Community discussions

MikroTik App
 
User avatar
killermantv
just joined
Topic Author
Posts: 16
Joined: Fri Feb 12, 2021 12:51 pm
Location: Czech Republic

Port forward not working

Sat Sep 03, 2022 11:09 pm

Hello,

I have rb4011 running 7.5 stable with dual wan setup (https://www.reddit.com/r/mikrotik/comments/rfg8ga/guide_routeros_71_load_balancing_using_pcc/) however port forward doesn't work, it used to work with stable 7.4/7.3/7.2
I use address list called "DUAL" to tell mangle rules my lan network for the dual wan setup.
I use address list called "PORT" to port forward through only one isp as trying to do it by adding second isp to the "PORT" never worked.
The problem is, i get packets on the counter for these dst-nat rules and even the linux gets those packets but it looks like it doesn't go back to isp.

Here's my firewall export:
# sep/03/2022 21:49:07 by RouterOS 7.5
# software id = xxxxxxxxxx
#
# model = RB4011iGS+5HacQ2HnD
# serial number = xxxxxxxxxxxxxx
/ip firewall address-list
add address=192.168.0.0/16 list=LAN
add address=10.10.10.10 list=WAN
add address=192.168.0.0/16 list=DUAL
add address=10.56.60.19 list=WAN
add address=10.10.10.10 list=PORT
/ip firewall filter
add action=accept chain=output src-address-list=LAN
add action=accept chain=input comment=\
    "defconf: accept established,related,untracked" connection-state=\
    established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=\
    invalid
add action=drop chain=input dst-port=53,8291,22 in-interface-list=WAN protocol=\
    tcp
add action=drop chain=input dst-port=53,8291,22 in-interface-list=WAN protocol=\
    udp
add action=accept chain=input comment="Allow limited pings" disabled=yes limit=\
    1,5:packet protocol=icmp
add action=drop chain=input comment="Disable Pings" in-interface-list=!LAN \
    limit=1,2:packet protocol=icmp
add action=accept chain=input comment=\
    "defconf: accept to local loopback (for CAPsMAN)" dst-address=127.0.0.1
add action=drop chain=input comment="defconf: drop all not coming from LAN" \
    in-interface-list=!LAN
add action=accept chain=forward comment="defconf: accept in ipsec policy" \
    ipsec-policy=in,ipsec
add action=accept chain=forward comment="defconf: accept out ipsec policy" \
    ipsec-policy=out,ipsec
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" \
    connection-state=established,related hw-offload=yes
add action=accept chain=forward comment=\
    "defconf: accept established,related, untracked" connection-state=\
    established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" connection-state=\
    invalid
add action=drop chain=forward comment="defconf: drop all from WAN not DSTNATed" \
    connection-nat-state=!dstnat connection-state=new in-interface-list=WAN
/ip firewall mangle
add action=mark-connection chain=prerouting comment=\
    "Mark connections for hairpin NAT" dst-address-list=WAN \
    new-connection-mark="Hairpin NAT" passthrough=yes src-address-list=LAN
add action=mark-connection chain=prerouting dst-address-type=!local \
    new-connection-mark=con-one passthrough=yes per-connection-classifier=\
    src-address-and-port:2/0 src-address-list=DUAL
add action=mark-connection chain=prerouting dst-address-type=!local \
    new-connection-mark=con-two passthrough=yes per-connection-classifier=\
    src-address-and-port:2/1 src-address-list=DUAL
add action=mark-routing chain=prerouting connection-mark=con-one \
    new-routing-mark=Antik passthrough=no src-address-list=DUAL
add action=mark-routing chain=prerouting connection-mark=con-two \
    new-routing-mark=Telekom passthrough=no src-address-list=DUAL
/ip firewall nat
add action=masquerade chain=srcnat comment="Hairpin NAT" connection-mark=\
    "Hairpin NAT"
add action=masquerade chain=srcnat comment=Antik ipsec-policy=out,none \
    out-interface=ether2 to-addresses=0.0.0.0
add action=masquerade chain=srcnat comment=Telekom ipsec-policy=out,none \
    out-interface=Telekom
add action=dst-nat chain=dstnat dst-address-list=PORT dst-port=443,80 protocol=\
    tcp to-addresses=192.168.0.15 to-ports=80-443
add action=dst-nat chain=dstnat dst-address-list=PORT dst-port=444 protocol=tcp \
    to-addresses=192.168.0.20 to-ports=444-1194
add action=dst-nat chain=dstnat dst-address-list=PORT dst-port=1194 protocol=\
    udp to-addresses=192.168.0.20 to-ports=444-1194
add action=dst-nat chain=dstnat comment="mc tcp linuxVM" dst-address-list=PORT \
    dst-port=25565 protocol=tcp to-addresses=192.168.0.195 to-ports=25565
add action=dst-nat chain=dstnat comment="mc udp linuxVM" dst-address-list=PORT \
    dst-port=25565 protocol=udp to-addresses=192.168.0.195 to-ports=25565
(10.10.10.10 is made up but it's my public ip from a pppoe isp, and rules having interface as "telekom" is the pppoe isp; "antik" is the dhcp isp)

Here are my routes:
# sep/03/2022 22:00:38 by RouterOS 7.5
# software id = xxxxxxxxxx
#
# model = RB4011iGS+5HacQ2HnD
# serial number = xxxxxxxxxxxxxx
/ip route
add check-gateway=ping comment=Antik disabled=no distance=1 dst-address=0.0.0.0/0 gateway=10.56.60.1 pref-src=0.0.0.0 \
    routing-table=Antik scope=30 suppress-hw-offload=no target-scope=10
add check-gateway=bfd comment=Telekom disabled=no distance=1 dst-address=0.0.0.0/0 gateway=Telekom pref-src=0.0.0.0 \
    routing-table=Telekom scope=30 suppress-hw-offload=no target-scope=10

and routing table:
# sep/03/2022 22:02:07 by RouterOS 7.5
# software id = xxxxxxxxxx
#
# model = RB4011iGS+5HacQ2HnD
# serial number = xxxxxxxxxxxxxx
/routing table
add disabled=no fib name=Antik
add disabled=no fib name=Telekom
 
LaPeppona
just joined
Posts: 12
Joined: Sun Sep 04, 2022 12:45 am

Re: Port forward not working  [SOLVED]

Sun Sep 04, 2022 10:48 am

It goes, but to wrong ISP, since you are not marking incoming (from ISP) connections.

what can you do in your case:

1) Do not override "new-connection-mark", add to every mangle rule "connection-mark=no-mark" every time you do "new-connection-mark"
It gonna look like this:
/ip firewall mangle
add action=mark-connection chain=prerouting comment=\
    "Mark connections for hairpin NAT" dst-address-list=WAN \
    connection-mark=no-mark new-connection-mark="Hairpin NAT" passthrough=yes src-address-list=LAN
add action=mark-connection chain=prerouting dst-address-type=!local \
    connection-mark=no-mark new-connection-mark=con-one passthrough=yes per-connection-classifier=\
    src-address-and-port:2/0 src-address-list=DUAL
add action=mark-connection chain=prerouting dst-address-type=!local \
    connection-mark=no-mark new-connection-mark=con-two passthrough=yes per-connection-classifier=\
    src-address-and-port:2/1 src-address-list=DUAL
add action=mark-routing chain=prerouting connection-mark=con-one \
    new-routing-mark=Antik passthrough=no src-address-list=DUAL
add action=mark-routing chain=prerouting connection-mark=con-two \
    new-routing-mark=Telekom passthrough=no src-address-list=DUAL
It will not mark connection again, if it's already got one.

2) Mark new connections, that comes from ISP sides:
add action=mark-connection chain=prerouting connection-mark=no-mark in-interface=ether2 new-connection-mark=con-one passthrough=no
add action=mark-connection chain=prerouting connection-mark=no-mark in-interface=Telekom new-connection-mark=con-two passthrough=no
to the end of current
/ip firewall mangle
where ether2 and Telekom are corresponding ISP interfaces on your router

so at the end mangle section gonna look like this:
/ip firewall mangle
add action=mark-connection chain=prerouting comment=\
    "Mark connections for hairpin NAT" dst-address-list=WAN \
    connection-mark=no-mark new-connection-mark="Hairpin NAT" passthrough=yes src-address-list=LAN
add action=mark-connection chain=prerouting dst-address-type=!local \
    connection-mark=no-mark new-connection-mark=con-one passthrough=yes per-connection-classifier=\
    src-address-and-port:2/0 src-address-list=DUAL
add action=mark-connection chain=prerouting dst-address-type=!local \
    connection-mark=no-mark new-connection-mark=con-two passthrough=yes per-connection-classifier=\
    src-address-and-port:2/1 src-address-list=DUAL
add action=mark-routing chain=prerouting connection-mark=con-one \
    new-routing-mark=Antik passthrough=no src-address-list=DUAL
add action=mark-routing chain=prerouting connection-mark=con-two \
    new-routing-mark=Telekom passthrough=no src-address-list=DUAL
add action=mark-connection chain=prerouting connection-mark=no-mark in-interface=ether2 new-connection-mark=con-one passthrough=no
add action=mark-connection chain=prerouting connection-mark=no-mark in-interface=Telekom new-connection-mark=con-two passthrough=no
Last edited by LaPeppona on Sun Sep 04, 2022 5:44 pm, edited 2 times in total.
 
User avatar
killermantv
just joined
Topic Author
Posts: 16
Joined: Fri Feb 12, 2021 12:51 pm
Location: Czech Republic

Re: Port forward not working

Sun Sep 04, 2022 4:12 pm

add action=mark-routing chain=prerouting connection-mark=con-one \
    new-routing-mark=Antik passthrough=no src-address-list=DUAL
add action=mark-routing chain=prerouting connection-mark=con-two \
    new-routing-mark=Telekom passthrough=yes src-address-list=DUAL
add action=mark-connection chain=prerouting connection-mark=no-mark in-interface=ether2 new-connection-mark=con-one passthrough=yes
add action=mark-connection chain=prerouting connection-mark=no-mark in-interface=Telekom new-connection-mark=con-two passthrough=no
Thanks for your reply, it solved the problem!

However i wonder why did you left 2 rules with passthrough yes and 2 without passthrough? Is there a reason for it? I've tested it with passthrough yes on all rules and it looks like it doesn't affect the port forward.
 
LaPeppona
just joined
Posts: 12
Joined: Sun Sep 04, 2022 12:45 am

Re: Port forward not working

Sun Sep 04, 2022 5:43 pm

add action=mark-routing chain=prerouting connection-mark=con-one \
    new-routing-mark=Antik passthrough=no src-address-list=DUAL
add action=mark-routing chain=prerouting connection-mark=con-two \
    new-routing-mark=Telekom passthrough=yes src-address-list=DUAL
add action=mark-connection chain=prerouting connection-mark=no-mark in-interface=ether2 new-connection-mark=con-one passthrough=yes
add action=mark-connection chain=prerouting connection-mark=no-mark in-interface=Telekom new-connection-mark=con-two passthrough=no
Thanks for your reply, it solved the problem!

However i wonder why did you left 2 rules with passthrough yes and 2 without passthrough? Is there a reason for it? I've tested it with passthrough yes on all rules and it looks like it doesn't affect the port forward.
Ye, sorry, I was too lazy to read whole thing, and typed it early morning.

Yes you dont need passthrough=yes on last 4 rules (it can be passthrough=no). I just typed about it to be sure, to avoid possible mistake.

I fixed the original post

u also dont need passthrough=yes in "Mark connections for hairpin NAT" I think. Since u are not using that mark in further mangle table.
 
User avatar
killermantv
just joined
Topic Author
Posts: 16
Joined: Fri Feb 12, 2021 12:51 pm
Location: Czech Republic

Re: Port forward not working

Sun Sep 04, 2022 6:49 pm



Thanks for your reply, it solved the problem!

However i wonder why did you left 2 rules with passthrough yes and 2 without passthrough? Is there a reason for it? I've tested it with passthrough yes on all rules and it looks like it doesn't affect the port forward.
Ye, sorry, I was too lazy to read whole thing, and typed it early morning.

Yes you dont need passthrough=yes on last 4 rules (it can be passthrough=no). I just typed about it to be sure, to avoid possible mistake.

I fixed the original post

u also dont need passthrough=yes in "Mark connections for hairpin NAT" I think. Since u are not using that mark in further mangle table.
I did some testing and with everything passthrough=yes and it somehow managed to pull 10% more cpu usage and 200mbps more upload speed which saturated the 1Gb link.
 
LaPeppona
just joined
Posts: 12
Joined: Sun Sep 04, 2022 12:45 am

Re: Port forward not working

Sun Sep 04, 2022 8:58 pm



Ye, sorry, I was too lazy to read whole thing, and typed it early morning.

Yes you dont need passthrough=yes on last 4 rules (it can be passthrough=no). I just typed about it to be sure, to avoid possible mistake.

I fixed the original post

u also dont need passthrough=yes in "Mark connections for hairpin NAT" I think. Since u are not using that mark in further mangle table.
I did some testing and with everything passthrough=yes and it somehow managed to pull 10% more cpu usage and 200mbps more upload speed which saturated the 1Gb link.
"passthrough=no" jumps out from mangle table if rule passed, so with passthrough=no it checks less rules in some scenarios.
If u realy want more optimizations, you can use accept and jump actions
where you can put all connection markings in additional Chain and jump there with no-mark check.

maybe something like this, I have not tested it:
/ip firewall mangle
add action=mark-connection chain=newmark comment=\
    "Mark connections for hairpin NAT" dst-address-list=WAN \
    connection-mark=no-mark new-connection-mark="Hairpin NAT" passthrough=no src-address-list=LAN
add action=mark-connection chain=newmark connection-mark=no-mark in-interface=ether2 new-connection-mark=con-one passthrough=no
add action=mark-connection chain=newmark connection-mark=no-mark in-interface=Telekom new-connection-mark=con-two passthrough=no
add action=mark-connection chain=newmark dst-address-type=!local \
    connection-mark=no-mark new-connection-mark=con-one passthrough=yes per-connection-classifier=\
    src-address-and-port:2/0 src-address-list=DUAL
add action=mark-connection chain=newmark dst-address-type=!local \
    connection-mark=no-mark new-connection-mark=con-two passthrough=yes per-connection-classifier=\
    src-address-and-port:2/1 src-address-list=DUAL
add action=mark-connection chain=newmark connection-mark=no-mark new-connection-mark=default passthrough=no comment="default mark"

add action=jump chain=prerouting connection-mark=no-mark jump-target=newmark
add action=mark-routing chain=prerouting connection-mark=con-one \
    new-routing-mark=Antik passthrough=no src-address-list=DUAL
add action=mark-routing chain=prerouting connection-mark=con-two \
    new-routing-mark=Telekom passthrough=no src-address-list=DUAL
 
User avatar
killermantv
just joined
Topic Author
Posts: 16
Joined: Fri Feb 12, 2021 12:51 pm
Location: Czech Republic

Re: Port forward not working

Tue Sep 06, 2022 5:43 pm



I did some testing and with everything passthrough=yes and it somehow managed to pull 10% more cpu usage and 200mbps more upload speed which saturated the 1Gb link.
"passthrough=no" jumps out from mangle table if rule passed, so with passthrough=no it checks less rules in some scenarios.
If u realy want more optimizations, you can use accept and jump actions
where you can put all connection markings in additional Chain and jump there with no-mark check.

maybe something like this, I have not tested it:
/ip firewall mangle
add action=mark-connection chain=newmark comment=\
    "Mark connections for hairpin NAT" dst-address-list=WAN \
    connection-mark=no-mark new-connection-mark="Hairpin NAT" passthrough=no src-address-list=LAN
add action=mark-connection chain=newmark connection-mark=no-mark in-interface=ether2 new-connection-mark=con-one passthrough=no
add action=mark-connection chain=newmark connection-mark=no-mark in-interface=Telekom new-connection-mark=con-two passthrough=no
add action=mark-connection chain=newmark dst-address-type=!local \
    connection-mark=no-mark new-connection-mark=con-one passthrough=yes per-connection-classifier=\
    src-address-and-port:2/0 src-address-list=DUAL
add action=mark-connection chain=newmark dst-address-type=!local \
    connection-mark=no-mark new-connection-mark=con-two passthrough=yes per-connection-classifier=\
    src-address-and-port:2/1 src-address-list=DUAL
add action=mark-connection chain=newmark connection-mark=no-mark new-connection-mark=default passthrough=no comment="default mark"

add action=jump chain=prerouting connection-mark=no-mark jump-target=newmark
add action=mark-routing chain=prerouting connection-mark=con-one \
    new-routing-mark=Antik passthrough=no src-address-list=DUAL
add action=mark-routing chain=prerouting connection-mark=con-two \
    new-routing-mark=Telekom passthrough=no src-address-list=DUAL
I had a few busy days but i got to test this configuration and it seems that this one manages about 900mbit about 30mbit less but also saves about 5-12% of cpu usage and it works without problems in my scenario
Last edited by killermantv on Tue Sep 06, 2022 5:53 pm, edited 1 time in total.
 
User avatar
killermantv
just joined
Topic Author
Posts: 16
Joined: Fri Feb 12, 2021 12:51 pm
Location: Czech Republic

Re: Port forward not working

Tue Sep 06, 2022 5:53 pm

It goes, but to wrong ISP, since you are not marking incoming (from ISP) connections.

what can you do in your case:

1) Do not override "new-connection-mark", add to every mangle rule "connection-mark=no-mark" every time you do "new-connection-mark"
It gonna look like this:
/ip firewall mangle
add action=mark-connection chain=prerouting comment=\
    "Mark connections for hairpin NAT" dst-address-list=WAN \
    connection-mark=no-mark new-connection-mark="Hairpin NAT" passthrough=yes src-address-list=LAN
add action=mark-connection chain=prerouting dst-address-type=!local \
    connection-mark=no-mark new-connection-mark=con-one passthrough=yes per-connection-classifier=\
    src-address-and-port:2/0 src-address-list=DUAL
add action=mark-connection chain=prerouting dst-address-type=!local \
    connection-mark=no-mark new-connection-mark=con-two passthrough=yes per-connection-classifier=\
    src-address-and-port:2/1 src-address-list=DUAL
add action=mark-routing chain=prerouting connection-mark=con-one \
    new-routing-mark=Antik passthrough=no src-address-list=DUAL
add action=mark-routing chain=prerouting connection-mark=con-two \
    new-routing-mark=Telekom passthrough=no src-address-list=DUAL
It will not mark connection again, if it's already got one.

2) Mark new connections, that comes from ISP sides:
add action=mark-connection chain=prerouting connection-mark=no-mark in-interface=ether2 new-connection-mark=con-one passthrough=no
add action=mark-connection chain=prerouting connection-mark=no-mark in-interface=Telekom new-connection-mark=con-two passthrough=no
to the end of current
/ip firewall mangle
where ether2 and Telekom are corresponding ISP interfaces on your router

so at the end mangle section gonna look like this:
/ip firewall mangle
add action=mark-connection chain=prerouting comment=\
    "Mark connections for hairpin NAT" dst-address-list=WAN \
    connection-mark=no-mark new-connection-mark="Hairpin NAT" passthrough=yes src-address-list=LAN
add action=mark-connection chain=prerouting dst-address-type=!local \
    connection-mark=no-mark new-connection-mark=con-one passthrough=yes per-connection-classifier=\
    src-address-and-port:2/0 src-address-list=DUAL
add action=mark-connection chain=prerouting dst-address-type=!local \
    connection-mark=no-mark new-connection-mark=con-two passthrough=yes per-connection-classifier=\
    src-address-and-port:2/1 src-address-list=DUAL
add action=mark-routing chain=prerouting connection-mark=con-one \
    new-routing-mark=Antik passthrough=no src-address-list=DUAL
add action=mark-routing chain=prerouting connection-mark=con-two \
    new-routing-mark=Telekom passthrough=no src-address-list=DUAL
add action=mark-connection chain=prerouting connection-mark=no-mark in-interface=ether2 new-connection-mark=con-one passthrough=no
add action=mark-connection chain=prerouting connection-mark=no-mark in-interface=Telekom new-connection-mark=con-two passthrough=no
Since you are familiar with configuration do you have any ideas why doesn't router itself have internet access? It stopped working when i added routing tables for the dual wan, so i always have to enable and disable a rule that routes the "main" routing table to check updates etc., but i can't leave it turned on as it breaks connectivity for my lan after a while.

It looks like this:
add check-gateway=ping comment=main disabled=yes distance=1 dst-address=0.0.0.0/0 gateway=10.56.60.1 pref-src=0.0.0.0 \
    routing-table=main scope=30 suppress-hw-offload=no target-scope=10
add check-gateway=bfd comment=main disabled=yes distance=1 dst-address=0.0.0.0/0 gateway=Telekom pref-src=0.0.0.0 \
    routing-table=main scope=30 suppress-hw-offload=no target-scope=10
I have them always disabled and have two of them if one link is down and i need to update or something
 
LaPeppona
just joined
Posts: 12
Joined: Sun Sep 04, 2022 12:45 am

Re: Port forward not working

Wed Sep 07, 2022 7:58 pm

coz Prerouting chain serves only "incoming" packets, to make router to answer to his own connections via correct routing tables u have to also to mark-routing to router own packets using OUTPUT chain
Something like this:
/ip firewall mangle
add action=mark-routing chain=output connection-mark=con-one \
    new-routing-mark=Antik passthrough=no
add action=mark-routing chain=output connection-mark=con-two \
    new-routing-mark=Telekom passthrough=no
plus it must have 2 default gates (0.0.0.0/0) in main table, for both ISPs. I am not sure btw if realy need them, I just have them to make :ping tool working (by choosing output interface later). But it may throu an error (No Route to House) without it.
(you already have them)

dont forget to use SAFE-MODE when adding/removing anything in INPUT/OUTPUT or POSTROUTING chains.
 
User avatar
killermantv
just joined
Topic Author
Posts: 16
Joined: Fri Feb 12, 2021 12:51 pm
Location: Czech Republic

Re: Port forward not working

Wed Sep 07, 2022 9:56 pm

coz Prerouting chain serves only "incoming" packets, to make router to answer to his own connections via correct routing tables u have to also to mark-routing to router own packets using OUTPUT chain
Something like this:
/ip firewall mangle
add action=mark-routing chain=output connection-mark=con-one \
    new-routing-mark=Antik passthrough=no
add action=mark-routing chain=output connection-mark=con-two \
    new-routing-mark=Telekom passthrough=no
plus it must have 2 default gates (0.0.0.0/0) in main table, for both ISPs. I am not sure btw if realy need them, I just have them to make :ping tool working (by choosing output interface later). But it may throu an error (No Route to House) without it.
(you already have them)

dont forget to use SAFE-MODE when adding/removing anything in INPUT/OUTPUT or POSTROUTING chains.
I added your rules, moved them around (now they are first) as well and they get 0 traffic and no route with ping as well no internet from router itself
 
LaPeppona
just joined
Posts: 12
Joined: Sun Sep 04, 2022 12:45 am

Re: Port forward not working

Sun Sep 11, 2022 12:26 am

coz Prerouting chain serves only "incoming" packets, to make router to answer to his own connections via correct routing tables u have to also to mark-routing to router own packets using OUTPUT chain
Something like this:
/ip firewall mangle
add action=mark-routing chain=output connection-mark=con-one \
    new-routing-mark=Antik passthrough=no
add action=mark-routing chain=output connection-mark=con-two \
    new-routing-mark=Telekom passthrough=no
plus it must have 2 default gates (0.0.0.0/0) in main table, for both ISPs. I am not sure btw if realy need them, I just have them to make :ping tool working (by choosing output interface later). But it may throu an error (No Route to House) without it.
(you already have them)

dont forget to use SAFE-MODE when adding/removing anything in INPUT/OUTPUT or POSTROUTING chains.
I added your rules, moved them around (now they are first) as well and they get 0 traffic and no route with ping as well no internet from router itself
two routes with 0.0.0.0/0 in main table still enabled? U said u disable them, I told you it must be enabled, to avoid "no route to host"
add check-gateway=ping comment=main disabled=no distance=1 dst-address=0.0.0.0/0 gateway=10.56.60.1 pref-src=0.0.0.0 \
    routing-table=main scope=30 suppress-hw-offload=no target-scope=10
add check-gateway=bfd comment=main disabled=no distance=1 dst-address=0.0.0.0/0 gateway=Telekom pref-src=0.0.0.0 \
    routing-table=main scope=30 suppress-hw-offload=no target-scope=10
these
just double checking first

also when using :ping tool, specify interface
 
User avatar
killermantv
just joined
Topic Author
Posts: 16
Joined: Fri Feb 12, 2021 12:51 pm
Location: Czech Republic

Re: Port forward not working

Sun Sep 11, 2022 4:15 pm



I added your rules, moved them around (now they are first) as well and they get 0 traffic and no route with ping as well no internet from router itself
two routes with 0.0.0.0/0 in main table still enabled? U said u disable them, I told you it must be enabled, to avoid "no route to host"
add check-gateway=ping comment=main disabled=no distance=1 dst-address=0.0.0.0/0 gateway=10.56.60.1 pref-src=0.0.0.0 \
    routing-table=main scope=30 suppress-hw-offload=no target-scope=10
add check-gateway=bfd comment=main disabled=no distance=1 dst-address=0.0.0.0/0 gateway=Telekom pref-src=0.0.0.0 \
    routing-table=main scope=30 suppress-hw-offload=no target-scope=10
these
just double checking first

also when using :ping tool, specify interface
Sorry i forgot to turn those routes on but without those rules i get about 1gb/1gb, but now it's around 800mbps/730kbps
If i turn on passthrough on your rules i get about 1gbps down and 100mbps up and with cpu usage maximum around 10%, websites are really slow to load with both settings
I usually use speedtest for this but it only said "finding optimal server..."
Screenshot 2022-09-11 150933.png
You do not have the required permissions to view the files attached to this post.
 
LaPeppona
just joined
Posts: 12
Joined: Sun Sep 04, 2022 12:45 am

Re: Port forward not working

Sun Sep 11, 2022 5:29 pm

thats strange. OUTPUT used only for local/own router traffic. And these 2 routes in main table should not affect anything for Forwarding traffic >.>
Idk try to disable these routes in main table, and use dynamic one, that provided by DHCP and PPPOE configs

If i turn on passthrough on your rules i get about 1gbps down and 100mbps up
on which rules

Show me whole /ip/firewall/mangle/ print u have right now
 
User avatar
killermantv
just joined
Topic Author
Posts: 16
Joined: Fri Feb 12, 2021 12:51 pm
Location: Czech Republic

Re: Port forward not working

Sun Sep 11, 2022 8:47 pm

thats strange. OUTPUT used only for local/own router traffic. And these 2 routes in main table should not affect anything for Forwarding traffic >.>
Idk try to disable these routes in main table, and use dynamic one, that provided by DHCP and PPPOE configs

If i turn on passthrough on your rules i get about 1gbps down and 100mbps up
on which rules

Show me whole /ip/firewall/mangle/ print u have right now
Passthrough part is about those rules that fixes internet for router itself the output ones.
Here:
# sep/11/2022 19:45:15 by RouterOS 7.5
# software id = xxxxxxxxxx
#
# model = RB4011iGS+5HacQ2HnD
# serial number = xxxxxxxxxxxxxx
/ip firewall mangle
add action=mark-connection chain=prerouting comment="Mark connections for hairpin NAT" connection-mark=no-mark disabled=yes \
    dst-address-list=WAN new-connection-mark="Hairpin NAT" passthrough=no src-address-list=LAN
add action=mark-connection chain=prerouting comment=Antik connection-mark=no-mark disabled=yes dst-address-type=!local \
    new-connection-mark=con-one passthrough=yes per-connection-classifier=src-address-and-port:2/0 src-address-list=DUAL
add action=mark-connection chain=prerouting comment=Telekom connection-mark=no-mark disabled=yes dst-address-type=!local \
    new-connection-mark=con-two passthrough=yes per-connection-classifier=src-address-and-port:2/1 src-address-list=DUAL
add action=mark-routing chain=prerouting comment=Antik connection-mark=con-one disabled=yes new-routing-mark=Antik \
    passthrough=yes src-address-list=DUAL
add action=mark-routing chain=prerouting comment=Telekom connection-mark=con-two disabled=yes new-routing-mark=Telekom \
    passthrough=yes src-address-list=DUAL
add action=mark-connection chain=prerouting comment=Antik connection-mark=no-mark disabled=yes in-interface=ether2 \
    new-connection-mark=con-one passthrough=yes
add action=mark-connection chain=prerouting comment=Telekom connection-mark=no-mark disabled=yes in-interface=Telekom \
    new-connection-mark=con-two passthrough=yes
add action=mark-connection chain=newmark comment="Mark connections for hairpin NAT" connection-mark=no-mark \
    dst-address-list=WAN new-connection-mark="Hairpin NAT" passthrough=no src-address-list=LAN
add action=mark-connection chain=newmark connection-mark=no-mark in-interface=ether2 new-connection-mark=con-one \
    passthrough=yes
add action=mark-connection chain=newmark connection-mark=no-mark in-interface=Telekom new-connection-mark=con-two \
    passthrough=yes
add action=mark-connection chain=newmark connection-mark=no-mark dst-address-type=!local new-connection-mark=con-one \
    passthrough=yes per-connection-classifier=src-address-and-port:2/0 src-address-list=DUAL
add action=mark-connection chain=newmark connection-mark=no-mark dst-address-type=!local new-connection-mark=con-two \
    passthrough=yes per-connection-classifier=src-address-and-port:2/1 src-address-list=DUAL
add action=mark-connection chain=newmark comment="default mark" connection-mark=no-mark new-connection-mark=default \
    passthrough=yes
add action=jump chain=prerouting connection-mark=no-mark jump-target=newmark
add action=mark-routing chain=prerouting connection-mark=con-one new-routing-mark=Antik passthrough=yes src-address-list=\
    DUAL
add action=mark-routing chain=prerouting connection-mark=con-two new-routing-mark=Telekom passthrough=yes src-address-list=\
    DUAL
add action=mark-routing chain=output comment="Inernet for Router" connection-mark=con-one new-routing-mark=Antik \
    passthrough=yes
add action=mark-routing chain=output comment="Internet for Router" connection-mark=con-two new-routing-mark=Telekom \
    passthrough=yes
 
LaPeppona
just joined
Posts: 12
Joined: Sun Sep 04, 2022 12:45 am

Re: Port forward not working

Fri Sep 16, 2022 1:39 am

Hmmm, I dont see anything strange so far, only last 4 rules must be passthrou on no. and some rules in newmark chain must be passthrou on no too (first 3) and last one, coz they dont need anything after has been action applied.

But I noticed, that I dont have gateway check on my own dual-wan router configuration, coz they are kinda useless for me:
the check-gateway option in route.

also in Filter:
plus
add action=accept chain=output src-address-list=LAN
in Filter looks kinda useless for me, u dont need accept for this, its accepted by default, since u dont have any drop rule in output.

And I noticed u are using Fasttrack, u can also try to temporary disable it, and check out how it works without it (after restart)
here:
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" \
    connection-state=established,related hw-offload=yes
disable it and restart router.
 
LaPeppona
just joined
Posts: 12
Joined: Sun Sep 04, 2022 12:45 am

Re: Port forward not working

Sun Oct 16, 2022 2:02 am

Sorry i forgot to turn those routes on but without those rules
Sorry I also completely forgot, that you router may not be able to correctly init outcome connections to default route with both routes on. Only answering back, or serve specific routes with 1 gateway/w multiple distance, To correctly init outcome connections, you must use only one default route, or add rules to output chain / mangle table, that gonna premark connections (if connection has no mark), according to src address (these rules must be before mark-routing rules). I think its more ez just to use one active default route (0.0.0.0) // routes with different distance in main table, in ur case.
I got these rules hidden, so forgot about it.

(yesterday I was doing the whole routine of configuring "balancing" on new mikrotik router, and accidentally noticed that I forgot to write about this here, when was remaking the rules)

UPD: its probably not a big deal for TCP, when NAT/masquerade is ON, but it may cause problems with UDP.
 
User avatar
killermantv
just joined
Topic Author
Posts: 16
Joined: Fri Feb 12, 2021 12:51 pm
Location: Czech Republic

Re: Port forward not working

Sun Oct 30, 2022 3:30 pm

Sorry i forgot to turn those routes on but without those rules
Sorry I also completely forgot, that you router may not be able to correctly init outcome connections to default route with both routes on. Only answering back, or serve specific routes with 1 gateway/w multiple distance, To correctly init outcome connections, you must use only one default route, or add rules to output chain / mangle table, that gonna premark connections (if connection has no mark), according to src address (these rules must be before mark-routing rules). I think its more ez just to use one active default route (0.0.0.0) // routes with different distance in main table, in ur case.
I got these rules hidden, so forgot about it.

(yesterday I was doing the whole routine of configuring "balancing" on new mikrotik router, and accidentally noticed that I forgot to write about this here, when was remaking the rules)

UPD: its probably not a big deal for TCP, when NAT/masquerade is ON, but it may cause problems with UDP.
Sorry for late reply i had a lot going on, this was the last missing part and it solved the problem, Thanks!

Who is online

Users browsing this forum: araqiel, Bing [Bot], Josephny and 92 guests