Community discussions

MikroTik App
 
zhsyourai
just joined
Topic Author
Posts: 5
Joined: Sun Jun 17, 2018 11:02 am

Router Problem about router mark

Sun Jun 17, 2018 11:18 am

Image

First of all, my mother tongue is not English. If I do not explain it clearly, I will explain it again.

My problem:
When My Device gateway is 10.10.10.1 the ROS can forward package to 10.10.10.2 but when 10.10.10.2 forward this package to 10.10.10.1 the src-nat not work(I log the package where last print the log in postrouting stage).

BUT, When My Device gateway is 10.10.10.2, It is work well. And My
Production Environment can't modify gateway to 10.10.10.2.

What setting I need.
 
sindy
Forum Guru
Forum Guru
Posts: 10205
Joined: Mon Dec 04, 2017 9:19 pm

Re: Router Problem about router mark

Sun Jun 17, 2018 2:09 pm

I am afraid I don't get what the actual problem is.

Does the "other gateway" device represent a gateway to some other network, i.e. you need some packets from the "My device" box to go to the internet via the Mikrotik and other packets to go to that other network via the "other gateway", and your problem is that you can only set a single (default) route on the "My device"?

Or is it so that you need to send packets only to the internet but the Mikrotik doesn't route them to internet if it gets them directly from "My device", but does route them properly if the "My device" sends them to 10.10.10.2 and the "Other Gateway" forwards them to Mikrotik?

What is your native language?
 
User avatar
anav
Forum Guru
Forum Guru
Posts: 19107
Joined: Sun Feb 18, 2018 11:28 pm
Location: Nova Scotia, Canada
Contact:

Re: Router Problem about router mark

Sun Jun 17, 2018 3:32 pm

Confusing.
1. IS ROS the main router with one WAN connection?
2. Is other gateway another router? or a switch?
3. If it is a router (lets call it router2) it looks like you want it to be a router with WANIP from ROS (double nat type scenario).

4. You want to be able to route traffic from LAN behind router2 to LAN behind ROS and also the opposite, route traffic from LAN behind ROS to LAN router2???
 
zhsyourai
just joined
Topic Author
Posts: 5
Joined: Sun Jun 17, 2018 11:02 am

Re: Router Problem about router mark

Sun Jun 17, 2018 4:34 pm

I am afraid I don't get what the actual problem is.

Does the "other gateway" device represent a gateway to some other network, i.e. you need some packets from the "My device" box to go to the internet via the Mikrotik and other packets to go to that other network via the "other gateway", and your problem is that you can only set a single (default) route on the "My device"?

Or is it so that you need to send packets only to the internet but the Mikrotik doesn't route them to internet if it gets them directly from "My device", but does route them properly if the "My device" sends them to 10.10.10.2 and the "Other Gateway" forwards them to Mikrotik?

What is your native language?
Thanks.

My native language is chinese.

The other gateway is OpenWrt. Only Mikrotik can access internet. The openwrt is also via Mikrotik to access to internet. The Openwrt run a proxy and config some iptables rule to help me access China can't access ip like(Google, Twitter etc...).
 
zhsyourai
just joined
Topic Author
Posts: 5
Joined: Sun Jun 17, 2018 11:02 am

Re: Router Problem about router mark

Sun Jun 17, 2018 4:41 pm

Confusing.
1. IS ROS the main router with one WAN connection?
2. Is other gateway another router? or a switch?
3. If it is a router (lets call it router2) it looks like you want it to be a router with WANIP from ROS (double nat type scenario).

4. You want to be able to route traffic from LAN behind router2 to LAN behind ROS and also the opposite, route traffic from LAN behind ROS to LAN router2???
1. Yes, Only ROS can access internat.
2. It is OpenWrt.
3. Not double nat, Router2 just decided which ip need to proxy. and router2's default gateway is ROS.
4.I want route traffic from LAN behind ROS => router2 => ROS => Internat. And the router2 not have lan,It just Transparent Proxy .
 
sindy
Forum Guru
Forum Guru
Posts: 10205
Joined: Mon Dec 04, 2017 9:19 pm

Re: Router Problem about router mark

Sun Jun 17, 2018 5:27 pm

So the ultimate goal is that the "My device" would send packets towards internet to the OpenWRT, which will do some magic and send them out via the Mikrotik. I suppose that the magic includes encapsulation into some tunnelling protocol so from the point of view of the Mikrotik, these encapsulated packets have a source address of the OpenWRT (10.10.10.2), not the one of the "My device".

If the above is true, then with your existing setup,
/ip route
add dst-address=0.0.0.0/0 gateway=10.10.10.2 routing-mark=forward
add dst-address=0.0.0.0/0 gateway=pppoe-out1
you need to assign the routing-mark "forward" to all packets from 10.10.10.0/24 other than from 10.10.10.2. One way is to use /ip firewall mangle to assign this routing-mark:
/ip firewall mangle
add action=mark-routing chain=forward in-interface=your-lan-interface-name src-address=!10.10.10.2 new-routing-mark=forward
To make it work, you need to disable the action=fasttrack-connection rule in Mikrotik's firewall.

Another way is to swap the default routes between the "default" and "marked" routing table instead of a firewall mangle rule, use a routing rule which doesn't interfere with fasttracking but doesn't accept negative conditions:
/ip route
add dst-address=0.0.0.0/0 gateway=10.10.10.2
add dst-address=0.0.0.0/0 gateway=pppoe-out1 routing-mark=from-owrt
/ip route rule
add action=lookup-only-in-table src-address=10.10.10.2/32 table=from-owrt
In either case, Mikrotik will send icmp redirect to My-device for each packet because the IP address of the gateway which Mikrotik uses to forward the packet is in the same subnet like the source. IP stacks of some devices follow the redirect and send subsequent packets to the same destination address directly to the 10.10.10.2, other devices ignore the redirect and continue sending to the Mikrotik.

I accept as given that you cannot change the default gateway address on the "My device", but I don't get why you need to do it this complex way instead of just setting Mikrotik's address to 10.10.10.2 and OpenWRT's address to 10.10.10.1?
 
zhsyourai
just joined
Topic Author
Posts: 5
Joined: Sun Jun 17, 2018 11:02 am

Re: Router Problem about router mark

Sun Jun 17, 2018 7:34 pm

So the ultimate goal is that the "My device" would send packets towards internet to the OpenWRT, which will do some magic and send them out via the Mikrotik. I suppose that the magic includes encapsulation into some tunnelling protocol so from the point of view of the Mikrotik, these encapsulated packets have a source address of the OpenWRT (10.10.10.2), not the one of the "My device".

If the above is true, then with your existing setup,
/ip route
add dst-address=0.0.0.0/0 gateway=10.10.10.2 routing-mark=forward
add dst-address=0.0.0.0/0 gateway=pppoe-out1
you need to assign the routing-mark "forward" to all packets from 10.10.10.0/24 other than from 10.10.10.2. One way is to use /ip firewall mangle to assign this routing-mark:
/ip firewall mangle
add action=mark-routing chain=forward in-interface=your-lan-interface-name src-address=!10.10.10.2 new-routing-mark=forward
To make it work, you need to disable the action=fasttrack-connection rule in Mikrotik's firewall.

Another way is to swap the default routes between the "default" and "marked" routing table instead of a firewall mangle rule, use a routing rule which doesn't interfere with fasttracking but doesn't accept negative conditions:
/ip route
add dst-address=0.0.0.0/0 gateway=10.10.10.2
add dst-address=0.0.0.0/0 gateway=pppoe-out1 routing-mark=from-owrt
/ip route rule
add action=lookup-only-in-table src-address=10.10.10.2/32 table=from-owrt
In either case, Mikrotik will send icmp redirect to My-device for each packet because the IP address of the gateway which Mikrotik uses to forward the packet is in the same subnet like the source. IP stacks of some devices follow the redirect and send subsequent packets to the same destination address directly to the 10.10.10.2, other devices ignore the redirect and continue sending to the Mikrotik.

I accept as given that you cannot change the default gateway address on the "My device", but I don't get why you need to do it this complex way instead of just setting Mikrotik's address to 10.10.10.2 and OpenWRT's address to 10.10.10.1?
Very Very Thanks.
This rule
/ip firewall mangle
add action=mark-routing chain=forward in-interface=your-lan-interface-name src-address=!10.10.10.2 new-routing-mark=forward
I has been setup.

And I track package, I found this package can success router from device -> ROS -> Openwrt to ROS, but this package reach src-nat not work, ROS not do src-nat.
So I think may be this is a ROS bug.

I will try the ”Another way“.

Precisely, from the point of view of the Mikrotik, these encapsulated packets have a source mac address of the OpenWRT (xx:xx::xx....), not the one of the "My device".
Because In my network some device need to router another openwrt(10.10.10.3) look like
device1 -> ROS(10.10.10.1) -> openwrt1(10.10.10.2) -> ROS(10.10.10.1)
device2 -> ROS(10.10.10.1) -> openwrt1(10.10.10.2) -> ROS(10.10.10.1)
 
sindy
Forum Guru
Forum Guru
Posts: 10205
Joined: Mon Dec 04, 2017 9:19 pm

Re: Router Problem about router mark

Sun Jun 17, 2018 7:50 pm

If the packets retain the original source IP address after passing through the proxy on the OpenWRT (I would suppose this is the case only for packets which matched the rules for routing the "normal" way), the rules I've suggested will not work because the routing table choice only looks at the source IP address. So you would have to use the /ip firewall mangle rule to assign the routing-mark, matching src-mac-address instead of src-address.
 
zhsyourai
just joined
Topic Author
Posts: 5
Joined: Sun Jun 17, 2018 11:02 am

Re: Router Problem about router mark

Sun Jun 17, 2018 8:04 pm

If the packets retain the original source IP address after passing through the proxy on the OpenWRT (I would suppose this is the case only for packets which matched the rules for routing the "normal" way), the rules I've suggested will not work because the routing table choice only looks at the source IP address. So you would have to use the /ip firewall mangle rule to assign the routing-mark, matching src-mac-address instead of src-address.
Yes that right.

I want to confirm whether this is a bug or my configuration is wrong.

Who is online

Users browsing this forum: Babujnik, GoogleOther [Bot], infabo, jaclaz, roncsak and 106 guests