Community discussions

MikroTik App
 
mode
newbie
Topic Author
Posts: 37
Joined: Sun Jun 03, 2018 12:12 am

Routing Mark - connection issues

Mon Apr 05, 2021 12:52 pm

Hello,

I am using my mikrotik Router with 2 internetconnections and masquerading.
On a normal day i only use the main internet connection with this configuration:
/interface list member
add comment="Main Internet" interface=ether1 list=WAN
add interface=vlan178_wan_backup list=WAN

/ip firewall nat
add action=masquerade chain=srcnat comment="defconf: masquerade" ipsec-policy=out,none \
    out-interface-list=WAN 
/ip route
add comment="Main Route (cable)" disabled=no distance=5 gateway=x.201.72.1
To manually switch over all trafic to the secondary internet connection i only have to enable this route
/ip route
add comment="second Internet con" disabled=no distance=1 gateway=192.168.178.1

Both connections work pretty will with a decent speed.

Now i wanted to use the second internet connection for one host (192.168.1.100) only, all others should use the primary connection. So i disbaled the "backup Route" and added this:
/ip route
add comment="second Internet con Routing Mask" distance=1 gateway=192.168.178.1 routing-mark=backup

/ip firewall mangle
add action=mark-connection chain=prerouting connection-state=new disabled=no dst-address-type=\
    !local in-interface=bridge new-connection-mark=con_backup passthrough=yes src-address=\
    192.168.1.100
add action=mark-routing chain=prerouting comment="OneHost over backup" connection-mark=con_backup \
    disabled=no in-interface=bridge new-routing-mark=backup passthrough=yes
This works, but the speed is very very low. CPU Load of the router is 1%.
With the static route for the secondary internet connection i get 20Mbit Down, 10 MBit up, surfing is fast and easy.
With the routing mark route for the secondary internet connection the internet feels very slow.
Surfing web pages takes 10 times longer with the routing mark route. My feeling is that it takes a very long time to connect to a server. Often my browser shows up errors like "PR_END_OF_FILE_ERROR".When connection is established, the speed is ok (like with the static route).

What am i doing wrong here?

Br
 
pe1chl
Forum Guru
Forum Guru
Posts: 10218
Joined: Mon Jun 08, 2015 12:09 pm

Re: Routing Mark - connection issues  [SOLVED]

Mon Apr 05, 2021 12:55 pm

Make sure you disable the "fasttrack" rule and "fastpath" setting in IP settings, then try again.
 
mode
newbie
Topic Author
Posts: 37
Joined: Sun Jun 03, 2018 12:12 am

Re: Routing Mark - connection issues

Mon Apr 05, 2021 1:02 pm

Problem solved.
I only changed this:
/ip firewall filter add action=fasttrack-connection chain=forward comment="defconf: fasttrack" connection-state=established,related disabled=yes
Thank you!!

What was the problem with fasttrack?

BR
 
User avatar
bekax5
Member Candidate
Member Candidate
Posts: 110
Joined: Thu Apr 30, 2015 11:27 pm

Re: Routing Mark - connection issues

Mon Apr 05, 2021 1:20 pm

Problem solved.
I only changed this:
/ip firewall filter add action=fasttrack-connection chain=forward comment="defconf: fasttrack" connection-state=established,related disabled=yes
Thank you!!

What was the problem with fasttrack?

BR
I believe fasttrack will jump Queues, firewall filter and mangle rules.
It does this after the first packet is marked to be tracked for faster processing, by skipping those extra "unnecessary" steps.

In my case I managed to leave fasttrack Enabled but added to that rule:
connection-mark=no-mark
chain=forward action=fasttrack-connection connection-state=established,related connection-mark=no-mark log=no log-prefix="" 
Also, I need to mark-connection in mangle whenever they need special filtering.
 
mode
newbie
Topic Author
Posts: 37
Joined: Sun Jun 03, 2018 12:12 am

Re: Routing Mark - connection issues

Mon Apr 05, 2021 1:49 pm

And where do you set the "no-mark" mark? Or is "no-mark" implicit set when no other mark is set in mangle ruleset?
 
User avatar
bekax5
Member Candidate
Member Candidate
Posts: 110
Joined: Thu Apr 30, 2015 11:27 pm

Re: Routing Mark - connection issues

Mon Apr 05, 2021 2:00 pm

And where do you set the "no-mark" mark? Or is "no-mark" implicit set when no other mark is set in mangle ruleset?
The latter:
"If no-mark is set, rule will match any unmarked connection."
 
pe1chl
Forum Guru
Forum Guru
Posts: 10218
Joined: Mon Jun 08, 2015 12:09 pm

Re: Routing Mark - connection issues

Mon Apr 05, 2021 5:11 pm

It depends on how you apply the marks if that will work. When the mark is applied immediately at the start of the connection e.g. by matching source address it can work, but when your mark is determined later it can be too late for this to work.
(of course when the mark changes routing, it will fail anyway when it is applied later, so for this particular usage it may work fine)

Remember fasttrack is not compatible with advanced uses of the router including routing marks, so you have to choose between those.
But indeed in some use cases it may work with a "partial" fasttrack.

Who is online

Users browsing this forum: haung05, jaisal, Splash and 99 guests