/ip firewall mangle
add action=mark-routing chain=prerouting dst-address-list=blocked \
new-routing-mark=vpn passthrough=no
/ip route
add distance=5 gateway=vpn routing-mark=vpn
/ip route
add distance=5 dst-address=195.201.201.32/32 gateway=vpn
add distance=5 gateway=vpn routing-mark=tovpn
add distance=20 dst-address=195.201.201.32/32 gateway=vpn
Having different distances means nothing in this case - these two rules are in the different routing tables.I concatenated two rules, dst-address and route-mark in one route, and it's ignore reply again :( I can't uderstand this situation and hope anybody help me to diagnose it...
/ip firewall raw
add action=passthrough chain=prerouting disabled=no in-interface=vpn log=\
yes protocol=icmp
BUT, I see reply at client only iffirewall,info prerouting: in:vpn out:(unknown 0), proto ICMP (type 0, code 0), 195.201.201.32->10.119.112.128, len 84
add disabled=yes distance=20 dst-address=195.201.201.32/32 gateway=vpn/ip firewall address-list
add address=2ip.ru list=blocked
add address=192.168.10.0-192.168.88.255 list=olegon
/ip firewall filter
add action=passthrough chain=forward disabled=yes log=yes protocol=icmp
add action=fasttrack-connection chain=forward dst-address=!192.168.88.2 src-address=!192.168.88.2
add action=fasttrack-connection chain=forward connection-state=established,related dst-address-list=olegon src-address-list=olegon
add action=jump chain=forward comment="many connections trap" connection-limit=128,24 dst-address=192.168.88.2 in-interface=wan jump-target=catch log=yes \
log-prefix=fuckconnect protocol=tcp tcp-flags=!ack
add action=jump chain=input comment="port scanners" connection-state=new dst-port=22,708,709,3128,3389,8291,8080 in-interface=wan jump-target=catch \
log-prefix=fuckscan protocol=tcp tcp-flags=""
add action=add-src-to-address-list address-list=banned address-list-timeout=1d chain=catch
add action=drop chain=catch
/ip firewall mangle
add action=passthrough chain=prerouting disabled=yes in-interface=vpn log=yes protocol=icmp
add action=mark-routing chain=prerouting connection-state=new dst-address-list=blocked new-routing-mark=tovpn passthrough=yes
/ip firewall nat
add action=netmap chain=dstnat dst-address=xxx.xxx.xxx.187 dst-port=80,443 protocol=tcp to-addresses=192.168.88.2
add action=redirect chain=dstnat dst-address=10.10.0.0/16 dst-port=80 in-interface=!wan protocol=tcp to-addresses=192.168.8.2 to-ports=8080
add action=netmap chain=dstnat dst-address=xxx.xxx.xxx.187 dst-port=6969 protocol=tcp to-addresses=192.168.88.70
add action=netmap chain=dstnat dst-address=xxx.xxx.xxx.187 dst-port=6969 protocol=udp to-addresses=192.168.88.70 to-ports=6969
add action=src-nat chain=srcnat dst-address=192.168.88.2 dst-port=80,443 protocol=tcp src-address=192.168.0.0/16 to-addresses=192.168.88.1
add action=src-nat chain=srcnat out-interface=wan src-address=192.168.0.0/16 to-addresses=xxx.xxx.xxx.187
add action=masquerade chain=srcnat out-interface=vpn src-address=192.168.0.0/16 to-addresses=10.119.112.128
/ip firewall raw
add action=drop chain=prerouting in-interface=wan src-address-list=banned
add action=drop chain=prerouting dst-address-list=banned
add action=passthrough chain=prerouting disabled=yes in-interface=vpn log=yes protocol=icmp
/ip route
add distance=5 gateway=vpn routing-mark=tovpn
add distance=1 dst-address=192.168.10.0/24 gateway=192.168.88.254 pref-src=192.168.88.1
add disabled=yes distance=20 dst-address=195.201.201.32/32 gateway=vpn
# DST-ADDRESS PREF-SRC GATEWAY DISTANCE
0 A S 0.0.0.0/0 vpn 5
1 ADS 0.0.0.0/0 xxx.xxx.xxx.1 10
2 ADC 10.119.64.1/32 10.119.112.128 vpn 0
3 ADC xxx.xxx.xxx.0/23 xxx.xxx.xxx.187 wan 0
4 A S 192.168.10.0/24 192.168.88.1 192.168.88.254 1
5 ADC 192.168.88.0/24 192.168.88.1 bridge 0
6 X S 195.201.201.32/32 vpn 20
add distance=5 gateway=10.119.64.1 routing-mark=tovpn
First of all: you can't use mark-routinng for only the first packet.add action=mark-routing chain=prerouting connection-state=new dst-address-list=blocked new-routing-mark=tovpn passthrough=yes
/ip firewall mangle
add action=mark-routing chain=prerouting dst-address-list=blocked \
new-routing-mark=tovpn passthrough=yes
ip-forward: yes
send-redirects: yes
accept-source-route: yes
accept-redirects: no
secure-redirects: yes
rp-filter: strict
tcp-syncookies: yes
max-neighbor-entries: 8192
arp-timeout: 30s
icmp-rate-limit: 10
icmp-rate-mask: 0x1818
route-cache: yes
allow-fast-path: yes
ipv4-fast-path-active: no
ipv4-fast-path-packets: 0
ipv4-fast-path-bytes: 0
ipv4-fasttrack-active: no
Probably you should wait for route cache to expire.And yes, rp-filter=strict, but I changed it to "no" without any success...
So it was rp-filter after all?!Thank you for patience, xvo
I rebooted device and claimed, that this is RP-filter, which discard reply packed in strict mode.
I don't understand why... Suppose routers must use only loose mode?
Yes, exactly!Packets routes by route mark to vpn interface... Reply come from the other side, checked by RP-Filter, based on rules without route mark, and discarded.
No, it is a limitation, but not a bug.Yes, xvo, you describe more accurately, what I mean...
But suppose, this is bug... RP-filter or route with route mark can't be existed at one time.
Ok. Your are welcome.Thank you for the advice, but it's very difficult schema for me, because of dynamic adresses of VPN...
I prefer to loose mode of RP-filter, than very big route table...
/ip firewall mangle
add action=mark-routing chain=prerouting dst-address=216.0.0.0/8 new-routing-mark=route_through_vpn passthrough=yes src-address=10.1.0.60
add action=mark-routing chain=prerouting dst-address=10.1.0.60 in-interface=ovpn new-routing-mark=route_through_vpn passthrough=yes src-address=216.0.0.0/8
/ip route
add distance=1 dst-address=10.1.0.0/25 gateway=vlan100-management routing-mark=route_through_vpn
add check-gateway=ping distance=1 dst-address=216.0.0.0/8 gateway=10.7.0.9 routing-mark=route_through_vpn
Hi, I tried this solution but still not work. Can you please better explain your idea?Yes, exactly!Packets routes by route mark to vpn interface... Reply come from the other side, checked by RP-Filter, based on rules without route mark, and discarded.
The way to overcome it:
1) copy routes pointing to local networks to tovpn routing table
2) and mark the returning packets to use it too