=to_wan1 check-gateway=ping
add dst-address=0.0.0.0/0 gateway=111.111.111.111 routing-mark=to_wan2 check-gateway=ping

where 111.111.111.111 is your another public ip gateway.

also, you need to take care about incoming packets in order to send that back where come from in case there are incoming connections from both connections, check following articles to understand why :

http://wiki.mikrotik.com/wiki/PCC
http://wiki.mikrotik.com/wiki/ECMP_load_balancing_with_masquerade
http://wiki.mikrotik.com/wiki/NTH_load_balancing_with_masquerade

3

I can see packets going through the mangle on the !192.168.0.10

but nothing through the 192.168.0.10

The minute I set that I lost access to the router.

I created an
add chain=output src-address=111.111.111.111 action=mark-routing new-routing-mark=to_wan2

I was able to get to the router then

but the gateway

0.0.0.0/0 is in there with no mark… to 111.111.111.111

With this set thatway, lan users could get to the Internet but it still goes through 111.111.111.111


so I added the routing mark to that route, then the lan users lost Internet.

if I take the routing mark off of either gateway, then the users can get to the Internet, with the routing mark, all internet goes away.

4

Here is my nat table

0 chain=srcnat action=masquerade

1 chain=dstnat action=dst-nat to-addresses=192.168.1.10 to-ports=80
protocol=tcp dst-address=111.111.111.111 dst-port=80

2 chain=dstnat action=dst-nat to-addresses=192.168.1.10 to-ports=443
protocol=tcp dst-address=111.111.111.111 dst-port=443

3 chain=dstnat action=dst-nat to-addresses=192.168.1.10 to-ports=444
protocol=tcp dst-address=111.111.111.111 dst-port=444

4 chain=dstnat action=dst-nat to-addresses=192.168.1.10 to-ports=4125
protocol=tcp dst-address=111.111.111.111 dst-port=4125

5 chain=dstnat action=dst-nat to-addresses=192.168.1.10 to-ports=110
protocol=tcp dst-address=111.111.111.111 dst-port=110

6 chain=dstnat action=dst-nat to-addresses=192.168.1.10 to-ports=993
protocol=tcp dst-address=111.111.111.111 dst-port=993

7 chain=dstnat action=dst-nat to-addresses=192.168.1.10 to-ports=143
protocol=tcp dst-address=111.111.111.111 dst-port=143

8 chain=dstnat action=dst-nat to-addresses=192.168.1.10 to-ports=135
protocol=tcp dst-address=111.111.111.111 dst-port=135

9 chain=dstnat action=dst-nat to-addresses=192.168.1.10 to-ports=691
protocol=tcp dst-address=111.111.111.111 dst-port=691

10 chain=dstnat action=dst-nat to-addresses=192.168.1.10 to-ports=995
protocol=tcp dst-address=111.111.111.111 dst-port=995

11 chain=dstnat action=dst-nat to-addresses=192.168.1.10 to-ports=563
protocol=tcp dst-address=111.111.111.111 dst-port=563

12 chain=dstnat action=dst-nat to-addresses=192.168.1.10 to-ports=119
protocol=tcp dst-address=111.111.111.111 dst-port=119

5

in your case 192.168.1.10 and public ip 111.111.111.111 is special case, all other may go using main route. That for you need to mark all incoming traffic on that interface and to send back using same interface. Also, you need to mark all trafic from 192.168.1.10 to same inerface.

if 111.111.111.111 is on interface wan2 and gateway is 111.111.111.1

/ ip firewall mangle
add chain=input in-interface=wan2 action=mark-connection new-connection-mark=wan2_conn
add chain=output connection-mark=wan2_conn action=mark-routing new-routing-mark=to_wan2
add chain=output src-address=192.168.0.10 action=mark-routing new-routing-mark=to_wan2

/ ip route
add dst-address=0.0.0.0/0 gateway=111.111.111.1 routing-mark=to_wan2 check-gateway=ping
add dst-address=0.0.0.0/0 gateway=192.168.1.25 check-gateway=ping

last one probably exists already, don’t need to made again but I have added that because don’t understand how your users lost connection to internet then.

srcnat or masquerade shall exists on both interfaces

6

I made that change, and now I can no longer get to 111.111.111.111 from the outside, or ping it.

7

correction… I can ping 111.111.111.111 from the outside, but my Nat rules are not working.

8

also, 111.111.111.111 is still going out using the 25.1 gateway.

9

try to replace this :
/ ip firewall mangle
add chain=input in-interface=wan2 action=mark-connection new-connection-mark=wan2_conn
add chain=output connection-mark=wan2_conn action=mark-routing new-routing-mark=to_wan2
add chain=output src-address=192.168.0.10 action=mark-routing new-routing-mark=to_wan2

with this :
/ ip firewall mangle
add chain=input in-interface=wan2 action=mark-connection new-connection-mark=wan2_conn
add chain=input src-address=192.168.0.10 action=mark-connection new-connection-mark=wan2_conn
add chain=output connection-mark=wan2_conn action=mark-routing new-routing-mark=to_wan2

after that monitor connections and see what happen with wan2_conn.

do you have sec-nat or masquerade on 111.111.111.111 ? check ping and if necessary remove “check-gateway=ping” on this interface.

I am not sure what is wrong on your configuration but if you understand packet flow and why you need to mark connection would not be hard to made that working. Just keep in mind that all by default need to go to 192.168.25.1 and packets “to_wan2” need to go to 111.111.111.111. Also, keep in mind that connections coming from wan2 need to be marked and sent back using same interface.

10

al my nat entries are list in this thread.

Also, the server at 192.168.1.10 still thinks it’s coming from the wan IP of 192.168.25 network.

11

and what thinking connections list ? did you had chance to check connection mark in connections ?

12

OK, I’m lost…

I have the Mangle rules setup. I can see packets flowing through these rules.

If I go to whatismyip.net on the server I get the ip of the DSL side which is on the 192.168.25.1 gateway.

I want all packets in and out to go to the 111.111.111.1 gateway from and to 192.168.0.10.

SO, do I need to setup a src-nat rule for that?

It looks like everything is A ok in the mangle rules.

There must be something else I need to do.

13

just debug situation. Open winbox and go to IP → Firewall → Connections

and there watch what happen with your connections from 192.168.1.10

In same window watch incomming connections to public IP supposed to be forwarded to 192.168.1.10 and outgoing connections. All of them shall have connecton mark “wan2_conn”. If this is not, then you need to check where you lost mark. If this connection mark exists and packets still leaving using 192.168.25.1 problem is in routing.

14

Ok here is what I see.

connections from 111.111.111.0/24 to 111.111.111.111 are showing a Connection Mark of wan2_conn

connections from 192.168.0.10 are only marked when the destination is 192.168.0.255

I see no other connections being marked.

here are my Mangle rules as in the router now

0 chain=input action=mark-connection new-connection-mark=wan2_conn
passthrough=yes in-interface=wan2

1 chain=input action=mark-connection new-connection-mark=wan2_conn
passthrough=yes src-address=192.168.0.10

2 chain=output action=mark-routing new-routing-mark=to_wan2
passthrough=yes connection-mark=wan2_conn

15

it is marking the connect now, but still not going out the route assigned to that connection mark

16

is 111.111.111.111 your static IP and gateway is static or you get that from dhcp ?

17

gateway is static.

18

where 111.111.111.111 would be static ip, 111.111.111.1 would be gateway, and always stays that way.