I wanted to put one IP to another isp using pbr
/ip firewall mangle
add action=mark-routing chain=prerouting new-routing-mark=isp_2 passthrough=no \
src-address=10.10.194.40
/ip route
add distance=4 gateway=192.168.0.1 routing-mark=isp_2
/ip route rule
add dst-address=0.0.0.0/0 src-address=10.10.194.40/32 table=isp_2
when I put this config, Pc don’t have access to internet.
anav
November 7, 2023, 2:05pm
2
The right question is why did you mangle???
Think about it…
a. you created a table and a route using the table.
b. you created a routing rule for that IP to use the table.
DONE! no mangling required.
Also why did you bother with distance=4?
While we are at it lets fix the routing rule.
from:
/ip route rule
add dst-address=0.0.0.0/0 src-address=10.10.194.40/32 table=isp_2
TO
/ip route rule
add src-address=10.10.194.40/32 action=lookup-in-table table=isp_2
+++++++++++++++++++++++++++
In conclusion, pbr works fine, the admin not so much!
The right question is why did you mangle???
Think about it…
a. you created a table and a route using the table.
b. you created a routing rule for that IP to use the table.
DONE! no mangling required.
Also why did you bother with distance=4?
While we are at it lets fix the routing rule.
from:
/ip route rule
add dst-address=0.0.0.0/0 src-address=10.10.194.40/32 table=isp_2
TO
/ip route rule
add src-address=10.10.194.40/32 action=lookup-in-table table=isp_2
+++++++++++++++++++++++++++
In conclusion, pbr works fine, the admin not so much!
/ip route
add distance=3 gateway=192.168.0.1 routing-mark=ISP2
add check-gateway=ping distance=1 gateway=8.8.4.4
add check-gateway=ping distance=2 gateway=8.8.8.8
add distance=1 dst-address=8.8.4.4/32 gateway=x.y.251.165 scope=10
add distance=2 dst-address=8.8.8.8/32 gateway=192.168.0.1 scope=10
/ip route rule
add dst-address=192.168.2.3/32 src-address=10.10.194.40/32 table=ISP2
tracert -d -w 100 192.168.2.3
Tracing route to 192.168.2.3 over a maximum of 30 hops
1 <1 ms <1 ms <1 ms 10.10.194.1
2 * * * Request timed out.
3 * * * Request timed out.
4 * * * Request timed out.
problem is , that 2.3 is reachable over openvpn connection which interface is established through ISP1…
So thats why maybe i cant make this to work…