Update: 7.22rc3 has been released that fixes the issue below, downgrade to 7.21.3 is no longer required.
Old warning because of issues with 7.22beta1-7.22rc2
Because you are running 7.22rc and we'll be using routing rules, try to downgrade the router to 7.21.3 first! The reason is that the current 7.22rc handling of the routing rule table is in a buggy and incompatible state with past and future RouterOS versions, you can follow up the discussion chain between MikroTik @mrz and I for more details. You should avoid adding new routing rules for the versions 7.22beta1-7.22rc2!
Once you've downgraded to 7.21.3 upgraded to 7.22rc3, you can try this idea (that does not require any NAT workaround or the new WireGuard VRF support).
The idea, which is the reverse of what @rplant proposes above, is to let the main routing table have WAN1 as primary and WAN2 as fail-over. Then to add another routing table where it's the reverse, WAN2 is primary and WAN1 is failover. And then add routing rules to steer all LAN clients to the 2nd table. It works with dynamic WAN IP addresses and fasttrack.
-
First, create the 2nd routing table:
/routing table add disabled=no fib name=prefer-WAN2 -
Assuming your WANs use DHCP client, you can configure the clients like following to automatically populate the two routing tables with default routes:
/ip dhcp-client add default-route-tables=main:1,prefer-WAN2:5 interface=ether1 name=client1 add default-route-tables=main:5,prefer-WAN2:1 interface=ether2 name=client2 -
Populate the routing rules table with rules for all your LAN subnet, for example assuming your LAN and VLANs have the subnets
192.168.88.0/24,172.24.0.0/16,10.20.30.0/24(*):/routing rule add action=lookup min-prefix=0 table=main add action=lookup table=prefer-WAN2 src-address=192.168.88.0/24 add action=lookup table=prefer-WAN2 src-address=172.24.0.0/16 add action=lookup table=prefer-WAN2 src-address=10.20.30.0/24 # ... # add more rules if you have more subnets
No NAT is requires, except for the standard SRCNAT masquerade for out-interface=ether1 and out-interface=ether2. The LAN clients will use WAN2 by default, while the router itself uses WAN1.
(*) As alternative for the above routing rules, instead of listing the subnets, you can also list the interfaces instead, example:
/routing rule
add action=lookup min-prefix=0 table=main
add action=lookup table=prefer-WAN2 dst-address=0.0.0.0/0 interface=bridge1
add action=lookup table=prefer-WAN2 dst-address=0.0.0.0/0 interface=vlan123
add action=lookup table=prefer-WAN2 dst-address=0.0.0.0/0 interface=wireguard1
# ...
# add more rules if you have more LAN interfaces
Remove dst-address=0.0.0.0/0 if you want to apply to IPv6 too.