So, I have an interesting setup that I want to try out. A bit of a challenge. Just thought I'd see what people thought, and if there is a problem with my logic here. This is actually a simplified version of what I'm trying to accomplish, but illustrates the issue.
Assume these are all public IPs, no masquerade needed / wanted.
Internet ----->(port8) Router ----> port1 (1.1.1.0/24) (Port 80,8080, 10000-11000)
|----> port2 (1.1.1.0/24) (All other ports)
(just to be clear, port1,port2, and port8 are all ports on the same Router. So the router has three connections, one to the internet, one to each of 2 seperate LANs. Those two LANs have no connections to each other.).
Basically the router is needing to split traffic based on port. But what is complicated is both places it is splitting the traffic to have the same IP addresses.
Here are some examples.
Connected to port1 is a web server. Connected to port2 is a SQL server.
Both machines have the same IP address, 1.1.1.20 They can not see each other, which is fine and how we want it. They both only think they are the only machine with the IP address of 1.1.1.20
When a request from the internet resolves to 1.1.1.20:80, it should get routed to port1. And the response from port1 back to the machine that made the request should be from port1 out to the internet.
When a request from the internet resolves to 1.1.1.20:112 (or any other port not routed to port1), it should get routed to port2. And the response from port2 back to the machine that made the request should be from port2 out to the internet.
If machine 1.1.1.20 (port1) makes a request out to some site on the internet, the traffic should get routed through port1. Likewise if machine 1.1.1.20 (port2) makes a request out to the internet, the traffic should get routed through port2.
So here is the general thoughts I have for rules / how to achieve this (not using actual mikrotik commands, but just what I'm doing):
Use 3 routing tables (probably redundant, could be just 2, but whatever).
main
port1Table
port2Table
Routes:
main
0.0.0.0/0 ---> port8
1.1.1.0/24 ---> port2 (because most traffic goes here)
port1Table
0.0.0.0/0 ---> port8
1.1.1.0/24 ---> port1
port2Table
0.0.0.0/0 ---> port8
1.1.1.0/24 ---> port2
Create AddressList LANIPs=1.1.1.0/24
Mangle Rules:
prerouting -> in interface=port1 Set-connection-mark=p1 passthrough=yes(?)
prerouting -> in interface=port2 Set-connection-mark=p2 passthrough=yes(?)
prerouting -> has-connection-mark=p1 Set-routing=port1Table passthrough=yes(?)
prerouting -> has-connection-mark=p2 Set-routing=port2Table passthrough=yes(?)
prerouting -> in interface=port8 tcp=80,8080,10000-11000 dst-addresslist=LANIPs Set-connection-mark=p1 passthrough=no(?)
prerouting -> in interface=port8 Set-connection-mark=p2 dst-addresslist=LANIPs passthrough=no(?) <--- To catch all other connections
Doesn't seem like it should be that complicated.
The issue is that the connection-marks don't seem to be really doing anything.
The computer 1 connected via port 1 will make a request to the internet (say 8.8.8.8:53). The computer on the internet responds trying to connect to the epherical port given by computer1 (like 59234 or something weird). I can see the response
Src: 8.8.8.8:53 Dst:1.1.1.20:59234
being routed to port2Table. Even though the request was started from port1
Any ideas / help would be appreciated.