Yes mangle rules.
I searched the Internet and forums for a solution when I could not access my ISP Modems. Found many threads with same problem but no definite answer.
So I started to dig for the difference between my previous config and this one. And finally found the “accept” rules to be the answer.
Yes, the accept rules are so that the router can respond to traffic to themselves and to ensure the router can communicate with the modems… or to other public IPs one has which are not being PCC’d
Hence why we mark traffic coming through each wan and also on the output chain ensure the traffic goes back out the same wan.
Thanks for solidifying this bit of knowledge!!
/ip firewall mangle
add action=accept chain=prerouting dst-address=192.168.12.0/24
in-interface-list=LANs
add action=accept chain=prerouting dst-address=192.168.13.0/24
in-interface-list=LANs
add action=accept chain=prerouting dst-address=192.168.14.0/24
in-interface-list=LANs
I note discher does not delineate the need to identify the LAN interface and thus the rule could also be like so and probably preferential if the router and modem needed to chat and not just the OP to the modems…
/ip firewall mangle
add action=accept chain=prerouting disabled=no dst-address=192.168.12.0/24
add action=accept chain=prerouting disabled=no dst-address=192.168.13.0/24
add action=accept chain=prerouting disabled=no dst-address=192.168.14.0/24