I have 2 WAN connections, namely ISP1 (184.108.40.206) and ISP2 (220.127.116.11), each on a different MT interface (ISP1 respectively ISP2). On the LAN side I have a few private subnets, 10.0.1.0/24 (interface LAN1) and 10.0.2.0/24 (LAN2). I also have dst-nat for both public IPs into the LANs.
My goal is to use the ISP1 as the default outgoing interface and use ISP2 only as backup. In the same time if flows come on either ISP1 or ISP2 interfaces I want to use the same interface for outgoing packets.
I've figured out these steps (please correct me if I'm wrong):
- 1. mark the incoming connections in order to be able to track on which interface they arrived and use the routing mark to select different lookup tables
- 2. mark the outgoing connections (originating from LAN) with the routing mark for default table that I want to use (in order to exit the default ISP1 interface)
- 3. add 2 route rules, one for each routing-mark to lookup in the desired tables
- 4. populate the routing tables corresponding to each routing mark
- 5. add the src and dst nat rules
/ip address add address=18.104.22.168/30 comment="ISP1, default" disabled=no interface=ISP1 network=22.214.171.124 add address=126.96.36.199/30 comment="ISP2, backup" disabled=no interface=ISP2 network=188.8.131.52 add address=10.0.1.1/24 comment="LAN1" disabled=no interface=LAN1 network=10.0.1.0 add address=10.0.2.1/24 comment="LAN2" disabled=no interface=LAN2 network=10.0.2.0 /ip firewall mangle add action=mark-connection chain=prerouting disabled=no in-interface=ISP1 new-connection-mark=ISP1 passthrough=no add action=mark-connection chain=prerouting disabled=no in-interface=ISP2 new-connection-mark=ISP2 passthrough=no add action=mark-routing chain=prerouting comment="LAN packets marked with 'ISP2' are stamped with routing mark 'to_ISP2'" \ connection-mark=ISP2 disabled=no src-address-list=lans new-routing-mark=to_ISP2 passthrough=no add action=mark-routing chain=prerouting comment="LAN packets marked with 'ISP1' are stamped with routing mark 'to_ISP1'" \ connection-mark=ISP1 disabled=no src-address-list=lans new-routing-mark=to_ISP1 passthrough=no add action=mark-routing chain=prerouting comment="LAN packets not previously marked are by default stamped with routing mark 'to_ISP1'" \ disabled=no new-routing-mark=to_ISP1 passthrough=no src-address-list=lans /ip firewall nat add action=masquerade chain=srcnat disabled=no dst-address-list=!lans src-address-list=lans /ip route add check-gateway=ping disabled=no distance=1 dst-address=0.0.0.0/0 gateway=184.108.40.206 routing-mark=to_ISP2 scope=30 target-scope=10 add check-gateway=ping disabled=no distance=10 dst-address=0.0.0.0/0 gateway=220.127.116.11 routing-mark=to_ISP2 scope=30 target-scope=10 add disabled=no distance=1 dst-address=10.0.1.0/24 gateway=LAN1 routing-mark=to_ISP2 scope=30 target-scope=10 add disabled=no distance=1 dst-address=10.0.2.0/24 gateway=LAN2 routing-mark=to_ISP2 scope=30 target-scope=10 add check-gateway=ping disabled=no distance=1 dst-address=0.0.0.0/0 gateway=18.104.22.168 routing-mark=to_ISP1 scope=30 target-scope=10 add check-gateway=ping disabled=no distance=10 dst-address=0.0.0.0/0 gateway=22.214.171.124 routing-mark=to_ISP1 scope=30 target-scope=10 add disabled=no distance=1 dst-address=10.0.1.0/24 gateway=LAN1 routing-mark=to_ISP1 scope=30 target-scope=10 add disabled=no distance=1 dst-address=10.0.2.0/24 gateway=LAN2 routing-mark=to_ISP1 scope=30 target-scope=10 /ip route rule add action=lookup disabled=no routing-mark=to_ISP1 table=to_ISP1 add action=lookup disabled=no routing-mark=to_ISP2 table=to_ISP2 /ip firewall address-list add list=lans address=10.0.1.0/24 add list=lans address=10.0.2.0/24Help is greatly appreciated, thanks!