Community discussions

MUM Europe 2020
 
flatbat
newbie
Topic Author
Posts: 48
Joined: Tue Apr 06, 2010 11:18 pm

Multihoming with srcnat

Sat Sep 21, 2019 1:15 pm

Is firewall Connection Tracking or NAT in any way linked to upstream interface in RouterOS?
I mean, we plan to multihome with ISP1 and ISP2 and announce the same /24 to both ISPs, and want to srcnat outbound traffic from a private network behind one of the public addresses in the /24.
Default gateway is via ISP1, which is the main uplink we use, but based on BGP I assume it may happen that a reply to an outbound session via ISP1 finds its way back via ISP2 instead.

I have seen the documentation about rp-filter and ensured it is left at 'no'.
Will this work, or is anything in the firewall expecting a fully symmetric routing that would break this?
 
pe1chl
Forum Guru
Forum Guru
Posts: 6129
Joined: Mon Jun 08, 2015 12:09 pm

Re: Multihoming with srcnat

Sat Sep 21, 2019 1:29 pm

You should use 2 routers for that, one to do the external BGP and runs without connection tracking and NAT, then another one behind that to do your NAT and other firewalling, maybe your PPPoE etc.
Combining that in a single router will cause issues, as you correctly point out.
 
flatbat
newbie
Topic Author
Posts: 48
Joined: Tue Apr 06, 2010 11:18 pm

Re: Multihoming with srcnat

Sat Sep 21, 2019 2:04 pm

Thanks, that would obviously be a clean solution, but what would be the exact reason for multihoming not working with a single router?

Is in fact firewall Connection Tracking or NAT in any way linked to upstream interface in RouterOS?
 
nithinkumar2000
just joined
Posts: 8
Joined: Wed Sep 11, 2019 7:42 am
Location: Coimbatore
Contact:

Re: Multihoming with srcnat

Sat Sep 21, 2019 6:59 pm

Is firewall Connection Tracking or NAT in any way linked to upstream interface in RouterOS?
I mean, we plan to multihome with ISP1 and ISP2 and announce the same /24 to both ISPs, and want to srcnat outbound traffic from a private network behind one of the public addresses in the /24.
Default gateway is via ISP1, which is the main uplink we use, but based on BGP I assume it may happen that a reply to an outbound session via ISP1 finds its way back via ISP2 instead.

I have seen the documentation about rp-filter and ensured it is left at 'no'.
Will this work, or is anything in the firewall expecting a fully symmetric routing that would break this?
Dear Flatbat,

While using Border Gateway Protocol (BGP) the inbound traffic to router will always prefer the nearest route.
But you can actually use route filters (AS Prepend) to increase the traffic to ISP1/ISP2 (As per your wish).

For more detailed information you can search the wiki.mikrotik.com.

Have a Great Day!!!

Who is online

Users browsing this forum: Bing [Bot], carlosfinezi, EricInIdahoFalls, mgi2003, vader7071 and 124 guests