Hello, I have two Wan connections, and the problem I have is that I cannot control the traffic, I have these two connections where one is with a higher priority than the other only enters if the first one falls, that is, I have an internet failure. My problem is that I want to use the interface that is in standby to get an rdp connection to a server, so I do a nat to the port to get from the public IP to the private IP, however the problem is that I see that I arrive at that wan and to the port but the connection is not completed, doing torch asks to observe that the waiting connection reaches the IP dr but returns the response through the internet interface with less administrative distance so that the connection does not complete, note: I need it to be like this because the backup connection is of lower bandwidth … I ask you, how do I guarantee that what enters through an interface leaves through that same interface? ok I tried with mangle to mark what goes in and what goes out in such a way that in the route I tell it to take that markup and go out through the wan I want but I observe that if the nat looks first at the connection I want it to take, it no longer marks the input, now if a ping arrives for example if the packet marking works, I do not understand why if both are an input for an interface … can you help me?
As dst-nat redirects the packet originally coming to router’s own IP address to some external one (in the LAN subnet), the packet is further handled by chain forward rather than by chain input. The responses to it are thus also handled by chain forward rather than chain output.
So the assignment of connection-mark based on in-interface must be done in chain prerouting in mangle (which means you don’t need separate rules in chains input and forward), but it is not enough to translate the connection-mark to routing-mark in chain output of mangle, you have to add similar translation rules also to chain prerouting or forward. This connection-mark → routing-mark translation rule must not act on WAN->LAN packets.
And fasttracking must not be used for these connections.
http://forum.mikrotik.com/t/static-default-route-im-missing-something/119183/9 - start reading from the last paragraph to get the context.