Community discussions

MikroTik App
 
aydinl60
just joined
Topic Author
Posts: 5
Joined: Sun Oct 11, 2020 11:58 pm

Need help to Setup Dual Gateway

Mon Oct 12, 2020 11:26 am

Hi,
I`m really new to Mikrotik Environment, I need a help from you guys for following scenario
I have one adsl router(Main internet connection) with IP range of 192.168.1.0/24 connected to Ethernet 1 of my mikrotik router(Wan Port)I have another adsl router(VPN connection to connect to main branch) with IP range of 172.200.1.0/24 which is connected to ethernet 2 of my Mikrotik router. I have wifi enabled Mikrotik as Ap bridge with Ip range of 192.168.88.0/24(every one connect to this router with wifi and physical connection).
What I want to do is if people want to access internet, Mikrotik router route packets automatically to ethernet 1 interface(first adsl). If people want to go to certain destination like 221.35.12.x their packet has to routed to ethernet 2 which is second adsl to connect to main branch. The gateway for first adsl is 192.168.1.1 and for second one is 172.200.1.17
so far I managed to access the gateway of second adsl but when I ping the actual destination address of 221.35.12.x it shows unreachable and when I tracert that address, it shows the packet goes to 192.168.88.1 and from there drops. is there anyone can help for above scenario with complete solution?
Thanks a lot in advance.
 
User avatar
anav
Forum Guru
Forum Guru
Posts: 5298
Joined: Sun Feb 18, 2018 11:28 pm
Location: Nova Scotia, Canada
Contact:

Re: Need help to Setup Dual Gateway

Mon Oct 12, 2020 4:40 pm

I am not understanding the breakdown of accessing internet vice whatever else you are talking about specific sites?
Do you mean that you have a list of external WANIPs, that you can apply such that all users going to those IPs use WAN2?
I'd rather manage rats than software. Follow my advice at your own risk! (Sob & mkx forced me to write that!)
MTUNA Certified, by the Ascerbic Llama!
 
sindy
Forum Guru
Forum Guru
Posts: 5905
Joined: Mon Dec 04, 2017 9:19 pm

Re: Need help to Setup Dual Gateway

Mon Oct 12, 2020 9:08 pm

What you experience is nothing specific to Mikrotik. Think also about the routing back, not just the routing forward. On the 'Tik, you need a route to 221.35.12.0/24 (plus routes to other destinations which should be accessed via 172.200.1.17), but the network in the main branch must also know which way to send packets for 192.168.88.0/24, otherwise the (ping) requests make it to the destination but the responses from that destination get routed elsewhere or dropped as they reach the main branch. Alternatively, you have to source-nat the traffic from the Mikrotik before sending it via the 172.200.1.17 gateway, assuming that a route back to Mikrotik's WAN IP on that interface does exist at the other end of the VPN pipe. In this case, the servers will see traffic from all clients in 192.168.88.0/24 as coming from the Mikrotik's WAN address, and it will not be possible that a client in the main branch could contact a server at the Mikrotik site, unless you'd use port forwarding.

So you can post your (anonymized, see my automatic signature below) configuration of the Mikrotik for a review, but it will be only one half of the story.
Instead of writing novels, post /export hide-sensitive. Use find&replace in your favourite text editor to systematically replace all occurrences of each public IP address potentially identifying you by a distinctive pattern such as my.public.ip.1.
 
aydinl60
just joined
Topic Author
Posts: 5
Joined: Sun Oct 11, 2020 11:58 pm

Re: Need help to Setup Dual Gateway

Mon Oct 12, 2020 10:28 pm

I am not understanding the breakdown of accessing internet vice whatever else you are talking about specific sites?
Do you mean that you have a list of external WANIPs, that you can apply such that all users going to those IPs use WAN2?
Hi,
That`s what I exactly mean. I have list of few public IP addresses which my users need to access them via WAN 2 only. rest of traffic must passed through wan 1 for general internet use.
 
aydinl60
just joined
Topic Author
Posts: 5
Joined: Sun Oct 11, 2020 11:58 pm

Re: Need help to Setup Dual Gateway

Mon Oct 12, 2020 10:44 pm

What you experience is nothing specific to Mikrotik. Think also about the routing back, not just the routing forward. On the 'Tik, you need a route to 221.35.12.0/24 (plus routes to other destinations which should be accessed via 172.200.1.17), but the network in the main branch must also know which way to send packets for 192.168.88.0/24, otherwise the (ping) requests make it to the destination but the responses from that destination get routed elsewhere or dropped as they reach the main branch. Alternatively, you have to source-nat the traffic from the Mikrotik before sending it via the 172.200.1.17 gateway, assuming that a route back to Mikrotik's WAN IP on that interface does exist at the other end of the VPN pipe. In this case, the servers will see traffic from all clients in 192.168.88.0/24 as coming from the Mikrotik's WAN address, and it will not be possible that a client in the main branch could contact a server at the Mikrotik site, unless you'd use port forwarding.

So you can post your (anonymized, see my automatic signature below) configuration of the Mikrotik for a review, but it will be only one half of the story.
Thanks for the reply, when my users directly connect to second adsl router(172.200.1.17) they can access to that specific destination and they can ping its Ip address as well so the packet goes to destination and replay also reach to 172.200.1.17. As you mentioned I need to source-nat the traffic from Mikrotik before sending it out via 172.200.1.17 gateway, but I`m a bit confused to setup this source-nat.
Unfortunately I`ve already reset the setting since I couldn't make it work. but if you really need to see the configuration I can do it again(Since I have done it few times) and send it here.
 
User avatar
anav
Forum Guru
Forum Guru
Posts: 5298
Joined: Sun Feb 18, 2018 11:28 pm
Location: Nova Scotia, Canada
Contact:

Re: Need help to Setup Dual Gateway

Mon Oct 12, 2020 11:55 pm

/export hide-sensitive file=anynameyouwish
so we can make sure your config is not causing issues!!


If you only have a few wanips then it should be doable since i have not done this particular iteration, not 100% sure.

IP Routes
a. ip route main ISP distance=5
b. ip route secondary ISP distance=10
c. ip route secondary ISP distance=10 route-mark=WAN2

IP route Rules
1. destination address=externalWANIP1 action=lookup only in table=Wan2
2. destination address=externalWANIP2 action=lookup only in table=Wan2
3. destination address=externalWANIPN action=lookup only in table=Wan2
I'd rather manage rats than software. Follow my advice at your own risk! (Sob & mkx forced me to write that!)
MTUNA Certified, by the Ascerbic Llama!
 
aydinl60
just joined
Topic Author
Posts: 5
Joined: Sun Oct 11, 2020 11:58 pm

Re: Need help to Setup Dual Gateway

Tue Oct 13, 2020 10:36 am

/export hide-sensitive file=anynameyouwish
so we can make sure your config is not causing issues!!


If you only have a few wanips then it should be doable since i have not done this particular iteration, not 100% sure.

IP Routes
a. ip route main ISP distance=5
b. ip route secondary ISP distance=10
c. ip route secondary ISP distance=10 route-mark=WAN2

IP route Rules
1. destination address=externalWANIP1 action=lookup only in table=Wan2
2. destination address=externalWANIP2 action=lookup only in table=Wan2
3. destination address=externalWANIPN action=lookup only in table=Wan2
Hi,
Thanks for reply. Unfortunately I don't get you. for example:
ip route main ISP distance=5 what do you mean with Main ISP? should i change "Main ISP" with its actual IP address or its interface? same goes for others as well.
 
WeWiNet
Member
Member
Posts: 432
Joined: Thu Sep 27, 2018 4:11 pm

Re: Need help to Setup Dual Gateway

Tue Oct 13, 2020 10:45 am

Use load balancing article from Chupaka to make basic setting.
Then add in the mangle rule that assigns traffic to ISP2 the "source address list" as condition.
And mangle rule for ISP1 will then use "!" = NOT "source address list".

That's all you need to do... very simple if you start from the failover example article.
WeWiNet

**
MTCNA
hapac2, map, hap-lite, ltap-mini, RB4011 (good!), Audience (better), Audience + Wap R ac LTE Hybrid DSL + LTE FWA (best :-) ) !!!
 
sindy
Forum Guru
Forum Guru
Posts: 5905
Joined: Mon Dec 04, 2017 9:19 pm

Re: Need help to Setup Dual Gateway

Tue Oct 13, 2020 11:50 am

Unfortunately I`ve already reset the setting since I couldn't make it work. but if you really need to see the configuration I can do it again(Since I have done it few times) and send it here.
Knowledge of the current configuration (without the changes you've reverted) is necessary to give a detailed suggestion of changes because they need to be suggested in accord with what is currently set up there.

At generic level:
  • if any device connected to Mikrotik's LAN subnet should access those several addresses via WAN2, it is enough to add a route via WAN2's gateway for each of these addresses,
  • if only some devices are allowed to access them and others must not access them in any way, you can use the route(s) as above and /ip firewall filter rules to control the access,
  • only if some devices should access a given address via WAN2 and other devices should access the same address via WAN1, you'd need to use two routing tables and use /ip firewall mangle rules to assign routing-mark values, used to choose the right routing table, depending on src-address-list and/or dst-address-list.
Instead of writing novels, post /export hide-sensitive. Use find&replace in your favourite text editor to systematically replace all occurrences of each public IP address potentially identifying you by a distinctive pattern such as my.public.ip.1.
 
User avatar
anav
Forum Guru
Forum Guru
Posts: 5298
Joined: Sun Feb 18, 2018 11:28 pm
Location: Nova Scotia, Canada
Contact:

Re: Need help to Setup Dual Gateway

Tue Oct 13, 2020 2:22 pm


Hi,
Thanks for reply. Unfortunately I don't get you. for example:
ip route main ISP distance=5 what do you mean with Main ISP? should i change "Main ISP" with its actual IP address or its interface? same goes for others as well.
Well unless you post your config its difficult to provide actual details, I was only noting the concept of what you should do, vice correct syntax or anything.
If you are experienced enough with MT, that advice would have been sufficient and since it was not best to post your config.
/export hide-sensitive file=anynameyouwish.

I think your request falls into Sindy's first category that if users want to go to certain sites they should go out WAN2, but for any other sites all users should use WAN1. Thus what I provided should suffice.

I think what he was saying is that there are two ways to skin the cat.

1. The way I noted,
IP Routes
a. ip route main ISP distance=5
b. ip route secondary ISP distance=10
c. ip route secondary ISP distance=10 route-mark=WAN2

IP route Rules
(i) destination address=externalWANIP1 action=lookup only in table=Wan2
(ii) destination address=externalWANIP2 action=lookup only in table=Wan2
(iii). destination address=externalWANIPN action=lookup only in table=Wan2

2. and another way which is to put the external WANIP right in as the destination and using the gateway of the second ISP...............
Here there is no use ip route rules, just routes.

a. Route to main ISP distance=5
b. Route to secondary ISP distance =10
c. Route to secondary ISP distance=2 destination address=external wanip1 gateway (of second ISP)
d. Route to secondary ISP distance=2 destination address=external wanip2 gateway (of second ISP)
e. Route to secondary ISP distance=2 destination address=external wanipN gateway (of second ISP)
Last edited by anav on Sat Oct 17, 2020 5:03 pm, edited 1 time in total.
I'd rather manage rats than software. Follow my advice at your own risk! (Sob & mkx forced me to write that!)
MTUNA Certified, by the Ascerbic Llama!
 
aydinl60
just joined
Topic Author
Posts: 5
Joined: Sun Oct 11, 2020 11:58 pm

Re: Need help to Setup Dual Gateway

Sat Oct 17, 2020 12:08 pm

Use load balancing article from Chupaka to make basic setting.
Then add in the mangle rule that assigns traffic to ISP2 the "source address list" as condition.
And mangle rule for ISP1 will then use "!" = NOT "source address list".

That's all you need to do... very simple if you start from the failover example article.
HI,
THanks for reply.
do You mean This one? https://wiki.mikrotik.com/wiki/Manual:PCC if no can you please give me the link?
 
sindy
Forum Guru
Forum Guru
Posts: 5905
Joined: Mon Dec 04, 2017 9:19 pm

Re: Need help to Setup Dual Gateway

Sat Oct 17, 2020 12:26 pm

Instead of writing novels, post /export hide-sensitive. Use find&replace in your favourite text editor to systematically replace all occurrences of each public IP address potentially identifying you by a distinctive pattern such as my.public.ip.1.
 
User avatar
anav
Forum Guru
Forum Guru
Posts: 5298
Joined: Sun Feb 18, 2018 11:28 pm
Location: Nova Scotia, Canada
Contact:

Re: Need help to Setup Dual Gateway

Sat Oct 17, 2020 5:01 pm

I am confused, did you want the easy way or the complicated way?
Oh well fill your boots and go down the mangling rabbit hole Gluck !!
Still havent provided an export as requested so I am outta here.
I'd rather manage rats than software. Follow my advice at your own risk! (Sob & mkx forced me to write that!)
MTUNA Certified, by the Ascerbic Llama!

Who is online

Users browsing this forum: Baidu [Spider], Google [Bot], Yahoo [Bot] and 96 guests