Can I challenge something?
In my case, I have a VPN in a VRF (the VPN itself is irrelevant here). I want to run a bandwidth test between the sites.
If I add this, I’m able to ping from the main routing table; however, b-test / tool speed-test is still not working.
/ip route
add disabled=no dst-address=10.60.10.0/30 gateway=wg1@vrf-stp routing-table=
main suppress-hw-offload=no
Any clue what might be missing?
Nice! My question is or comment is:
It would appear that one has to approach local subnets ( as if they were external subnets ) for any local routing. Aka the router doesnt know enough about them to route their traffic properly.
I did some experiments, and apparently with the current state of Bandwidth Test and Speed Test, this is not possible if the link to the other side is in a VRF other than main.
You can use multiple methods (like you did) to force the packets over the VPN, and the other side will also respond, and the response packets will correctly land in the input chain, with the expected destination IP address. However, because they belong to non-main VRF, the Bandwidth Test and Speed Test tools will reject them, and will close the connection if it's TCP (by sending back RST packet). It's not a routing or firewall problem anymore, but it's the tools that reject the packets.
Probably the two tools will need to be updated to accept the @vrf modifier to the destination address/hostname, like :ping and /tool traceroute already have. Currently /tool speed-test and /tool bandwidth-test only accept the %interface modifier.
