Stuck with Mangle on Dual WAN/DualLAN?

rybred · Tue May 22, 2018 10:40 am

Ok i would really appreciate your guys help here because i have the feeling that i am just missing something simple here
i tried following one of the guyides
ok so i'm have 2 wan connections and a LAN subnet and a VOIP subnet

trying to have the LAN use WAN1 and failover to WAN2 and have the VOIP use WAN2 and failover to WAN1
I have not been able to get these working properly, i'm sure it's something simple that i'm missing.
here's my routing:

/ip route
add check-gateway=ping distance=20 comment="lan" gateway=bridge-wan1
add check-gateway=ping distance=10 comment="voip" distance=10 gateway=1.1.1.1 (wan2)
add distance=10 gateway=bridge-wan1 routing-mark=ISP1_Route
add distance=20 gateway=bridge-wan2 routing-mark=ISP1_Route
add distance=10 gateway=bridge-wan2 routing-mark=ISP2_Route
add distance=20 gateway=bridge-wan1 routing-mark=ISP2_Route
/ip firewall address-list
add address=192.168.1.0/24 list=Connected
add address=10.10.1.0/24 list=Connected
add address=192.168.0.0/16 list=subnet_local
add address=10.10.0.0/16 list=subnet_local
add address=172.16.0.0/16 list=subnet_local
add address=192.168.1.0/24 list=subnet_lan
add address=10.10.10.0/24 list=subnet_voip
/ip firewall mangle
add action=mark-connection chain=input comment="Local routing" connection-mark=no-mark dst-address-list=subnet_local log-prefix=ROUTING new-connection-mark=local_routing passthrough=yes \
src-address-list=subnet_local
add action=accept chain=output connection-mark=local_routing log-prefix=ROUTING
add action=mark-connection chain=input comment="ROUTING Rules" connection-mark=no-mark in-interface=bridge-wan1 new-connection-mark=WAN1->ROS passthrough=yes
add action=mark-connection chain=input connection-mark=no-mark in-interface=bridge-wan2 new-connection-mark=WAN2->ROS passthrough=yes
add action=mark-routing chain=output connection-mark=WAN1->ROS new-routing-mark=ISP1_Route
add action=mark-routing chain=output connection-mark=WAN2->ROS new-routing-mark=ISP2_Route
add action=mark-routing chain=prerouting connection-mark=WAN1->LANs new-routing-mark=ISP1_Route src-address-list=subnet_local
add action=mark-routing chain=prerouting connection-mark=WAN2->LANs new-routing-mark=ISP2_Route src-address-list=subnet_local
add action=mark-connection chain=prerouting connection-mark=no-mark dst-address-list=!subnet_local dst-address-type=!local new-connection-mark=LAN->WAN1 passthrough=yes src-address-list=subnet_lan
add action=mark-connection chain=prerouting connection-mark=no-mark dst-address-list=!subnet_local dst-address-type=!local new-connection-mark=LAN->WAN2 passthrough=yes src-address-list=subnet_voip
add action=mark-routing chain=prerouting comment="ISP1 Primary" connection-mark=LAN->WAN1 new-routing-mark=ISP1_Route passthrough=yes src-address-list=subnet_lan
add action=mark-routing chain=prerouting comment="ISP2 Primary" connection-mark=LAN->WAN2 new-routing-mark=ISP2_Route passthrough=yes src-address-list=subnet_voip
add action=mark-connection chain=prerouting connection-mark=LAN->WAN1 new-connection-mark=Sticky_ISP1 passthrough=yes routing-mark=ISP1_Route
add action=mark-connection chain=prerouting connection-mark=LAN->WAN2 new-connection-mark=Sticky_ISP2 passthrough=yes routing-mark=ISP2_Route
add action=mark-routing chain=prerouting connection-mark=Sticky_ISP1 new-routing-mark=ISP1_Route src-address-list=subnet_local
add action=mark-routing chain=prerouting connection-mark=Sticky_ISP2 new-routing-mark=ISP2_Route src-address-list=subnet_local

I cant seem to get my routing working but can't figure it out. any suggestions?
I also have some connection marking rules for traffic shaping that I need to figure out but this is the most important.

anav · Wed May 23, 2018 2:32 am

Here is my guess............ but I am sure someone will rescue you from my attempt.

Assumes
ISP1-WAN1-PRIMARY WAN
ISP2-WAN2-SECONDARY WAN
LAN1 - 192.168.1.0/24 (USERS)
LAN2 - 192.168.2.0/24 (VOIP)
Using Google and OPENDNS to check gateway status.

/ip firewall nat
add action=masquerade chain=srcnat out-interface=ISP1
add action=masquerade chain=srcnat out-interface=ISP2

/ip firewall mangle
add action=mark-connection chain=prerouting new-connection-mark=LAN1RouteConnection passthrough=no src-address=192.168.1.0/24
add action=mark-connection chain=prerouting new-connection-mark=LAN2RouteConnection passthrough=no src-address=192.168.2.0/24
add action=mark-routing chain=prerouting new-routing-mark=LAN1RouteMark passthrough=yes connection mark=LAN1RouteConnection
add action=mark-routing chain=prerouting new-routing-mark=LAN2RouteMark passthrough=yes connection mark=LAN2RouteConnection

/ip route
add dst-address=Host1(8.8.8.

gateway=gatewayIP (of primary ISP)
add dst-address=Host2(208.67.222.222) gateway=gatewayIP (of primary ISP)
add dst-address=Host3(8.8.4.4) gateway=gatewayIP (of secondary ISP)
add dst-address=Host4(208.67.220.220) gateway=gatewayIP (of secondary ISP)

/ip route
add distance=1 gateway=Host1(8.8.8.

check-gateway=ping
add distance=2 gateway=Host2(208.67.222.222)
add distance=1 gateway=Host3(8.8.4.4) check-gateway=ping
add distance=2 gateway=Host4(208.67.220.220)

/Ip route
add destination=0.0.0.0/0 gateway IP (ISP Primary) distance=1, routing
mark=LAN1RouteMark ping gateway
add destination=0.0.0.0/0 gateway IP (ISP Secondary) distance=2, routing mark=LAN1RouteMark,

add destination= 0.0.0.0/0 gateway IP(ISP Secondary) distance=1 routing
mark=LAN2RouteMark ping gateway
add destination=0.0.0.0/0 gateway IP (ISP Primary) distance=2 routing mark=LAN2RouteMark

yhfung · Wed May 23, 2018 3:39 am

Do not forget to disable the FastTrack option in the firewall otherwise strange problem may be arisen.

Once the problem is fixed, before re-activating the FastTrack, you have to exception rules before the FastTrack rules in the forward chain.

Stuck with Mangle on Dual WAN/DualLAN?

Stuck with Mangle on Dual WAN/DualLAN?

Re: Stuck with Mangle on Dual WAN/DualLAN?

Re: Stuck with Mangle on Dual WAN/DualLAN?

Who is online