Community discussions

 
AVA
just joined
Topic Author
Posts: 21
Joined: Mon Jun 18, 2018 6:19 pm

Multihoming and connection tracking

Thu Jan 31, 2019 3:13 pm

Hi,

I want to build up a system as follows:
schema.png
The two CCRs have BGP connections to the uplink provider (2 ports, 1 ASN) and they exchange routes with the PPPoE servers via OSPF. The second uplink port exists for redundancy purpose, not to gain more bandwith. So in normal operation mode the customer traffic should run through the first BGP router. My question is, what can happen if I have asymmetric traffic flow? For example a customer establishes a TCP connection and sends his syn packet through BGP router 1 but the ack package arrives through BGP router 2? Normaly I would setup firewall rules which allow incoming packets only if they are related to a connection which is established from the inside, hence BGP router 2 would drop the ack packet. So, how can I keep reliable connection tracking with more than one possible paths?
Of course I'll try to force the traffic to run through router 1 but I can't force a host in the internet to use the first path as long its available. Although I guess that if I use AS prepend for the second router and both BGP peers have the same partner AS, there should be no reason for a host to use the second path...
Please let me know your opinions!

Michael
You do not have the required permissions to view the files attached to this post.
 
pe1chl
Forum Guru
Forum Guru
Posts: 5096
Joined: Mon Jun 08, 2015 12:09 pm

Re: Multihoming and connection tracking

Thu Jan 31, 2019 3:25 pm

My opinion is that you should not use connection-tracking firewall rules in a network like that.
 
User avatar
sri2007
Member Candidate
Member Candidate
Posts: 158
Joined: Wed May 20, 2015 10:14 pm
Location: Quito

Re: Multihoming and connection tracking

Thu Jan 31, 2019 10:56 pm

Hi I currently have that network running successfully without issues related to asymmetric traffic flow. And totally I recommend you to disable connection tracking it will totally improve your router behavior, just be careful if you're using NAT or any firewall rule related to tracking (like matching tcp state connections).
 
User avatar
mrz
MikroTik Support
MikroTik Support
Posts: 5813
Joined: Wed Feb 07, 2007 12:45 pm
Location: Latvia
Contact:

Re: Multihoming and connection tracking

Fri Feb 01, 2019 10:03 am

It is recommended not to use any connection tracking related feature. Also avoid setting complicated firewall for forwarded traffic.
 
AVA
just joined
Topic Author
Posts: 21
Joined: Mon Jun 18, 2018 6:19 pm

Re: Multihoming and connection tracking

Sun Feb 03, 2019 10:44 pm

Ok thank you all for your tips. I need a few tracking features to protect the litte ip subnet that we use for our own servers etc. So would it be enough (especially concerning CPU load) to set firewall raw rules which disable tracking for the customers ip space?
 
p3rad0x
Long time Member
Long time Member
Posts: 603
Joined: Fri Sep 18, 2015 5:42 pm
Location: South Africa
Contact:

Re: Multihoming and connection tracking

Mon Feb 11, 2019 3:49 pm

It should work yes.

But I will add a third router for just the internal servers and NAT on it so the edge routers only does routing.
There you go then you touched something ;-) : it only takes a change in wind direction to screw with your nat :-)

Who is online

Users browsing this forum: No registered users and 2 guests