Community discussions

MikroTik App
 
jbar
just joined
Topic Author
Posts: 9
Joined: Sun Nov 12, 2017 8:46 pm

Fasttrack kills Policy Based Route

Tue Jul 31, 2018 2:02 am

I just ran into an issue where I setup the router to handle incoming connections from a secondary WAN (WAN2) and forcing the responses to go out the secondary WAN (WAN2), with all other connections defaulting to the first WAN (WAN1). So I setup the pre-routing and output marks, and applied a connection mark to the route, set the gateway weights to 1. While testing, it seems only 1 packet made it out of the router, everything else just dies. I had a fasttrack-connection rule for established and related connections, disabled that, everything works. So I had to setup the fast-track to only apply to connections going out WAN1 so that WAN2 would work. Is that right? It feels like a little bit of a hack?
 
User avatar
strods
MikroTik Support
MikroTik Support
Posts: 1626
Joined: Wed Jul 16, 2014 7:22 am
Location: Riga, Latvia

Re: Fasttrack kills Policy Based Route  [SOLVED]

Tue Jul 31, 2018 7:15 am

That is the whole point of FastTrack:

https://wiki.mikrotik.com/wiki/Manual:IP/Fasttrack

"Fasttracked packets bypass firewall, connection tracking, simple queues, queue tree with parent=global, ip traffic-flow(restriction removed in 6.33), IP accounting, IPSec, hotspot universal client, VRF assignment, so it is up to administrator to make sure fasttrack does not interfere with other configuration"

Since fasttracked packets bypass firewall, they can not be properly marked by Mangle rules.
 
jbar
just joined
Topic Author
Posts: 9
Joined: Sun Nov 12, 2017 8:46 pm

Re: Fasttrack kills Policy Based Route

Tue Jul 31, 2018 4:54 pm

It is the terms that are the problem. Firewall to me is anything under the Firewall tab, not the entire device like I found out the hard way when I was trying to setup a DNAT, but had to use connection marks, but only connection tracking is mentioned, and I didn't know those two were the same thing. I assumed since the firewall is stateful that connection tracking just meant the tracking tab in WinBox.

*edit* My wan connections are on port 12 and port 13 of the RB1100AHx4 device, which fasttrack documentation says is not supported since it's just ether1-11. Which just made this even stranger.

I'm suggesting edits to the documentation you linked to clarify, because others have ran into this issue, and posting "this is the point of fasttrack" doesn't help us beginners.

"IPv4 FastTrack handler is automatically used for marked connections. Use firewall action "fasttrack-connection" to mark connections for fasttrack. Currently only TCP and UDP connections can be actually fasttracked (even though any connection can be marked for fasttrack). IPv4 FastTrack handler supports NAT (SNAT, DNAT or both).

Note that not all packets in a connection can be fasttracked, so it is likely to see some packets going through slow path even though connection is marked for fasttrack. This is the reason why fasttrack-connection is usually followed by identical action=accept rule. Fasttracked packets bypass firewall, connection tracking, connection marks, policy based routing, simple queues, queue tree with parent=global, ip traffic-flow(restriction removed in 6.33), IP accounting, IPSec, hotspot universal client, VRF assignment, so it is up to administrator to make sure fasttrack does not interfere with other configuration; If you have fasttrack enabled and experience any networking issues, temporarily disable fasttrack. If this solves your issue, make your fasttrack rule more specific to interfaces that do not use any of the above features."

Who is online

Users browsing this forum: Google [Bot], GoogleOther [Bot] and 96 guests