pcc load balancing and mail servers with nat

alex_rhys-hurn · Thu May 06, 2010 8:19 pm

Hello,

I have looked around the forums and the closest thing I have found that starts me on ly solution is here: http://forum.mikrotik.com/viewtopic.php ... it=pcc+nat

My situation.

2 ISP Links, 2mb up and 2mb down each.

each ISP terminates with a /30 on my RB 433 and then additionally gives me a /29 (so two /29s) and I have added these IP addresses as secondary IPs to each relevant interface. All IP addresses are pingable.

I have setup the PCC Load Balancing solution as per the wiki manual example.

PCC and load balancing works well (in fact I have used ECMP and NTH in the past and this is by far the best method).

My problem is in understanding how to do natting properly for my mail server.

I have setup two MX records for the relevant public IP and these are DST-NATted properly on each interface.

Normally I SRC-NAT as well for traffic from the mail server so that the outgoing IP address for the server works properly for the PTR records and MX lookup for anti-spam purposes.

I can telnet to port 25 correctly on one isp interface but not on the other. Why is that?

How Can I do the DST-NAT and SRC-NAT properly for the mail server with two wan interfaces?

PCC only seems to work properly with masquerade and not SRC-DST nat.

Thanks,

Alex

PS: My nat rules:

#
/ip firewall nat

add action=dst-nat chain=dstnat comment="IN ISP 1" disabled=\
    no dst-address=41.206.37.30 dst-port=25 protocol=tcp to-addresses=\
    192.168.0.8 to-ports=25

add action=dst-nat chain=dstnat comment="IN ISP 2" disabled=\
    no dst-address=41.212.40.70 dst-port=25 protocol=tcp to-addresses=\
    192.168.0.8 to-ports=25


add action=src-nat chain=srcnat comment="OUT ISP ONE" disabled=no src-address=192.168.0.8 \
    to-addresses=41.206.37.30
add action=src-nat chain=srcnat comment="OUT ISP TWO" disabled=no src-address=192.168.0.8 \
    to-addresses=41.212.40.70


add action=masquerade chain=srcnat comment="Masq AK Traffic to AK Interface" \
    disabled=no out-interface=ether2

add action=masquerade chain=srcnat comment=\
    "Masq Simba Traffic to Simba Interface" disabled=no out-interface=ether3

fewi · Thu May 06, 2010 8:39 pm

Add in-interface and out-interface qualifiers to your dst-nat and src-nat rules. Your first src-nat action matches traffic going out both WAN interfaces.

Also ensure that you're correctly marking incoming connections for PCC purposes so you can send the replies from the mail server out the same interface that the original request came in on.

alex_rhys-hurn · Sat May 08, 2010 11:44 am

Hi fewi,

Thanks for your input. Its helped me.

In fact I had not done my mangle PCC rules properly and so I followed this post by you which sorted me out.

http://forum.mikrotik.com/viewtopic.php?f=2&t=36232&start=0

Thanks again,

Alex

pcc load balancing and mail servers with nat

pcc load balancing and mail servers with nat

Re: pcc load balancing and mail servers with nat

Re: pcc load balancing and mail servers with nat

Who is online