I have a post here http://forum.mikrotik.com/t/multi-wan-connection-tracking/157689/1 that explains how I used mangle to track multiple WAN connections and always route inound WAN traffic back out to the appropriate gateway. However implementing this has seemed to break my ability to access the router with WinBox. It seems that everything that goes through the router to a device and back in the LAN gets routed out the WAN correctly, but when the destination is the WAN IP address for WinBox access it fails to return the traffic. Here’s a diagram of my system. I’m trying to use WinBox from the B Corp server through Cell 2 and open 192.168.200.2:8291.
When I add a static /IP Routing rule for 0.0.0.0/0 back out that interface (WAN2) it works, but breaks WAN1 traffic. Without that rule both WAN1 and WAN2 work as desired, but WinBox doesn’t work. What am I missing?
You do need some route(s) in main routing table, otherwise the initial routing decision fails, because it uses main routing table. You do mark routing for those packets, but it happens only after that. Add e.g. this:
Router will use it for own connections to outside (e.g. to access DNS server, check for updates, etc), and also for initial routing decision. But your mangle rules will override it for marked connections.
@sob i don’t agree with you.
Yes there are cases where not having a Main Routing Table can cause situations where the packets can’t be routed and are dropped or are routed in a wrong way.
But not in this case.
The OP describes that can’t reach from B corp the Router 200.1.
The packet looking the Packet flow on for example input chain https://help.mikrotik.com/docs/display/ROS/Packet+Flow+in+RouterOS#PacketFlowinRouterOS-Input
the packet first goes to the prerouting chain, it will be marked accordingly and only after that will go to the Routing Decision where it is already marked and will have no problems to be routed as it should.
The same applies to the forward chain, first is the prerouting chain, and only after that the routing decision follows.
Not having a main routing table would cause problems e.g. for packets initiated from the Router, in IPsec cases etc.
The router is smarter than the 3 morons above me. ;-PP
Its has recognized that opening up the port for winbox to anything other than the LAN is hazardous to its health.
This is a preservation move by the router and you will not find a solution anywhere, as its neurons are not programmable!
of course if you thought that was bad it can get worse. add action=accept chain=input comment=WinBox dst-port=80 protocol=tcp
The entire IP address schema baffles me, as not sure why what has been chosen has been chosen, I would think setting statiC DHCPs would suffice???
In any case its probably one of those cases that is perfectly fine and I just dont understand the logic.
Seems to be a pattern of setting the IP address for the subnet and then individually assigning other addresses on the port and then the bridge running over ether2 as well…sigh.
@anav you are right on that.
However i thought the OP was trying to access 200.1 as you can see from my previous answer and not 200.2.
Anyways, the OP indicated that it works on some cases, so i am confused now, maybe the tests where made with firewall disabled ? who knows…
@Zacharias: I’ve been wrong before, it can happen (don’t tell @anav), but I think that I’ll last a little longer before I inevitably repeat it. OP wants to connect to 192.168.200.2:8291, that’s this router, so you should be rather looking at output chain as the same page.
@sob you are right, sorry.
I just missed that the reply will have nowhere to go because of the missing main Routing Table and that the Routing decision in Output chain is earlier than the Routing Adjustment.
Thank you all for your responses. I really appreciate the input. I haven’t been able to try @Sob’s route rule and won’t be able to until I get back to work Monday. I’m hoping this is the piece that I need.
As I mentioned at the end of the OP, whenever I add a main table routing rule it seems to break the marked connections. Is that the way the packet/rule flow is supposed to work or do I have something wrong there?
Prior to adding this router, A Corp was the only one connected to the three RTU’s. The RTU’s are dumb measurement devices in a a pipeline system that only have static IP’s and don’t broadcast data, they only respond to poll requests from the server. The entire network from the servers to the RTU’s is isolated from the internet. (Private cellular APN with no routes in or out to the world.) The three RTU’s were on the Cell 1 LAN at 192.168.13.101/102/103. However my company, B Corp just purchased a potion of A Corps assets and needs access to the same measurement data. The result is that we are adding our own Cell routers but can’t just add them to the 13.0/24 subnet. I have to add a intermediate gateway with routing rules to allow the RTU’s to communicate with two different servers. Because of this I’m using port forwarding in the WAN connections of the new router, hence the multiple WAN IP addresses. Hopefully that makes sense. I don’t know any way around this setup and it gives us the best network isolation between A and B Corp that I know how to provide, while still sharing end devices.
THIS. Thank you @Sob! I added this to the /Routing Rules and everything is working as I expect it to! Mangle is tracking packets and router generated traffic goes where I want it to. Thank you!
OP wants to connect to 192.168.200.2:8291, that’s this router, so you should be rather looking at