NAT not working in load balance (2 WAN)

Technetium · Mon Apr 29, 2019 7:33 pm

I have 2 Wan in load balance configuration after the ISP modem.
Wan 1 : 192.168.10.2
Wan 2 : 192.168.20.2
The load balance work but a NAT rule i have set for a webserver seems not working well. If 2 Wan are connected the NAT sometimes work, sometimes no. If it work, the connection is slow. If i disable the Wan 2 (the NAT rule is only on WAN 1).
The nat rule connect a webserver IP 192.168.1.200 that on the LAN respond on 443 (https, tcp) but is mapped on the ISP router Wan 1 on port 35000.

Mangle rule:


Flags: X - disabled, I - invalid, D - dynamic 
0  D ;;; special dummy rule to show fasttrack counters
      chain=prerouting action=passthrough 

1  D ;;; special dummy rule to show fasttrack counters
      chain=forward action=passthrough 

2  D ;;; special dummy rule to show fasttrack counters
      chain=postrouting action=passthrough 

3    ;;; Accept da WAN1
      chain=prerouting action=accept dst-address=192.168.178.0/24 log=no 
      log-prefix="" 

4    ;;; Accept da WAN2
      chain=prerouting action=accept dst-address=10.0.2.0/24 

5    ;;; PCC stream WAN1
      chain=prerouting action=mark-connection new-connection-mark=WAN1 
      passthrough=yes dst-address-type=!local connection-mark=no-mark 
      in-interface=bridge per-connection-classifier=both-addresses:2/0 

6    ;;; PCC stream WAN2
      chain=prerouting action=mark-connection new-connection-mark=WAN2 
      passthrough=yes dst-address-type=!local connection-mark=no-mark 
      in-interface=bridge per-connection-classifier=both-addresses:2/1 

7    chain=prerouting action=mark-routing new-routing-mark=WAN1-mark 
      passthrough=yes connection-mark=WAN1 in-interface=bridge 

8    chain=prerouting action=mark-routing new-routing-mark=WAN2-mark 
      passthrough=yes connection-mark=WAN2 in-interface=bridge 

9    chain=output action=mark-routing new-routing-mark=WAN1-mark passthrough=ye>
      connection-mark=WAN1 

10    chain=output action=mark-routing new-routing-mark=WAN2-mark passthrough=ye>
      connection-mark=WAN2 

11    chain=prerouting action=mark-connection new-connection-mark=WAN1 
      passthrough=yes connection-mark=no-mark in-interface=WAN1 

12    chain=prerouting action=mark-connection new-connection-mark=WAN2 
      passthrough=yes connection-mark=no-mark in-interface=WAN2 

13    chain=forward action=mark-connection new-connection-mark=WAN1 
      in-interface=WAN1 

14    chain=forward action=mark-connection new-connection-mark=WAN2 
      in-interface=WAN2

NAT Rule:

Flags: X - disabled, I - invalid, D - dynamic 
0    ;;; defconf: masquerade
      chain=srcnat action=masquerade out-interface-list=WAN 
      ipsec-policy=out,none 

2    chain=dstnat action=dst-nat to-addresses=192.168.1.200 to-ports=443 
      protocol=tcp in-interface=WAN1 dst-port=35000 

3    chain=dstnat action=dst-nat to-addresses=192.168.1.200 to-ports=443 
      protocol=udp in-interface=WAN1 dst-port=35000 log=no log-prefix=""

Firewall filter, as default

/ip firewall filter> print
Flags: X - disabled, I - invalid, D - dynamic 
0  D ;;; special dummy rule to show fasttrack counters
      chain=forward action=passthrough 

1    ;;; defconf: accept established,related,untracked
      chain=input action=accept connection-state=established,related,untracked 

2    ;;; defconf: drop invalid
      chain=input action=drop connection-state=invalid 

3    ;;; defconf: accept ICMP
      chain=input action=accept protocol=icmp 

4    ;;; defconf: drop all not coming from LAN
      chain=input action=drop in-interface-list=!LAN 

5    ;;; defconf: accept in ipsec policy
      chain=forward action=accept ipsec-policy=in,ipsec 

6    ;;; defconf: accept out ipsec policy
      chain=forward action=accept ipsec-policy=out,ipsec 

7    ;;; defconf: fasttrack

Do you have any idea why the NAT rule isn't working well with 2 wan ?

P.s. I don't know why code block after first aren't working... @normis

tdw · Mon Apr 29, 2019 9:19 pm

Fasttrack doesn't work with mangle rules - disable it.

Put an extra blank line between code blocks to make them display properly.

Technetium · Tue Apr 30, 2019 2:55 pm

I saw after that i have to disable fasttrack.
In the book and guide i read there is no advice to disable fasttrack and also on the Mikrotik PCC wiki (https://wiki.mikrotik.com/wiki/Manual:PCC).

@normis
Can you update the wiki about PCC and insert an advice like: "disable fasttrack to use PCC" ?
I think will be useful.

anav · Tue Apr 30, 2019 4:04 pm

You doth ask too much!! Its not a user manual, its only a guide for those brainwashed at MT academies. If they had everything in the guide, then there would be no profits or motivation for all the certifications. ;-P

Technetium · Tue Apr 30, 2019 8:13 pm

I think that the reason why there isn't any advice about fasttrack is that no one required it or at the author of the article on PCC didn't occur to him.
I think that user on forum can help to improve it.

P.s. https://wiki.mikrotik.com/wiki/Manual:TOC is the official manual of RouterOS.

sebastia · Tue Apr 30, 2019 8:58 pm

Or more likely...

PCC is available from v3 see top right corner. Or see history: https://wiki.mikrotik.com/index.php?tit ... on=history
On top of that, it was user generated content, when it was still allowed.

FastTrack has been added only recently.

And best of all: the wiki on FT(https://wiki.mikrotik.com/wiki/Manual:IP/Fasttrack) does mention that mangle is bypassed!

Warning: Queues (except Queue Trees parented to interfaces), firewall filter and mangle rules will not be applied for FastTracked traffic.

NAT not working in load balance (2 WAN)

NAT not working in load balance (2 WAN)

Re: NAT not working in load balance (2 WAN)

Re: NAT not working in load balance (2 WAN)

Re: NAT not working in load balance (2 WAN)

Re: NAT not working in load balance (2 WAN)

Re: NAT not working in load balance (2 WAN)

Who is online