Community discussions

 
sniper88
just joined
Topic Author
Posts: 10
Joined: Fri Apr 13, 2018 5:17 pm

How use routing mark with 2 wan

Tue May 14, 2019 11:43 am

Hello,
I'm working today on a script that manage with some rules the decision to manage the target routing between two wan for failover purpose.
My problem is how to force the routing from the mikrotik to a specified IP to the first wan, and to another IP to the second wan.
I explain the case better:
I have a script where I try to ping two test IP, I want that when the mikrotik ping for example the 1.1.1.1 packets go through the GW of the Wan1 and when the mikrotik ping 1.0.0.1 packets go through the hw of the wan2.
The first wan is a router connecter to eth1, the second wan is a pppoe 3g usb.
I have two default route created in auto from a dhcp-client for ether1 (0.0.0.0/0 with priority 1) and a second one (always 0.0.0.0/0 with priority 2) created in auto from pppoe connection.

How can I do to force the routing to this two gw?

I read about use the routing mark but I don't find a good example for me, and I have the case that the two wan shoutd be also offline in some case (so in winbox the config line is blu and not black).

Thanks.
 
pe1chl
Forum Guru
Forum Guru
Posts: 5351
Joined: Mon Jun 08, 2015 12:09 pm

Re: How use routing mark with 2 wan

Tue May 14, 2019 2:43 pm

Search a bit more thoroughly, there are many fine examples to do what you want.
(there are different ways to approach it, also depending on whether you have incoming portforwarded connections as well)
 
sindy
Forum Guru
Forum Guru
Posts: 3459
Joined: Mon Dec 04, 2017 9:19 pm

Re: How use routing mark with 2 wan

Tue May 14, 2019 3:10 pm

I don't believe in copy-pasting examples, understanding what you are doing and why is much better.

The role of routing-mark is to choose a routing table. A routing table consists of all routes bearing the same routing-mark. An exception is the default routing table, named "main", where no routing-mark at all is equivalent to routing-mark=main.

So you have to define your routing tables depending on whether a given type of traffic has to prefer a given WAN, or use that WAN exclusively.

So let's say you have all 4 cases represented by routing mark names, so you will need 4 routing tables in addition to the main one created dynamically by DHCP client and LTE.

These two items if /ip route configuration branch are generated dynamically:
dst-address=0.0.0.0/0 gateway=wan1.gw.ip distance=1
dst-address=0.0.0.0/0 gateway=wan2.gw.ip distance=2


These you have to add manually:
dst-address=0.0.0.0/0 routing-mark=prefer-wan1 gateway=wan1.gw.ip distance=1
(if WAN 1 is down, no other route with routing-mark=prefer-wan1 is active, so routing reverts to the default routing table where route via gateway=wan1.gw.ip is also inactive so it will use the other one)

dst-address=0.0.0.0/0 routing-mark=prefer-wan2 gateway=wan2.gw.ip distance=1
(same case like above)

dst-address=0.0.0.0/0 routing-mark=use-only-wan1 gateway=wan1.gw.ip distance=1
dst-address=0.0.0.0/0 routing-mark=use-only-wan1 type=blackhole distance=2

dst-address=0.0.0.0/0 routing-mark=use-only-wan2 gateway=wan2.gw.ip distance=1
dst-address=0.0.0.0/0 routing-mark=use-only-wan2 type=blackhole distance=2

(here, the type=blackhole routes prevent packets marked with routing-mark=use-only-wanX from being routed using the default routing table if the route via the proper WAN is down).

There is more to it, you have to prevent traffic towards connected subnets (Mikrotik's LANs) from getting a routing-mark or "neutralize" the routing mark, look for details here.
Instead of writing novels, post /export hide-sensitive. Use find&replace in your favourite text editor to systematically replace all occurrences of each public IP address potentially identifying you by a distinctive pattern such as my.public.ip.1.
 
sniper88
just joined
Topic Author
Posts: 10
Joined: Fri Apr 13, 2018 5:17 pm

Re: How use routing mark with 2 wan

Wed May 15, 2019 12:28 pm

Thanks Sindy,
I'm trying to do what you have explain but I need some help because I don't understand all.
My mangle rules are:
/ip firewall mangle add action=mark-routing chain=output dst-address=1.1.1.1 new-routing-mark=toWanEth passthrough=no
/ip firewall mangle add action=mark-routing chain=output dst-address=1.0.0.1 new-routing-mark=toWanUsb passthrough=no

Mu route settings are:
2 autocreated route:
0.0.0.0/0 with gw 10.12.89.1 distance 1
0.0.0.0/0 with gw ppp-out1 distance 2
/ip route add dst-address=0.0.0.0/0 distance=1 gateway=10.12.89.1 routing-mark=toWanEth
/ip route add dst-address=0.0.0.0/0 distance=2 routing-mark=toWanEth type=blackhole
/ip route add dst-address=0.0.0.0/0 distance=2 gateway=ppp-out1 routing-mark=toWanUsb
/ip route add dst-address=0.0.0.0/0 distance=3 routing-mark=toWanUsb type=blackhole

If I ping the 1.1.1.1 it responds ok, but if I ping 1.0.0.1 it reply timeout
Where am I doing wrong?
 
sindy
Forum Guru
Forum Guru
Posts: 3459
Joined: Mon Dec 04, 2017 9:19 pm

Re: How use routing mark with 2 wan

Wed May 15, 2019 12:40 pm

Where am I doing wrong?
I cannot see anything to be wrong, except that you start from distance=2 in routing table toWanUsb, which is not actually wrong but indicates that you haven't realized that the distance values are only meaningful in their local context (same length of dst-address mask and the same routing-mark).

So first, are you pinging from the Mikrotik itself or from a device in LAN? Second, if you disable both the mangle rules and disable the Ethernet WAN, can you ping the 1.0.0.1?

Instead of writing novels, post /export hide-sensitive. Use find&replace in your favourite text editor to systematically replace all occurrences of each public IP address potentially identifying you by a distinctive pattern such as my.public.ip.1.
 
sniper88
just joined
Topic Author
Posts: 10
Joined: Fri Apr 13, 2018 5:17 pm

Re: How use routing mark with 2 wan

Wed May 15, 2019 3:18 pm

I have used the distance 2 for ppp-out1 because in my first config of the Mikrotik that was more simple (without the logic to use the failover on usb 3g) the two wan are all in dhcp with automatic creation of gateway, so to make work with priority of the ethernet wan I had to put distance 2 to the ppp-out1 gw.
Now I implemented a logic for the failover that check the two line and manage the switch of internet only if I have more than 20 ping loss to a gateway, and also if the second wan is connected for 20 ping.
That is why I need to have two ip (1.1.1.1 and 1.0.0.1) to ping for each wan interface. With the ping answer I decide where swith the intertet for clients.
Behind the wan, I have 3 lan all routed in a tunnel ipsec, so the outgoing public IP for client is the IP of the main building internet where is terminated the tunnel ipsec.
The check for gateways (1.1.1.1 and 1.0.0.0) is made from the mikrotik that can surf internet without go to the tunnel.

Sorry for the long explain, but I think that it was great to know.

I tried what you asked me.
The ping to 1.0.0.1 works fine if I detach the wan cable in ether1. It works also with mangle active....
 
sindy
Forum Guru
Forum Guru
Posts: 3459
Joined: Mon Dec 04, 2017 9:19 pm

Re: How use routing mark with 2 wan

Wed May 15, 2019 3:29 pm

The ping to 1.0.0.1 works fine if I detach the wan cable in ether1. It works also with mangle active....
So to recap, when ppp-out1 is active:
  • when WAN1 is active and mangle rules are active too, you can ping 1.1.1.1 but not 1.0.0.1?
  • when WAN1 is active and mangle rules are not, you can ping both 1.1.1.1 and 1.0.0.1?
  • when WAN1 is not active, you can ping 1.0.0.1 regardless whether mangle rules are active or not?
And I repeat the question you haven't answered, when testing the above, do you ping from the Mikrotik itself or from some device on its LAN?
Instead of writing novels, post /export hide-sensitive. Use find&replace in your favourite text editor to systematically replace all occurrences of each public IP address potentially identifying you by a distinctive pattern such as my.public.ip.1.
 
sniper88
just joined
Topic Author
Posts: 10
Joined: Fri Apr 13, 2018 5:17 pm

Re: How use routing mark with 2 wan

Wed May 15, 2019 4:08 pm

1) when WAN1 is active and mangle rules are active too, you can ping 1.1.1.1 but not 1.0.0.1?
--> yes, I can ping only 1.1.1.1, the 1.0.0.1 answer timeout
2) when WAN1 is active and mangle rules are not, you can ping both 1.1.1.1 and 1.0.0.1?
--> yes, in this case I can ping both
3) when WAN1 is not active, you can ping 1.0.0.1 regardless whether mangle rules are active or not?
--> with mangle disable I can ping both
--> with mangle active when I ping 1.1.1.1 it says packet rejected, if I ping 1.0.0.1 it works

I ping the target from Mikrotik.
I don't ping from lan because If I should ping these IP from lan the traffic should go in the tunnel ipsec and it works normaly.
 
sindy
Forum Guru
Forum Guru
Posts: 3459
Joined: Mon Dec 04, 2017 9:19 pm

Re: How use routing mark with 2 wan  [SOLVED]

Wed May 15, 2019 4:47 pm

1) when WAN1 is active and mangle rules are active too, you can ping 1.1.1.1 but not 1.0.0.1?
--> yes, I can ping only 1.1.1.1, the 1.0.0.1 answer timeout
here, ping to 1.1.1.1 is marked and goes via WAN1, and ping to 1.0.0.1 must be marked with toWanUsb, otherwise it could use the route via WAN1 in the default routing table, either due to getting no routing-mark at all and thus using the default table directly, or due to getting a misspelled routing mark and thus using the default table as a fallback as no marked route for the misspelled routing mark would exist. So the routing mark matches at least the one of the blackhole route.

2) when WAN1 is active and mangle rules are not, you can ping both 1.1.1.1 and 1.0.0.1?
--> yes, in this case I can ping both
because both pings take the default routing table (no routing-mark assigned), so both go via WAN1

3) when WAN1 is not active, you can ping 1.0.0.1 regardless whether mangle rules are active or not?
--> with mangle disable I can ping both
so the route via WAN2 (ppp-out1) works, as it can be used when the default routing table sends the packets there

--> with mangle active when I ping 1.1.1.1 it says packet rejected, if I ping 1.0.0.1 it works
So the routing-mark must be correctly assigned for both 1.1.1.1 and 1.0.0.1, otherwise the ping to 1.0.0.1 would not be responded also in this case.


So there must be something else which causes that. With packets generated by Mikrotik itself, there is the so-called "routing adjustment" phase, allowing policy routing to work also for locally originated packets. So the route for a locally originated packet is first determined using the default routing table, and then the mangle rules in chain=output eventually assign the routing-mark - and if they do, the route is chosen again. There is, however, a trap - for locally originated packets, the source address is chosen based on the route, but only during the first routing stage. So if the mangle rules assign a routing-mark and thus the route is chosen again, the source address of the packet remains unchanged, unless you forcifully change it using a src-nat or masquerade rule. And ISP's ppp links often drop packets with a different source address than the one assigned to the customer's end of the link. Some ISPs even drop the whole link and it has to be re-established.

So a rule
action=masquerade chain=srcnat out-interface=ppp-out1 src-address-type=local
as the topmost one in chain=srcnat in /ip firewall nat should fix this.
Instead of writing novels, post /export hide-sensitive. Use find&replace in your favourite text editor to systematically replace all occurrences of each public IP address potentially identifying you by a distinctive pattern such as my.public.ip.1.
 
sniper88
just joined
Topic Author
Posts: 10
Joined: Fri Apr 13, 2018 5:17 pm

Re: How use routing mark with 2 wan

Mon May 20, 2019 5:26 pm

Thanks Sindy,
Sorry for my delay but I had several problems in these days and I tried your solution only today.

I want inform you that you are a big man!!!!
The last masquerate rule for the pppout solve the problem!!

Is not easy the routing system decision..
Do you have a good help to study how the mikrotik works or a good manual to tell me?

Thanks so mauch.

Who is online

Users browsing this forum: No registered users and 59 guests