I have two WAN (WAN1 and WAN2) and one LAN.
I try to describe my scenario:
LAN: 192.168.100.x/24
WAN1: XXX.XXX.XXX.XXX/28
WAN2: YYY.YYY.YYY.YYY/28
For internet some PCs (From 192.168.100.1 to 192.168.100.20) use WAN1 → WORKS → IP XXX.XXX.XXX.210
Others PCs use WAN2 (From 192.168.100.21 to 192.168.100.100) use WAN2 → WORKS → IP YYY.YYY.YYY.162
On WAN1 i have some servers with various services.
I configured MANGLE and Routes and the internet connection works.
Problem
From the servers (192.168.100.1-20) if i try to contact one Public IP on WAN2 → PING WORKS
If i make a tracert to YYY.YYY.YYY.YYY the first step is the gateway of my network (192.168.100.254)
If i make the same operation but from the IP Included (192.168.100.21-100) i cannot reach the IP on WAN1
If i make a tracert to XXX.XXX.XXX.XXX the first step is * * * *
Why the first step is not my gateway and i cannot reach the IP on my WAN1?
Using WAN2 i can reach every IP on Internet but i cannot reach my IP on WAN1.
2 ;;; NAT Masquerade per Mosaico MIS
chain=srcnat action=masquerade src-address=192.168.100.9 log=no log-prefix=“”
3 ;;; WAN - NAT Masquerade per INTERNET - ALL CLIENTS → 113.139.219.10
chain=srcnat action=masquerade to-addresses=0.0.0.0 src-address=192.168.100.20-192.168.100.100
is changed…a little bit…i don’t want public my IP…
but the concept is the same
why i can contact all the internet ip but not mine on WAN1 from LAN that use the WAN2 internet connection?
Either wrong configuration or you trace route a non existing IP…
You were already missing a masquerade rule for your first “subnet” , i don’t even know how you could reach the Internet through that subnet with that rule missing…
That’s why i believe there are mistakes in your configuration…
NAT Rule N° 3
3 ;;; WAN - NAT Masquerade per INTERNET - ALL CLIENTS
chain=srcnat action=masquerade to-addresses=0.0.0.0 src-address=192.168.100.21-192.168.100.100
No it is not ok..! You do not masquerade your whole192.168.100.0/24, only one part of it… You will have no internet access from the “subnet” you do not masquerade…
Is Necessary to configure the MANGLE like in the picture:
11.11.11.0/24 → WAN1
12.12.12.0/24 → WAN2
192.168.88.0/24 → Local LAN
I guess you don’t really know what that rule does…
You use those accept rules in the mangle facility in order to exclude the directly connected routers from your mangles…Otherwise when you try to ping lets say 11.11.11.1 or 12.12.12.1 they will be routed through your wan interfaces.. This means you will never reach them…Thus we use the main routing table for those addresses…
However you said you cant reach your Public IP.. Strictly speaking your Public IP is neither 11.11.11.1 or 12.12.12.1… Since you are behind a router and you use no tunnels, the public IPs are on your ISPs routers…
