Community discussions

MikroTik App
 
ragis
just joined
Topic Author
Posts: 1
Joined: Sun Jun 25, 2017 6:37 pm

VPN over Balancing PCC

Mon Jun 26, 2017 5:54 am

It can be useful...

Equipment and configuration:

RB: 951G-2HnD
RouterOs: 6.39.2
Ether1=WAN1: Dynamic IP, 10Mbps
Ether2=WAN2: Dynamic IP, 6Mbps
Ether3=LAN: Local network
Ether4=Off
Ether5=Off

/ip firewall mangle
add action=mark-connection chain=prerouting comment=VPN TRAFFIC in-interface=all-ppp new-connection-mark=mc_vpn passthrough=yes
add action=mark-routing chain=prerouting connection-mark=mc_vpn new-routing-mark=mr_vpn passthrough=no

/ip route
add check-gateway=ping distance=1 gateway=WAN1 routing-mark="to_WAN1, mr_vpn"
add check-gateway=ping distance=1 gateway=WAN2 routing-mark="to_WAN2"

/ip firewall nat
add action=masquerade chain=srcnat out-interface=LAN
 
shamet
just joined
Posts: 22
Joined: Wed Jun 27, 2018 1:16 am
Location: PL

Re: VPN over Balancing PCC

Wed Oct 02, 2019 9:28 pm

I think it makes sense only if your WAN connection is not PPPoE.
Please correct me if I'm wrong.
 
Zacharias
Forum Guru
Forum Guru
Posts: 3459
Joined: Tue Dec 12, 2017 12:58 am
Location: Greece

Re: VPN over Balancing PCC

Wed Oct 02, 2019 9:54 pm

Ragis here just marks the connection comming from the VPN side and makes sure it will always be routed through his first WAN...
Otherwise it could use WAN two as well and then there would be a problem communicating with the other side of the VPN...
There are other ways to do that as well...
 
shamet
just joined
Posts: 22
Joined: Wed Jun 27, 2018 1:16 am
Location: PL

Re: VPN over Balancing PCC

Thu Oct 03, 2019 12:51 am

Yes,
I understand marking rule. But marking incomming
in-interface=all-ppp
when one of my WANs is PPPoE marks all comming from this WAN as comming from VPN. At least that's what I have observed when I was trying to implement his solution.
I'm strugling with problems with accessing all devices (I can ping some, can't others etc.) on the remote side when using VPN connection (L2TP) and I thought to give it a try.
One of my WANs is PPPoE and I think it's not going to work this way.
 
Zacharias
Forum Guru
Forum Guru
Posts: 3459
Joined: Tue Dec 12, 2017 12:58 am
Location: Greece

Re: VPN over Balancing PCC

Thu Oct 03, 2019 12:58 am

In your case in interface should be only your VPN and not all ppp that includes your pppoe client as well...

Ragis should have been more specific on that and not select all ppp.. But since he got no pppoe client his configuration works.
 
shamet
just joined
Posts: 22
Joined: Wed Jun 27, 2018 1:16 am
Location: PL

Re: VPN over Balancing PCC

Thu Oct 03, 2019 1:24 am

Yes, the thing is that I cannot select VPN interface because it is some kind of dynamic interface and when there is no connection established I can't see any VPN interface in the list to pick.
 
Zacharias
Forum Guru
Forum Guru
Posts: 3459
Joined: Tue Dec 12, 2017 12:58 am
Location: Greece

Re: VPN over Balancing PCC

Thu Oct 03, 2019 1:30 am

Make it static then...
 
shamet
just joined
Posts: 22
Joined: Wed Jun 27, 2018 1:16 am
Location: PL

Re: VPN over Balancing PCC

Thu Oct 03, 2019 1:44 am

True, sounds reasonable and simple :D.
I'll try to search for solution for that.

Edit:
Thanks for hint. I've added static l2tp-in interface but it somehow doesn't seem to work for me.
When I remove
, mr_vpn
part from my routing mark it works but with this part included, not.
I receive:
ipsec,error phase1 negotiation failed due to time up...
and I can't connect.
It works however on WAN2 connection, but I think it's not a big surprise.
 
shamet
just joined
Posts: 22
Joined: Wed Jun 27, 2018 1:16 am
Location: PL

Re: VPN over Balancing PCC

Thu Oct 03, 2019 10:18 pm

I think it's not going to work even with static l2tp-in in my case.
This kind of interface is inactive until connection is established so this mangle rule is not going to work.
 
Zacharias
Forum Guru
Forum Guru
Posts: 3459
Joined: Tue Dec 12, 2017 12:58 am
Location: Greece

Re: VPN over Balancing PCC

Thu Oct 03, 2019 10:37 pm

This kind of interface is inactive until connection is established so this mangle rule is not going to work.
If there is no connection why should it work? :shock:
And how?
You made it static so you can use it in your rules... even when its down...
 
shamet
just joined
Posts: 22
Joined: Wed Jun 27, 2018 1:16 am
Location: PL

Re: VPN over Balancing PCC

Thu Oct 03, 2019 10:58 pm

And how?
I wish I would know it.
I have l2tp-in interface configured but mangle rule calling it in is marked in red colour until connection is established.
When I export I receive:
# l2tp-in1 not ready
add action=mark-connection chain=prerouting comment="VPN TRAFFIC" in-interface=\
    l2tp-in1 new-connection-mark=mc_vpn passthrough=yes
When I have it like this and I leave routing mark like it was it's not a problem. Connection goes on, rule becomes active and everyting seems to be ok.
When I add
, mr_vpn
to my Routing Mark it can't make vpn connection on this particular WAN interface.
 
Zacharias
Forum Guru
Forum Guru
Posts: 3459
Joined: Tue Dec 12, 2017 12:58 am
Location: Greece

Re: VPN over Balancing PCC

Thu Oct 03, 2019 11:48 pm

Can you disable all your wan interfaces except the one you want to use with your l2tp?
If yes then it works? Even if you have mr_vpn in your routing table?
 
shamet
just joined
Posts: 22
Joined: Wed Jun 27, 2018 1:16 am
Location: PL

Re: VPN over Balancing PCC

Fri Oct 04, 2019 1:58 am

Can you disable all your wan interfaces except the one you want to use with your l2tp?
If yes then it works? Even if you have mr_vpn in your routing table?

Yes, I did it with shaking hands because I was afraid loosing connection with remote location, but I did it with scheduled simple disable and enable interface rules so I could get back on track in case of failure.
Anyway, it works. When, let say WAN1 interface is disabled it works perfectly on WAN2.
It even solves my primary problem. Now I can ping all the remote devices when connected with vpn. Before I wasn’t able to ping some of them and it didn't work in totally random way.
This means the direction is good but in my case different solution is needed.
 
Zacharias
Forum Guru
Forum Guru
Posts: 3459
Joined: Tue Dec 12, 2017 12:58 am
Location: Greece

Re: VPN over Balancing PCC

Fri Oct 04, 2019 2:08 am

Ok.. The reason why you had problem connecting when both your WAN where up and mr_vpn was in your routing table is because obviously your L2TP connection was initiated from wan1 but with your mangle rule you were telling the incoming traffic from the vpn to be routed then back from wan2..

You can change the priority of your wan interfaces or you can using mangles again to tell from which wan to initiate the l2tp connection...
 
shamet
just joined
Posts: 22
Joined: Wed Jun 27, 2018 1:16 am
Location: PL

Re: VPN over Balancing PCC

Fri Oct 04, 2019 2:32 am

... because obviously your L2TP connection was initiated from wan1
Well, it does not seem likely. I was trying to connect with vpn using my WAN2 IP address.
I have two connections configured with WAN1 and WAN2 IPs.
What do you mean by:
You can change the priority of your wan interfaces...
?
Do you mean to change distance in route? I have both of them set to 1, so it is not the case, I think.
 
Isla4419
just joined
Posts: 1
Joined: Fri Oct 04, 2019 9:42 am

Re: VPN over Balancing PCC

Fri Oct 04, 2019 9:46 am

 
Zacharias
Forum Guru
Forum Guru
Posts: 3459
Joined: Tue Dec 12, 2017 12:58 am
Location: Greece

Re: VPN over Balancing PCC

Fri Oct 04, 2019 1:03 pm

My advice is to study carefully the mangles PCC example... https://wiki.mikrotik.com/wiki/Manual:PCC
 
shamet
just joined
Posts: 22
Joined: Wed Jun 27, 2018 1:16 am
Location: PL

Re: VPN over Balancing PCC

Fri Oct 04, 2019 1:51 pm

My advice is to study carefully the mangles PCC example... https://wiki.mikrotik.com/wiki/Manual:PCC
That was my starting point and this is exactly how I have it set up right now, for quite a time already. It seems to work good, but not with VPN, hence the whole story.
 
Zacharias
Forum Guru
Forum Guru
Posts: 3459
Joined: Tue Dec 12, 2017 12:58 am
Location: Greece

Re: VPN over Balancing PCC

Fri Oct 04, 2019 3:36 pm

There is certainly a mistake in your configuration... if you want you can export the whole router's configuration with hide sensitive and post is here...
 
Sob
Forum Guru
Forum Guru
Posts: 9119
Joined: Mon Apr 20, 2009 9:11 pm

Re: VPN over Balancing PCC

Fri Oct 04, 2019 3:44 pm

Quick note, routing-mark="to_WAN1, mr_vpn" means one routing mark named "to_WAN1, mr_vpn", NOT two routing marks "to_WAN1" and "mr_vpn".
 
shamet
just joined
Posts: 22
Joined: Wed Jun 27, 2018 1:16 am
Location: PL

Re: VPN over Balancing PCC

Fri Oct 04, 2019 3:46 pm

There is certainly a mistake in your configuration... if you want you can export the whole router's configuration with hide sensitive and post is here...
As for now, I have asked my ISP to change config of my connection to static IP instead of PPPoE.
If they agree i will check if first post's tricks work for me.
I know this is not a solution (rather workaround) but I think it will show me where problem lays.
 
shamet
just joined
Posts: 22
Joined: Wed Jun 27, 2018 1:16 am
Location: PL

Re: VPN over Balancing PCC

Fri Oct 04, 2019 3:54 pm

Quick note, routing-mark="to_WAN1, mr_vpn" means one routing mark named "to_WAN1, mr_vpn", NOT two routing marks "to_WAN1" and "mr_vpn".
Yes, I'm aware of that. And I understand it as "route it to vpn interface (from which connection comes) and further to gateway of WAN1". Am I correct?
 
Sob
Forum Guru
Forum Guru
Posts: 9119
Joined: Mon Apr 20, 2009 9:11 pm

Re: VPN over Balancing PCC

Fri Oct 04, 2019 7:52 pm

No, it's just a name, it doesn't have any special meaning. I don't see much of your config, but original post contains three distinct routing marks:

mr_vpn
to_WAN1, mr_vpn
to_WAN2

Mangle rule sets the first one, but there's no routing table for it.
 
shamet
just joined
Posts: 22
Joined: Wed Jun 27, 2018 1:16 am
Location: PL

Re: VPN over Balancing PCC

Fri Oct 04, 2019 8:31 pm

Mangle rule sets the first one, but there's no routing table for it.
So, I think I have misunderstood the thing completely. I thought
to_WAN1, mr_vpn
in routing table somehow joins those two into one route.
My config is pretty much according to https://wiki.mikrotik.com/wiki/Manual:PCC, but with one static and another one pppoe WAN interfaces.
I will review once more all my mangle rules during weekend and see if I can find something wrong there.
Anyway, as I said before, PCC works good. The only problem I'm getting when VPN connected.
I will also see thread recommended by Isla4419 to find some inspiration there maybe.

Edit:

What solved my problem is:
/ip firewall nat
add action=masquerade chain=srcnat comment="TEST VPN PING REMOTE"
just below rules from PCC manual:
/ ip firewall nat
add chain=srcnat out-interface=ISP1 action=masquerade
add chain=srcnat out-interface=ISP2 action=masquerade
Rules from the beginning of this thread appeared to be unnecessary in my case.
In the meantime I've removed, re entered and compared with old ones, all my routes, mangle rules etc and all of them were correct, after all.
Maybe rebooting router, in the meantime, had also some influence?
Last edited by shamet on Wed Oct 09, 2019 4:35 am, edited 1 time in total.
 
Sob
Forum Guru
Forum Guru
Posts: 9119
Joined: Mon Apr 20, 2009 9:11 pm

Re: VPN over Balancing PCC

Thu Oct 10, 2019 5:00 am

It's not right. The masquerade rule you posted doesn't have any condition, it means it will apply to every connection going through router. So for example, if you'd have some forwarded ports to internal server, you wouldn't be able to see real addresses of clients.
 
shamet
just joined
Posts: 22
Joined: Wed Jun 27, 2018 1:16 am
Location: PL

Re: VPN over Balancing PCC

Thu Oct 10, 2019 5:34 am

Damn, I thought I finally have solution! Found it somewhere.
Thing is that after making this rule it really works. When I disable it, I don't receive ping replies from some of the remote (L2TP/Ipscec over PCC) hosts.
Unfortunately, you are completely right!
I logged into server with this rule on and off and I can clearly see the difference.
This rule on = logged from router's local IP, rule off = logged in from my remote address.
Thanks for pointing it out.
I think I have to do it all, once again....
 
Sob
Forum Guru
Forum Guru
Posts: 9119
Joined: Mon Apr 20, 2009 9:11 pm

Re: VPN over Balancing PCC

Thu Oct 10, 2019 5:48 am

Hint: Just be careful about how you mark your connections and be sure you don't change some existing marks that should stay unchanged.

Or, if you want to miss all the fun you can have while finding the solution yourself, you can post your exported config and maybe someone will tell you what's wrong.
 
shamet
just joined
Posts: 22
Joined: Wed Jun 27, 2018 1:16 am
Location: PL

Re: VPN over Balancing PCC

Thu Oct 10, 2019 8:06 pm

Thanks for hint.
I'm actually planning to remove everything and start from scratch again. Once again.
And in matter of "missing all the fun". I don't want to be too easy ;)
Posting complete config and counting that someone will spend time on finding errors in mess I have probably made is, I think last option.
 
Sob
Forum Guru
Forum Guru
Posts: 9119
Joined: Mon Apr 20, 2009 9:11 pm

Re: VPN over Balancing PCC

Thu Oct 10, 2019 8:37 pm

I like your approach. Some trial & error, exploring dead ends, things like that, it's great way how to learn something.
 
shamet
just joined
Posts: 22
Joined: Wed Jun 27, 2018 1:16 am
Location: PL

Re: VPN over Balancing PCC

Mon Oct 14, 2019 3:00 am

I like your approach.
Thanks.
... trial & error, exploring dead ends, things like that..
I think it all depends on if you have enough satisfaction from having flawlessly running system or from making it by yourself it to run like that ;)
I'm personally more into second option.
But to the point:
I'm really ashamed I didn't figure it out way sooner but solution to my problem was, apart from ones in manual, one more mangle rule:
/ip firewall mangle
add action=accept chain=prerouting comment="PCC - Policy routing VPN" dst-address=10.11.12.0/24 in-interface=LAN
where 10.11.12.0/24 is my l2tp_pool network address.
Simple as that, I'd say.
Thanks a lot for pointing me into the right direction.
 
Sob
Forum Guru
Forum Guru
Posts: 9119
Joined: Mon Apr 20, 2009 9:11 pm

Re: VPN over Balancing PCC

Mon Oct 14, 2019 4:41 am

The goal is to have all, flawlessly running system, knowing why it does that (it's very helpful), and good feeling from doing it yourself. It could take a while, but it's possible. :)

Another way to do it is:
/ip route rule
add action=lookup-only-in-table dst-address=10.11.12.0/24 table=main
You basically tell the router to ignore routing marks for some destination, and it will only use main routing table for them.
 
shamet
just joined
Posts: 22
Joined: Wed Jun 27, 2018 1:16 am
Location: PL

Re: VPN over Balancing PCC

Mon Oct 14, 2019 5:14 am

... goal is to have all, flawlessly running system, knowing why it does that (it's very helpful), and good feeling from doing it yourself...
I coulnd't agree more.
/ip route rule
add action=lookup-only-in-table dst-address=10.11.12.0/24 table=main
You basically tell the router to ignore routing marks for some destination, and it will only use main routing table for them.
Let me dig more into this to have better understanding of things. As for now, I don't get much of it, unfortunately. I'm just occupied being happy with having flawlessly running system :)
 
Zacharias
Forum Guru
Forum Guru
Posts: 3459
Joined: Tue Dec 12, 2017 12:58 am
Location: Greece

Re: VPN over Balancing PCC

Mon Oct 14, 2019 6:32 pm

You can just use an accept rule if you want the main routing table to be used...
 
shamet
just joined
Posts: 22
Joined: Wed Jun 27, 2018 1:16 am
Location: PL

Re: VPN over Balancing PCC

Wed Oct 16, 2019 2:54 am

You can just use an accept rule if you want the main routing table to be used...

You mean the one that I'm currently using:
/ip firewall mangle
add action=accept chain=prerouting comment="PCC - Policy routing VPN" dst-address=10.11.12.0/24 in-interface=LAN
right?
 
Zacharias
Forum Guru
Forum Guru
Posts: 3459
Joined: Tue Dec 12, 2017 12:58 am
Location: Greece

Re: VPN over Balancing PCC

Wed Oct 16, 2019 8:37 am

Yes..

Who is online

Users browsing this forum: Ahrefs [Bot], CGGXANNX, elbob2002, godel0914, K0NCTANT1N, qatar2022 and 77 guests