Community discussions

MikroTik App
 
OKNET
Member
Member
Topic Author
Posts: 354
Joined: Mon Jun 22, 2015 9:22 am

I don't understand this simple mangle rule:

Thu Jul 14, 2016 6:46 pm

In a double WAN environment

/ip firewall mangle

add action=accept chain=prerouting disabled=no dst-address=<WAN1_class>
add action=accept chain=prerouting disabled=no dst-address=<WAN2_class>

to exempt connected networks from the mangle chain

but how do they really work ? what if it they are not present ?
 
 
pe1chl
Forum Guru
Forum Guru
Posts: 10240
Joined: Mon Jun 08, 2015 12:09 pm

Re: I don't understand this simple mangle rule:

Thu Jul 14, 2016 7:12 pm

These are obviously part of a bigger picture, but you omitted it...
 
freemannnn
Forum Veteran
Forum Veteran
Posts: 700
Joined: Sun Oct 13, 2013 7:29 pm

Re: I don't understand this simple mangle rule:

Thu Jul 14, 2016 8:02 pm

me too i dont understand these 2 rules in dual wan examples.
can someone explain what for exist?
 
User avatar
ZeroByte
Forum Guru
Forum Guru
Posts: 4047
Joined: Wed May 11, 2011 6:08 pm

Re: I don't understand this simple mangle rule:

Thu Jul 14, 2016 10:00 pm

The point of these rules is to bypass policy routing for destinations which are directly connected to the router itself.

So if WAN1 is 192.0.2.36/30 and WAN2 is 198.51.100.162/30, then you want to reach these particular subnets by going directly to the appropriate WAN interface, and not being subject to the outbound load-balancing policy.

Otherwise, you may try to ping 198.51.100.163 (the ISP end of WAN2), and the load balancing rules might choose ISP1 for this ping, causing the ping to go out ISP1, all the way through the Internet to ISP2, and then ping the ISP's router from the Internet side, and the reply going all the way back around the Internet and back to you through ISP1.
 
freemannnn
Forum Veteran
Forum Veteran
Posts: 700
Joined: Sun Oct 13, 2013 7:29 pm

Re: I don't understand this simple mangle rule:

Thu Jul 14, 2016 10:18 pm

thanx for the nice example "0byte". now i understand!
 
User avatar
ZeroByte
Forum Guru
Forum Guru
Posts: 4047
Joined: Wed May 11, 2011 6:08 pm

Re: I don't understand this simple mangle rule:

Thu Jul 14, 2016 11:45 pm

No problem.

I actually find it to be more straightforward to use routing rules to override policy - it keeps the policy rules in the mangle table from getting overly complicated.

/ip route rule add action=lookup-only-in-table table=main dst=x.x.x.x/m

This rule means that if the destination IP is in the range specified by x.x.x.x/m, then only look it up in the main routing table. This trumps any routing marks present on the packet, so your mangle table can just mark away to its heart's content, but it won't matter because the routing engine will ignore them for those specific destinations.
 
pe1chl
Forum Guru
Forum Guru
Posts: 10240
Joined: Mon Jun 08, 2015 12:09 pm

Re: I don't understand this simple mangle rule:

Fri Jul 15, 2016 1:25 am

In such cases I have just added a static route to that destination in the "other" table.  So when the marking results in
a lookup in the "wrong" table, it still goes to the correct destination.
It is probably the most efficient solution at runtime, as there are no extra rules to process for each packet.
 
OKNET
Member
Member
Topic Author
Posts: 354
Joined: Mon Jun 22, 2015 9:22 am

Re: I don't understand this simple mangle rule:

Mon Jul 25, 2016 5:30 pm

Thank you for answers
I connect only a single device to my wan interface , it is the ISP dsl router usually with the whole traffic natted to MT machine WAN so that connection has a /30 subnet and router IP adress is set as gateway in MT routing table (one router per wan)
Can i omit that mangle rules in this scenario or are they needed anyway ?
 
User avatar
ZeroByte
Forum Guru
Forum Guru
Posts: 4047
Joined: Wed May 11, 2011 6:08 pm

Re: I don't understand this simple mangle rule:

Tue Jul 26, 2016 4:16 pm

Thank you for answers
I connect only a single device to my wan interface , it is the ISP dsl router usually with the whole traffic natted to MT machine WAN so that connection has a /30 subnet and router IP adress is set as gateway in MT routing table (one router per wan)
Can i omit that mangle rules in this scenario or are they needed anyway ?
You need to have direct (non-policy) routes for the directly-connected networks, especially the wan /30s if you're using any kind of "check gateway" testing. Otherwise, you may be pinging the ISP2 address, but it could be going out ISP1 link and all the way around the Internet to reach that address.... 
 
OKNET
Member
Member
Topic Author
Posts: 354
Joined: Mon Jun 22, 2015 9:22 am

Re: I don't understand this simple mangle rule:

Tue Jul 26, 2016 5:57 pm

Thank you for answers
I connect only a single device to my wan interface , it is the ISP dsl router usually with the whole traffic natted to MT machine WAN so that connection has a /30 subnet and router IP adress is set as gateway in MT routing table (one router per wan)
Can i omit that mangle rules in this scenario or are they needed anyway ?
You need to have direct (non-policy) routes for the directly-connected networks, especially the wan /30s if you're using any kind of "check gateway" testing. Otherwise, you may be pinging the ISP2 address, but it could be going out ISP1 link and all the way around the Internet to reach that address.... 
Do you mean that , despite MT knows their connected networks (the /30 link with routers LAN) , they would be overriden by policy routes (i.e. mangle ones) ?
 
User avatar
ZeroByte
Forum Guru
Forum Guru
Posts: 4047
Joined: Wed May 11, 2011 6:08 pm

Re: I don't understand this simple mangle rule:

Wed Jul 27, 2016 3:04 am

Yes. Whenever a packet has a routing mark, the router will only consider routing table entries with the same mark.
 
OKNET
Member
Member
Topic Author
Posts: 354
Joined: Mon Jun 22, 2015 9:22 am

Re: I don't understand this simple mangle rule:

Wed Jul 27, 2016 3:40 pm

Clear !

Just choosen the routing rules instead now

If I have multiple LANs interfaces, should the routing rules have to be applied to that subnets also ??? 
Thank you
 
User avatar
ZeroByte
Forum Guru
Forum Guru
Posts: 4047
Joined: Wed May 11, 2011 6:08 pm

Re: I don't understand this simple mangle rule:

Wed Jul 27, 2016 7:09 pm

I generally advise users to just make a broad rule:
dst-address=192.168.0.0/16

This will work for all 256 private /24 networks in the 192.168.x.x range, and you won't need to remember to add routing rules whenever you provision a new LAN range using that IP space.
If you're using 172.16-31.x.x/12 or 10.x.x.x/8 you should use that in the routing rule. In general, I'd say to use as few rules as possible in order to maximize performance.

It may actually be higher performance to do as Pe1chl suggested, and add all of your local subnets as static routes in all tables - it's just that this can really snowball into a large number of routes to maintain as your number of interfaces / routing tables increases. Routing rules are the simplest way, but perhaps not the absolute fastest performance-wise.

For me, I'd say that achieving the desired behavior is the #1 concern (assuming that your desired behavior isn't horribly afoul of best practice / design considerations)
Then performance.
Given multiple solutions that achieve the first two criteria, I go with the simplest.
 
OKNET
Member
Member
Topic Author
Posts: 354
Joined: Mon Jun 22, 2015 9:22 am

Re: I don't understand this simple mangle rule:

Thu Jul 28, 2016 10:28 am

I'm not sure to have understood pe1chl suggestion :
I actually have three table to choose in routing rules :  "main" , "to_WAN1" and "to_WAN2"

"to_WAN1" and "to_WAN2" are the routing marks defined by PCC and added to each 0.0.0.0/0 route :

dst-address=0.0.0.0/0 gateway=10.0.10.1 gateway-status=10.0.10.1 reachable via  ether23 check-gateway=ping distance=1 scope=30 target-scope=10 routing-mark=to_WAN1
dst-address=0.0.0.0/0 gateway=10.0.20.1 gateway-status=10.0.20.1 reachable via  ether24 check-gateway=ping distance=1 scope=30 target-scope=10 routing-mark=to_WAN2

do you mean I have to insert a further static route for the WAN subnet for each routing mark ? i.e.

dst-address=10.0.10.0/30  reachable via  ether23  routing-mark=to_WAN1
dst-address=10.0.20.0/30  reachable via  ether24  routing-mark=to_WAN2
 
User avatar
ZeroByte
Forum Guru
Forum Guru
Posts: 4047
Joined: Wed May 11, 2011 6:08 pm

Re: I don't understand this simple mangle rule:

Fri Jul 29, 2016 11:46 pm

Yep - that's what he means.
If you don't exempt your internal networks / directly-connected networks from policy-routing (using either routing rules OR exemptions in the mangle table design) then you must put routes into each table where you want them to be used.

If you need an easier way to visualize the various tables - in Winbox, try using the view filter drop-down window at the top-right corner of the Route List window - select a routing table (such as the WAN1 table) and it will only show those routes... this is the complete routing table for any packet with that mark on it - it can ONLY follow that table.

Who is online

Users browsing this forum: GoogleOther [Bot] and 85 guests