Dear all,

I have 4 ISP and i'm using load balance.....
how can i select one ISP go to MSN and one ISP for Download ......

Plz help meeeeee


many thx,

Hi!

You need routing marks for this.

step 1: go to IP -> Firewall -> Mangle, and create a rule to match traffic (e.g. dst address = msn, port=80, etc) on action tab, make it 'mark routing' and give it some name

step 2: go to IP -> route, and create a new route - set destination = 0.0.0.0/0 and next hop gateway = whichever gateway you want it to use. Then set routing mark to the one you made in the mangle rule.

all done!

Cheers.

Messenger uses TCP 1863 port

Dear..

all is ok,but in firewall..> mangle..>General..>dst adress ...? i dont undersatnd this..
plz step by step this stage



many thxxxxxxxxxxxxxxxxxxxx

Click on the button labeled IP to bring up the IP menu, click on firewall. Click on the mangle tab. Add a rule via the + button and on the General tab fill out the field named Destination Port.

Watch some videos on tiktube.com and read the manual on the wiki and look at screenshots. His instructions were very clear, really. It wouldn't have taken much clicking and looking around and exploring Winbox to figure out what he meant.

I'M sorry i need to rout msn i searched in wiki but i dont found about this..

plz which port excatly or plz send me mangle steps


sory again

many thxxxxx

can i connect 2 mikrotik with same pppoe server
i want to connect 8 isp


many thxxxx

[quote="sleimanr"]can i connect 2 mikrotik with same pppoe server
i want to connect 8 isp [/quote]

yes you can. use multilink PPP to aggregate throughput (if supported by the ISP):

http://wiki.mikrotik.com/wiki/Manual:ML ... iple_links

Otherwise you will need to use route marking and define interface instead of just nexthop address in your routing table entries.

Cheers!

/ip firewall mangle
add chain=prerouting protocol=tcp dst-port=1863 action=mark-routing new-routing-mark=msn
/ip route
add dst-address=0.0.0.0/0 gateway=a.b.c.d routing-mark=msn


i tried but msn not open also i tried dst-address for google.com not work

plz help meeeeeee

many thxxxxx

which DST-address did you use for google? It uses many IP addresses, one is not enough

ahaaaa before ip google=209.85.135.106 ,now ip=209.85.135.99 ...

my idea is one isp account for facebook and hotmail
other for msn and not working


many thxxxxxx

my idea is one isp account for facebook and hotmail
other for msn and not working

That's a perfectly fine idea, so long as you can deal with a range of possible IP addresses (e.g for google as you have discovered)

Would probably be a better idea if you define address ranges (e.g. 209.85.106.0/24) instead of single IP addresses.

Cheers!

thx good ideaaaaa

but it is not working .. i tried msn port 1863 still not work


plz any idea


many thxxxxx

but it is not working .. i tried msn port 1863 still not work

how do you define 'not working'? no access to msn, or just not using the isp link that you expect?

have you got masquerade working on both isp links?

Cheers.

if mark routing go to isp direct without dst-port or google ip..etc it is work fine
when i use dst-port or ip no acces to msn or......


many thxxxxxxxxxxxxxxxxxxxxx

do you have default 0.0.0.0 route with no routing mark rule for non marked packets?

see pic plz

plz helpppp

Do you have a SECOND default route to 0.0.0.0 that doesn't have a routing mark for traffic without a routing mark to fall through to?

sory i dont understand yr question

if u ask me: all 4 isp working fine with load balance
but i want to choose one isp to msn or.. not working

Hi,

post results of '/ip route print'

hiiiii

Hi,

that's not the result of 'ip route print' - it's a snapshot of the winbox routing table. it doesn't show all the info.

anyway...

please /also/ show us the result of 'int print' as well as 'ip route print'

cheers.

hiiiiiiiiiiiiiiiiiiiiiiii

OK, thanks.

Just one more: 'ip address print'

it would help a lot if you just highlight the text in the terminal window and right-click-copy then paste into the forum text editor.

Cheers.

I would just like to quickly point out that using MLPPP and combining all four circuits into one - as you are asking in your other thread - is the opposite of what you're asking in here, and you cannot do both at the same time.

Flags: X - disabled, I - invalid, D - dynamic
# ADDRESS NETWORK BROADCAST
0 X 143.168.143.243/24 143.168.143.0 143.168.143.255
1 X 182.30.16.134/24 182.30.16.0 182.30.16.255
2 10.10.10.1/24 10.10.10.0 10.10.10.255
3 192.129.0.3/24 192.129.0.0 192.129.0.255
4 X 192.168.24.26/24 192.168.24.0 192.168.24.255
5 192.166.0.3/24 192.166.0.0 192.166.0.255
6 192.168.0.150/24 192.168.0.0 192.168.0.255
7 192.168.23.150/24 192.168.23.0 192.168.23.255
8 D 10.10.10.1/32 10.10.10.98 0.0.0.0
9 D 10.10.10.1/32 10.10.10.40 0.0.0.0
10 D 10.10.10.1/32 10.10.10.43 0.0.0.0
11 D 10.10.10.1/32 10.10.10.94 0.0.0.0
12 D 10.10.10.1/32 10.10.10.200 0.0.0.0
13 D 10.10.10.1/32 10.10.10.9 0.0.0.0
14 D 10.10.10.1/32 10.10.10.173 0.0.0.0
15 D 10.10.10.1/32 10.10.10.165 0.0.0.0
16 D 10.10.10.1/32 10.10.10.12 0.0.0.0
17 D 10.10.10.1/32 10.10.10.189 0.0.0.0
18 D 10.10.10.1/32 10.10.10.95 0.0.0.0
19 D 10.10.10.1/32 10.10.10.159 0.0.0.0

OK, have you got NAT rules set up for each outbound interface? Each one probably need a src-nat or masquerade to make sure that the source address of outbound packets matches the interface that it is transmitted on.

It may also be easier if you can just attach your supout.rif

Cheers,

[admin@DS new] ip firewall nat> print
Flags: X - disabled, I - invalid, D - dynamic
0 chain=srcnat src-address=10.10.10.0/24 action=masquerade


all interface work with this nat

Post a reply
The extension rif is not allowed.

any help plzzzzzzzzzzzzzzz

Post a reply
The extension rif is not allowed.

you can just change the filename to ._if, or .txt or something else perhaps?

so lets get this straight: if you disable the mangle rule you show above, then msn works. when you enable it, doesn't work.

is that essentially right?

* this mangle work for browsing ,all port
chain=prerouting src-address=10.10.10.0/26 action=mark-routing
new-routing-mark=GroupA passthrough=no
* this mangle for msn not work
chain=prerouting src-address=10.10.10.0/26 protocol=tcp dst-port=1863
action=mark-routing new-routing-mark=msn passthrough=no

* this mangle work for browsing ,all port
chain=prerouting src-address=10.10.10.0/26 action=mark-routing
new-routing-mark=GroupA passthrough=no
* this mangle for msn not work
chain=prerouting src-address=10.10.10.0/26 protocol=tcp dst-port=1863
action=mark-routing new-routing-mark=msn passthrough=no

What about of you change the first rule like this:

chain=prerouting src-address=10.10.10.0/26 action=mark-routing new-routing-mark=msn passthrough=no

?

Cheers.

* i change new-routing-mark to msn also i change route..Mark= msn
yes there is internet..

0 ;;; GroupA
chain=prerouting src-address=10.10.10.0/26 action=mark-routing
new-routing-mark=msn passthrough=no

what version of ROS are you using ??

v:3.20

* i change new-routing-mark to msn also i change route..Mark= msn
yes there is internet..

0 ;;; GroupA
chain=prerouting src-address=10.10.10.0/26 action=mark-routing
new-routing-mark=msn passthrough=no

I think that you have identified a problem with your nexthop path via 192.129.0.2 - what /is/ that address anyway? can you ping it? if you connect just a PC to that gateway, can you get internet access that way?

Cheers.

i changed to next route it is work thxxx
but if i put address for www.facebook.com knowing that facebook range 189.0/24 and 190.0/24
only first page open, if i want to login..> the page cannectbe displayed why?


many thxxx

i changed to next route it is work thxxx
but if i put address for http://www.facebook.com knowing that facebook range 189.0/24 and 190.0/24
only first page open, if i want to login..> the page cannectbe displayed why?

many thxxx

Hi,

I suspect that your IP addresses are not matching all of the facebook pages that you expect. For example, I think when you logon to facebook, the hostname is login.facebook.com instead of www.facebook.com and so on. So I think that you probably need to double check that you are matching the right IP addresses.

Cheers.

what is address for facebook

thxx

in windows, open "cmd" and type "nslookup facebook.com"

result will be something like this:

can we mark routing facebook.com
facebook have 3 ip address and in mangle only one ip we can

thxxx

So make more mangle rules or make a firewall address list with the 3 IPs on them and refer to the address list via dst-address-list. The latter is the preferred method.
http://wiki.mikrotik.com/wiki/Manual:IP/Firewall/Mangle
http://wiki.mikrotik.com/wiki/Manual:IP ... dress_list

plz can u send me step by step stil not working
plzzzzzzzzzzz

Why don't you rather post what you have tried so far with address lists so that it can be corrected rather than asking for others to create a complete solution for you?

i tried many ideas still same
plz yr solution

many thxxxxxxxxx

can u export everything, u r asking questions 1 after the other. and ur not getting to a solution.
post your export (type /export) and copy all screen and paste it here.

/interface ethernet
set 0 arp=enabled auto-negotiation=yes bandwidth=unlimited/unlimited comment=\
"" disabled=no full-duplex=yes mac-address=00:0C:42:19:7C:93 master-port=\
none mtu=1500 name=Real speed=100Mbps
set 1 arp=enabled auto-negotiation=yes bandwidth=unlimited/unlimited comment=\
"" disabled=no full-duplex=yes mac-address=00:0C:42:19:7C:94 master-port=\
none mtu=1500 name=Real2 speed=100Mbps
set 2 arp=enabled auto-negotiation=yes bandwidth=unlimited/unlimited comment=\
"" disabled=no full-duplex=yes mac-address=00:0C:42:19:7C:95 master-port=\
none mtu=1500 name=Realg1 speed=100Mbps
set 3 arp=enabled auto-negotiation=yes bandwidth=unlimited/unlimited comment=\
"" disabled=no full-duplex=yes mac-address=00:0C:42:19:7C:96 master-port=\
none mtu=1500 name=Realg2 speed=100Mbps
set 4 arp=enabled auto-negotiation=yes bandwidth=unlimited/unlimited comment=\
"" disabled=no full-duplex=yes mac-address=00:0C:42:19:7C:97 master-port=\
none mtu=1500 name=Fake speed=100Mbps
set 5 arp=enabled auto-negotiation=yes bandwidth=unlimited/unlimited comment=\
"" disabled=no full-duplex=yes mac-address=00:0C:42:19:7C:98 master-port=\
none mtu=1500 name=Dilink speed=100Mbps
set 6 arp=enabled auto-negotiation=yes bandwidth=unlimited/unlimited comment=\
"" disabled=no full-duplex=yes mac-address=00:0C:42:19:7C:99 master-port=\
none mtu=1500 name=Volcano speed=100Mbps
set 7 arp=enabled auto-negotiation=yes bandwidth=unlimited/unlimited comment=\
"" disabled=no full-duplex=yes mac-address=00:0C:42:19:7C:9A master-port=\
none mtu=1500 name=Facebook speed=100Mbps
set 8 arp=enabled auto-negotiation=yes bandwidth=unlimited/unlimited comment=\
"" disabled=no full-duplex=yes mac-address=00:0C:42:19:7C:9B master-port=\
none mtu=1500 name=dilink1 speed=100Mbps
/interface wireless security-profiles
set default authentication-types="" eap-methods=passthrough group-ciphers="" \
group-key-update=5m interim-update=0s mode=none name=default \
radius-eap-accounting=no radius-mac-accounting=no \
radius-mac-authentication=no radius-mac-caching=disabled \
radius-mac-format=XX:XX:XX:XX:XX:XX radius-mac-mode=as-username \
static-algo-0=none static-algo-1=none static-algo-2=none static-algo-3=\
none static-key-0="" static-key-1="" static-key-2="" static-key-3="" \
static-sta-private-algo=none static-sta-private-key="" \
static-transmit-key=key-0 supplicant-identity="DS new" tls-certificate=\
none tls-mode=no-certificates unicast-ciphers="" wpa-pre-shared-key="" \
wpa2-pre-shared-key=""
/ip hotspot profile
set default dns-name="" hotspot-address=0.0.0.0 html-directory=hotspot \
http-cookie-lifetime=3d http-proxy=0.0.0.0:0 login-by=cookie,http-chap \
name=default rate-limit="" smtp-server=0.0.0.0 split-user-domain=no \
use-radius=no
/ip hotspot user profile
set default advertise=no idle-timeout=none keepalive-timeout=2m name=default \
open-status-page=always shared-users=1 status-autorefresh=1m \
transparent-proxy=yes
/ip ipsec proposal
set default auth-algorithms=sha1 disabled=no enc-algorithms=3des lifetime=30m \
name=default pfs-group=modp1024
/ip pool
add name=pool1 ranges=10.10.10.2-10.10.10.254
/port
set 0 baud-rate=9600 data-bits=8 flow-control=none name=serial0 parity=none \
stop-bits=1
set 1 baud-rate=9600 data-bits=8 flow-control=none name=serial1 parity=none \
stop-bits=1
/ppp profile
set default change-tcp-mss=yes comment=32/64 dns-server=198.6.1.3 \
local-address=10.10.10.1 name=default only-one=default rate-limit=32k/64k \
remote-address=pool1 use-compression=default use-encryption=default \
use-vj-compression=default
add change-tcp-mss=default comment="" local-address=10.10.10.1 name=64/128 \
only-one=default rate-limit=32k/128k remote-address=pool1 \
use-compression=default use-encryption=default use-vj-compression=default
add change-tcp-mss=default comment="" local-address=10.10.10.1 name=64/256 \
only-one=default rate-limit=32k/180k remote-address=pool1 \
use-compression=default use-encryption=default use-vj-compression=default
add change-tcp-mss=default comment="" local-address=10.10.10.1 name=64/512 \
only-one=default rate-limit=64k/400k remote-address=pool1 \
use-compression=default use-encryption=default use-vj-compression=default
add change-tcp-mss=default comment="" local-address=10.10.10.1 name=64/200 \
only-one=default rate-limit=32k/128k remote-address=pool1 \
use-compression=default use-encryption=default use-vj-compression=default
add change-tcp-mss=default comment="" local-address=10.10.10.1 name=64/2566 \
only-one=default rate-limit=64k/256k remote-address=pool1 \
use-compression=default use-encryption=default use-vj-compression=default
set default-encryption change-tcp-mss=yes comment="" name=default-encryption \
only-one=default use-compression=default use-encryption=yes \
use-vj-compression=default
/queue type
set default kind=pfifo name=default pfifo-limit=50
set ethernet-default kind=pfifo name=ethernet-default pfifo-limit=50
set wireless-default kind=sfq name=wireless-default sfq-allot=1514 \
sfq-perturb=5
set synchronous-default kind=red name=synchronous-default red-avg-packet=1000 \
red-burst=20 red-limit=60 red-max-threshold=50 red-min-threshold=10
set hotspot-default kind=sfq name=hotspot-default sfq-allot=1514 sfq-perturb=\
5
add kind=pcq name=PCQ_download pcq-classifier=dst-address pcq-limit=50 \
pcq-rate=0 pcq-total-limit=2000
add kind=pcq name=PCQ_upload pcq-classifier=src-address pcq-limit=50 \
pcq-rate=64000 pcq-total-limit=2000
set default-small kind=pfifo name=default-small pfifo-limit=10
/queue simple
add burst-limit=0/0 burst-threshold=0/0 burst-time=0s/0s comment="" \
direction=both disabled=yes dst-address=0.0.0.0/0 limit-at=128000/64000 \
max-limit=512000/64000 name=Day parent=none priority=8 queue=\
default-small/default-small target-addresses=192.129.0.0/24 total-queue=\
default-small
add burst-limit=0/0 burst-threshold=0/0 burst-time=0s/0s comment="" \
direction=both disabled=yes dst-address=0.0.0.0/0 limit-at=128000/64000 \
max-limit=256000/64000 name=Night parent=none priority=8 queue=\
default-small/default-small target-addresses=192.129.0.0/24 total-queue=\
default-small
add burst-limit=0/0 burst-threshold=0/0 burst-time=0s/0s comment="" \
direction=both disabled=yes dst-address=0.0.0.0/0 interface=all limit-at=\
0/0 max-limit=64000/256000 name="from 12 am to 3 pm" parent=none \
priority=8 queue=default-small/default-small total-queue=default-small
add burst-limit=0/0 burst-threshold=0/0 burst-time=0s/0s comment="" \
direction=both disabled=yes dst-address=0.0.0.0/0 interface=all limit-at=\
0/0 max-limit=64000/128000 name="from 3pm to 12 am" parent=none priority=\
8 queue=default-small/default-small total-queue=default-small
/queue tree
add burst-limit=0 burst-threshold=0 burst-time=0s disabled=yes limit-at=0 \
max-limit=0 name=queue1 packet-mark=all parent=global-in priority=8 \
queue=PCQ_download
add burst-limit=0 burst-threshold=0 burst-time=0s disabled=yes limit-at=0 \
max-limit=0 name=queue2 packet-mark=all parent=global-out priority=8 \
queue=PCQ_upload
/routing bgp instance
set default as=1 client-to-client-reflection=yes comment="" disabled=no \
ignore-as-path-len=no name=default out-filter="" redistribute-connected=\
no redistribute-ospf=no redistribute-other-bgp=no redistribute-rip=no \
redistribute-static=no router-id=0.0.0.0
/routing ospf area
add area-id=0.0.0.0 authentication=none disabled=no name=backbone type=\
default
/snmp
set contact="" enabled=no engine-boots=0 engine-id="" location="" \
time-window=15 trap-sink=0.0.0.0 trap-version=1
/snmp community
set public address=0.0.0.0/0 authentication-password="" \
authentication-protocol=MD5 encryption-password="" encryption-protocol=\
DES name=public read-access=yes security=none write-access=no
/system logging action
set memory memory-lines=100 memory-stop-on-full=no name=memory target=memory
set disk disk-lines=100 disk-stop-on-full=no name=disk target=disk
set echo name=echo remember=yes target=echo
set remote name=remote remote=0.0.0.0:514 target=remote
/system routerboard settings
set baud-rate=115200 boot-delay=2s boot-device=nand-if-fail-then-ethernet \
boot-protocol=bootp cpu-frequency=175MHz cpu-mode=power-save \
enable-jumper-reset=yes enter-setup-on=any-key
set baud-rate=115200 boot-delay=2s boot-device=nand-if-fail-then-ethernet \
boot-protocol=bootp cpu-frequency=175MHz cpu-mode=power-save \
enable-jumper-reset=yes enter-setup-on=any-key
/user group
add name=read policy="local,telnet,ssh,reboot,read,test,winbox,password,web,sn\
iff,!ftp,!write,!policy"
add name=write policy="local,telnet,ssh,reboot,read,write,test,winbox,password\
,web,sniff,!ftp,!policy"
add name=full policy="local,telnet,ssh,ftp,reboot,read,write,policy,test,winbo\
x,password,web,sniff"
/user
add address=0.0.0.0/0 comment="system default user" disabled=no group=full \
name=admin
/interface bridge settings
set use-ip-firewall=no use-ip-firewall-for-pppoe=no use-ip-firewall-for-vlan=\
no
/interface ethernet mirror
set mirror-port=none source-port=none
/interface l2tp-server server
set authentication=pap,chap,mschap1,mschap2 default-profile=\
default-encryption enabled=no max-mru=1460 max-mtu=1460 mrru=disabled
/interface ovpn-server server
set auth=sha1,md5 certificate=none cipher=blowfish128,aes128 default-profile=\
default enabled=no keepalive-timeout=60 mac-address=FE:C7:52:61:47:B8 \
max-mtu=1500 mode=ip netmask=24 port=1194 require-client-certificate=no
/interface pppoe-server server
add authentication=pap,chap,mschap1,mschap2 default-profile=64/128 disabled=\
no interface=Fake keepalive-timeout=10 max-mru=1488 max-mtu=1488 \
max-sessions=0 mrru=disabled one-session-per-host=no service-name=pppneww
/interface pptp-server server
set authentication=mschap1,mschap2 default-profile=default-encryption \
enabled=no keepalive-timeout=30 max-mru=1460 max-mtu=1460 mrru=disabled
/interface wireless align
set active-mode=yes audio-max=-20 audio-min=-100 audio-monitor=\
00:00:00:00:00:00 filter-mac=00:00:00:00:00:00 frame-size=300 \
frames-per-second=25 receive-all=no ssid-all=no
/interface wireless sniffer
set channel-time=200ms file-limit=10 file-name="" memory-limit=10 \
multiple-channels=no only-headers=no receive-errors=no streaming-enabled=\
no streaming-max-rate=0 streaming-server=0.0.0.0
/interface wireless snooper
set channel-time=200ms multiple-channels=yes receive-errors=no
/ip accounting
set account-local-traffic=no enabled=no threshold=256
/ip accounting web-access
set accessible-via-web=no address=0.0.0.0/0
/ip address
add address=10.10.10.1/24 broadcast=10.10.10.255 comment="" disabled=no \
interface=Real network=10.10.10.0
add address=192.129.0.3/24 broadcast=192.129.0.255 comment="" disabled=no \
interface=Real network=192.129.0.0
add address=192.166.0.3/24 broadcast=192.166.0.255 comment="" disabled=no \
interface=Real2 network=192.166.0.0
add address=192.168.0.150/24 broadcast=192.168.0.255 comment="" disabled=no \
interface=Realg1 network=192.168.0.0
add address=192.168.23.150/24 broadcast=192.168.23.255 comment="" disabled=no \
interface=Realg2 network=192.168.23.0
add address=192.168.25.150/24 broadcast=192.168.25.255 comment="" disabled=no \
interface=Volcano network=192.168.25.0
add address=192.168.26.155/24 broadcast=192.168.26.255 comment="" disabled=no \
interface=Dilink network=192.168.26.0
add address=192.168.27.150/24 broadcast=192.168.27.255 comment="" disabled=no \
interface=Facebook network=192.168.27.0
add address=192.168.28.150/24 broadcast=192.168.28.255 comment="" disabled=no \
interface=dilink1 network=192.168.28.0
/ip dhcp-server config
set store-leases-disk=5m
/ip dns
set allow-remote-requests=yes cache-max-ttl=1w cache-size=10240KiB \
max-udp-packet-size=512 primary-dns=193.251.135.65 secondary-dns=0.0.0.0
/ip firewall address-list
add address=74.125.232.0/24 comment="" disabled=no list=mtc
/ip firewall connection tracking
set enabled=yes generic-timeout=10m icmp-timeout=10s tcp-close-timeout=10s \
tcp-close-wait-timeout=10s tcp-established-timeout=1d \
tcp-fin-wait-timeout=10s tcp-last-ack-timeout=10s \
tcp-syn-received-timeout=5s tcp-syn-sent-timeout=5s tcp-syncookie=no \
tcp-time-wait-timeout=10s udp-stream-timeout=3m udp-timeout=10s
/ip firewall filter
add action=accept chain=forward comment="allow established connection" \
connection-state=established disabled=no
add action=accept chain=forward comment="allow related connections" \
connection-state=related disabled=no
add action=drop chain=forward comment="drop invalid connections" \
connection-state=invalid disabled=no
add action=drop chain=virus comment="Drop Messenger Worm" disabled=no \
dst-port=135-139 protocol=udp
add action=drop chain=virus comment="Drop Blaster Worm" disabled=no dst-port=\
135-139 protocol=tcp
add action=drop chain=virus comment="Drop Blaster Worm" disabled=no dst-port=\
445 protocol=tcp
add action=drop chain=virus comment="Drop Blaster Worm" disabled=no dst-port=\
445 protocol=udp
add action=drop chain=virus comment=________ disabled=no dst-port=593 \
protocol=tcp
add action=drop chain=virus comment=________ disabled=no dst-port=1024-1030 \
protocol=tcp
add action=drop chain=virus comment="Drop MyDoom" disabled=no dst-port=1080 \
protocol=tcp
add action=drop chain=virus comment=________ disabled=no dst-port=1214 \
protocol=tcp
add action=drop chain=virus comment="ndm requester" disabled=no dst-port=1363 \
protocol=tcp
add action=drop chain=virus comment="ndm server" disabled=no dst-port=1364 \
protocol=tcp
add action=drop chain=virus comment="screen cast" disabled=no dst-port=1368 \
protocol=tcp
add action=drop chain=virus comment=hromgrafx disabled=no dst-port=1373 \
protocol=tcp
add action=drop chain=virus comment=cichlid disabled=no dst-port=1377 \
protocol=tcp
add action=drop chain=virus comment=Worm disabled=no dst-port=1433-1434 \
protocol=tcp
add action=drop chain=virus comment="Bagle Virus" disabled=no dst-port=2745 \
protocol=tcp
add action=drop chain=virus comment="Drop Dumaru.Y" disabled=no dst-port=2283 \
protocol=tcp
add action=drop chain=virus comment="Drop Beagle" disabled=no dst-port=2535 \
protocol=tcp
add action=drop chain=virus comment="Drop Beagle.C-K" disabled=no dst-port=\
2745 protocol=tcp
add action=drop chain=virus comment="Drop MyDoom" disabled=no dst-port=\
3127-3128 protocol=tcp
add action=drop chain=virus comment="Drop Backdoor OptixPro" disabled=no \
dst-port=3410 protocol=tcp
add action=drop chain=virus comment=Worm disabled=no dst-port=4444 protocol=\
tcp
add action=drop chain=virus comment=Worm disabled=no dst-port=4444 protocol=\
udp
add action=drop chain=virus comment="Drop Sasser" disabled=no dst-port=5554 \
protocol=tcp
add action=drop chain=virus comment="Drop Beagle.B" disabled=no dst-port=8866 \
protocol=tcp
add action=drop chain=virus comment="Drop Dabber.A-B" disabled=no dst-port=\
9898 protocol=tcp
add action=drop chain=virus comment="Drop Dumaru.Y" disabled=no dst-port=\
10000 protocol=tcp
add action=drop chain=virus comment="Drop MyDoom.B" disabled=no dst-port=\
10080 protocol=tcp
add action=drop chain=virus comment="Drop NetBus" disabled=no dst-port=12345 \
protocol=tcp
add action=drop chain=virus comment="Drop Kuang2" disabled=no dst-port=17300 \
protocol=tcp
add action=drop chain=virus comment="Drop SubSeven" disabled=no dst-port=\
27374 protocol=tcp
add action=drop chain=virus comment="Drop PhatBot, Agobot, Gaobot" disabled=\
no dst-port=65506 protocol=tcp
add action=jump chain=forward comment="jump to the virus chain" disabled=no \
jump-target=virus
add action=accept chain=forward comment="Allow HTTP" disabled=no dst-port=80 \
protocol=tcp
add action=accept chain=forward comment="Allow SMTP" disabled=no dst-port=25 \
protocol=tcp
add action=accept chain=forward comment="" disabled=no protocol=tcp
add action=accept chain=forward comment="allow ping" disabled=no protocol=\
icmp
add action=accept chain=forward comment="allow udp" disabled=no protocol=udp
add action=drop chain=forward comment="drop everything else" disabled=no
add action=accept chain=input comment="" disabled=no src-address-list=mtc
/ip firewall mangle
add action=mark-routing chain=prerouting comment=GroupA disabled=no \
new-routing-mark="Group A" passthrough=no src-address=10.10.10.0/27
add action=mark-routing chain=prerouting comment=GroupB disabled=no \
new-routing-mark=GroupB passthrough=no src-address=10.10.10.32/27
add action=mark-routing chain=prerouting comment="Group C" disabled=no \
new-routing-mark="Group C" passthrough=no src-address=10.10.10.64/27
add action=mark-routing chain=prerouting comment="Group D" disabled=no \
new-routing-mark="Group D" passthrough=no src-address=10.10.10.96/27
add action=mark-routing chain=prerouting comment="Group E" disabled=no \
new-routing-mark="Group E" passthrough=no src-address=10.10.10.128/27
add action=mark-routing chain=prerouting comment="Group F" disabled=no \
new-routing-mark="Group F" passthrough=no src-address=10.10.10.160/27
add action=mark-routing chain=prerouting comment="Group G" disabled=no \
new-routing-mark="Group G" passthrough=no src-address=10.10.10.192/27
add action=mark-routing chain=prerouting comment="Group H" disabled=no \
new-routing-mark="Group H" passthrough=no src-address=10.10.10.224/27
add action=mark-connection chain=forward comment="" connection-state=new \
disabled=yes dst-address=69.63.181.0/24 dst-port=80 in-interface=dilink1 \
new-connection-mark=facebook1 passthrough=no protocol=tcp src-address=\
10.10.10.224/27 src-address-list=facebook1
add action=mark-packet chain=forward comment="" connection-mark=facebook1 \
disabled=yes dst-address=69.63.190.0/24 new-packet-mark=facebook1 \
passthrough=no src-address=10.10.10.224/27
/ip firewall nat
add action=src-nat chain=srcnat comment="" disabled=yes out-interface=dilink1 \
src-address=10.10.10.224/27 to-addresses=74.125.232.0-74.125.232.255
add action=masquerade chain=srcnat comment="" disabled=no src-address=\
10.10.10.0/27
add action=masquerade chain=srcnat comment="" disabled=no src-address=\
10.10.10.32/27
add action=masquerade chain=srcnat comment="" disabled=no src-address=\
10.10.10.64/27
add action=masquerade chain=srcnat comment="" disabled=no src-address=\
10.10.10.96/27
add action=masquerade chain=srcnat comment="" disabled=no src-address=\
10.10.10.128/27
add action=masquerade chain=srcnat comment="" disabled=no src-address=\
10.10.10.160/27
add action=masquerade chain=srcnat comment="" disabled=no src-address=\
10.10.10.192/27
add action=masquerade chain=srcnat comment="" disabled=no src-address=\
10.10.10.224/27
/ip firewall service-port
set ftp disabled=no ports=21
set tftp disabled=no ports=69
set irc disabled=no ports=6667
set h323 disabled=no
set sip disabled=no ports=5060,5061
set pptp disabled=no
/ip hotspot service-port
set ftp disabled=no ports=21
/ip neighbor discovery
set Real discover=yes
set Real2 discover=yes
set Realg1 discover=yes
set Realg2 discover=yes
set Fake discover=yes
set Dilink discover=yes
set Volcano discover=yes
set Facebook discover=yes
set dilink1 discover=yes
/ip proxy
set always-from-cache=no cache-administrator=webmaster cache-hit-dscp=4 \
cache-on-disk=no enabled=no max-cache-size=none max-client-connections=\
600 max-fresh-time=3d max-server-connections=600 parent-proxy=0.0.0.0 \
parent-proxy-port=0 port=8080 serialize-connections=no src-address=\
0.0.0.0
/ip proxy access
add action=deny comment="block telnet & spam e-mail relaying" disabled=no \
dst-port=23-25
/ip proxy cache
add action=deny comment="" disabled=no dst-host=":cgi-bin \\\?"
/ip route
add check-gateway=ping comment="" disabled=no distance=1 dst-address=\
0.0.0.0/0 gateway=192.166.0.1 routing-mark=GroupB scope=255 target-scope=\
10
add check-gateway=ping comment="" disabled=no distance=1 dst-address=\
0.0.0.0/0 gateway=192.129.0.2 routing-mark="Group A" scope=255 \
target-scope=10
add comment="" disabled=no distance=1 dst-address=0.0.0.0/0 gateway=\
192.168.0.1 routing-mark="Group C" scope=255 target-scope=10
add comment="" disabled=no distance=1 dst-address=0.0.0.0/0 gateway=\
192.168.23.1 routing-mark="Group D" scope=255 target-scope=10
add comment="" disabled=no distance=1 dst-address=0.0.0.0/0 gateway=\
192.168.26.1 routing-mark="Group F" scope=30 target-scope=10
add comment="" disabled=no distance=1 dst-address=0.0.0.0/0 gateway=\
192.168.25.1 routing-mark="Group E" scope=30 target-scope=10
add comment="" disabled=no distance=1 dst-address=0.0.0.0/0 gateway=\
192.168.28.1 routing-mark="Group H" scope=30 target-scope=10
add comment="" disabled=no distance=1 dst-address=0.0.0.0/0 gateway=\
192.168.27.1 routing-mark="Group G" scope=30 target-scope=10
/ip service
set telnet address=0.0.0.0/0 disabled=no port=23
set ftp address=0.0.0.0/0 disabled=no port=21
set www address=0.0.0.0/0 disabled=no port=80
set ssh address=0.0.0.0/0 disabled=no port=22
set www-ssl address=91.212.1.252/32 certificate=none disabled=no port=1700
set api address=0.0.0.0/0 disabled=yes port=8728
set winbox address=0.0.0.0/0 disabled=no port=8291
/ip socks
set connection-idle-timeout=2m enabled=no max-connections=200 port=1080
/ip traffic-flow
set active-flow-timeout=30m cache-entries=1k enabled=no \
inactive-flow-timeout=15s interfaces=all
/ip upnp
set allow-disable-external-interface=yes enabled=no show-dummy-rule=yes
/ppp aaa
set accounting=yes interim-update=0s use-radius=no
/ppp secret
add caller-id="" comment="" disabled=no limit-bytes-in=0 limit-bytes-out=0 \
name=amaniassadd password=123456ab profile=64/256 remote-address=\
10.10.10.197 routes="" service=pppoe
add caller-id="" comment="" disabled=no limit-bytes-in=0 limit-bytes-out=0 \
name=bareshibtihal11 password=123456ab profile=64/128 remote-address=\
10.10.10.101 routes="" service=pppoe
add caller-id="" comment="" disabled=no limit-bytes-in=0 limit-bytes-out=0 \
name=bareshsilvana password=123456ab profile=64/128 remote-address=\
10.10.10.151 routes="" service=pppoe
add caller-id="" comment="" disabled=no limit-bytes-in=0 limit-bytes-out=0 \
name=hassanghandourr password=123456ab profile=64/256 remote-address=\
10.10.10.165 routes="" service=pppoe
add caller-id="" comment="" disabled=no limit-bytes-in=0 limit-bytes-out=0 \
name=hassansaadd password=123456ab profile=64/256 remote-address=\
10.10.10.54 routes="" service=pppoe
add caller-id="" comment="" disabled=yes limit-bytes-in=0 limit-bytes-out=0 \
name=hichamsaadd password=123456ab profile=64/128 routes="" service=pppoe
add caller-id="" comment="" disabled=no limit-bytes-in=0 limit-bytes-out=0 \
name=housseinzaidann password=123456ab profile=64/256 routes="" service=\
pppoe
add caller-id="" comment="" disabled=no limit-bytes-in=0 limit-bytes-out=0 \
name=husseinberrii password=123456ab profile=64/256 routes="" service=\
pppoe
add caller-id="" comment="" disabled=no limit-bytes-in=0 limit-bytes-out=0 \
name=jowadnanisma3ill password=123456ab profile=64/256 routes="" service=\
pppoe
add caller-id="" comment="" disabled=yes limit-bytes-in=0 limit-bytes-out=0 \
name=jowamalatiehh password=123456ab profile=64/256 routes="" service=\
pppoe
add caller-id="" comment="" disabled=no limit-bytes-in=0 limit-bytes-out=0 \
name=jowhassanmansourr password=123456ab profile=64/256 remote-address=\
10.10.10.57 routes="" service=pppoe
add caller-id="" comment="" disabled=no limit-bytes-in=0 limit-bytes-out=0 \
name=jowsaadaklaitt password=123456ab profile=64/256 remote-address=\
10.10.10.175 routes="" service=pppoe
add caller-id="" comment="" disabled=no limit-bytes-in=0 limit-bytes-out=0 \
name=jowyosra3wadaa password=123456ab profile=64/256 routes="" service=\
pppoe
add caller-id="" comment="" disabled=no limit-bytes-in=0 limit-bytes-out=0 \
name=ma307400092 password=123456ab profile=64/200 routes="" service=pppoe
add caller-id="" comment="" disabled=no limit-bytes-in=0 limit-bytes-out=0 \
name=ma3hadjowayaa password=123456ab profile=64/2566 routes="" service=\
pppoe
add caller-id="" comment="" disabled=no limit-bytes-in=0 limit-bytes-out=0 \
name=majalibaylonn password=123456ab profile=64/256 routes="" service=\
pppoe
add caller-id="" comment="" disabled=no limit-bytes-in=0 limit-bytes-out=0 \
name=majfayez11 password=123456ab profile=64/256 routes="" service=pppoe
add caller-id="" comment="" disabled=no limit-bytes-in=0 limit-bytes-out=0 \
name=majibrahimm password=123456ab profile=64/256 routes="" service=pppoe
add caller-id="" comment="" disabled=no limit-bytes-in=0 limit-bytes-out=0 \
name=majzainabs3adee password=123456ab profile=64/256 routes="" service=\
pppoe
add caller-id="" comment="" disabled=no limit-bytes-in=0 limit-bytes-out=0 \
name=mo5tarkhalill password=123456ab profile=64/256 remote-address=\
10.10.10.199 routes="" service=pppoe
add caller-id="" comment="" disabled=no limit-bytes-in=0 limit-bytes-out=0 \
name=mohmmadsaadd password=123456ab profile=64/128 routes="" service=\
pppoe
add caller-id="" comment="" disabled=no limit-bytes-in=0 limit-bytes-out=0 \
name=ra2edhajalii password=123456ab profile=64/256 remote-address=\
10.10.10.103 routes="" service=pppoe
add caller-id="" comment="" disabled=no limit-bytes-in=0 limit-bytes-out=0 \
name=rana20088 password=123456ab profile=64/128 routes="" service=pppoe
add caller-id="" comment="" disabled=no limit-bytes-in=0 limit-bytes-out=0 \
name=3azza20088 password=123456ab profile=64/256 routes="" service=pppoe
add caller-id="" comment="" disabled=no limit-bytes-in=0 limit-bytes-out=0 \
name=dersilicium66 password=123456ab profile=64/128 remote-address=\
10.10.10.50 routes="" service=pppoe
add caller-id="" comment="" disabled=no limit-bytes-in=0 limit-bytes-out=0 \
name=dersilicium22 password=123456ab profile=64/128 remote-address=\
10.10.10.49 routes="" service=pppoe
add caller-id="" comment="" disabled=no limit-bytes-in=0 limit-bytes-out=0 \
name=dersilicium11 password=123456ab profile=64/128 remote-address=\
10.10.10.99 routes="" service=pppoe
add caller-id="" comment="" disabled=no limit-bytes-in=0 limit-bytes-out=0 \
name=dersilicium33 password=123456ab profile=64/128 remote-address=\
10.10.10.160 routes="" service=pppoe
add caller-id="" comment="" disabled=no limit-bytes-in=0 limit-bytes-out=0 \
name=dersilicium44 password=123456ab profile=64/128 remote-address=\
10.10.10.109 routes="" service=pppoe
add caller-id="" comment="" disabled=no limit-bytes-in=0 limit-bytes-out=0 \
name=dersilicium55 password=123456ab profile=64/128 remote-address=\
10.10.10.100 routes="" service=pppoe
add caller-id="" comment="" disabled=no limit-bytes-in=0 limit-bytes-out=0 \
name=dersilicium77 password=123456ab profile=64/128 remote-address=\
10.10.10.161 routes="" service=pppoe
add caller-id="" comment="" disabled=no limit-bytes-in=0 limit-bytes-out=0 \
name=ma3alihh password=123456ab profile=64/256 routes="" service=pppoe
add caller-id="" comment="" disabled=no limit-bytes-in=0 limit-bytes-out=0 \
name=snet088 password=123456ab profile=64/256 remote-address=10.10.10.168 \
routes="" service=pppoe
add caller-id="" comment="" disabled=no limit-bytes-in=0 limit-bytes-out=0 \
name=snet099 password=123456ab profile=64/256 remote-address=10.10.10.104 \
routes="" service=pppoe
add caller-id="" comment="" disabled=no limit-bytes-in=0 limit-bytes-out=0 \
name=snet100 password=123456ab profile=64/256 remote-address=10.10.10.53 \
routes="" service=pppoe
add caller-id="" comment="" disabled=no limit-bytes-in=0 limit-bytes-out=0 \
name=snet111 password=123456ab profile=64/256 remote-address=10.10.10.212 \
routes="" service=pppoe
add caller-id="" comment="" disabled=no limit-bytes-in=0 limit-bytes-out=0 \
name=snet122 password=123456ab profile=64/256 remote-address=10.10.10.105 \
routes="" service=pppoe
add caller-id="" comment="" disabled=no limit-bytes-in=0 limit-bytes-out=0 \
name=ma3hassanfneshh password=123456ab profile=64/256 routes="" service=\
pppoe
add caller-id="" comment="" disabled=no limit-bytes-in=0 limit-bytes-out=0 \
name=ma3ibrahimfneishh password=123456ab profile=64/256 routes="" \
service=pppoe
add caller-id="" comment="" disabled=no limit-bytes-in=0 limit-bytes-out=0 \
name=ma3jamalfnyshh password=123456ab profile=64/256 routes="" service=\
pppoe
add caller-id="" comment="" disabled=no limit-bytes-in=0 limit-bytes-out=0 \
name=ma3mohamedff password=123456ab profile=64/256 routes="" service=\
pppoe
add caller-id="" comment="" disabled=no limit-bytes-in=0 limit-bytes-out=0 \
name=ma3sh7adi3 password=123456ab profile=64/128 remote-address=\
10.10.10.195 routes="" service=pppoe
add caller-id="" comment="" disabled=no limit-bytes-in=0 limit-bytes-out=0 \
name=ma3sh7adi4 password=123456ab profile=64/128 remote-address=\
10.10.10.91 routes="" service=pppoe
add caller-id="" comment="" disabled=no limit-bytes-in=0 limit-bytes-out=0 \
name=ma3westernn password=123456ab profile=64/256 routes="" service=pppoe
add caller-id="" comment="" disabled=no limit-bytes-in=0 limit-bytes-out=0 \
name=saharhijazee password=123456ab profile=64/256 routes="" service=\
pppoe
add caller-id="" comment="" disabled=no limit-bytes-in=0 limit-bytes-out=0 \
name=silicium1177 password=123456ab profile=64/256 routes="" service=\
pppoe
add caller-id="" comment="" disabled=no limit-bytes-in=0 limit-bytes-out=0 \
name=sleimankashakeshh password=123456ab profile=64/256 remote-address=\
10.10.10.52 routes="" service=pppoe
add caller-id="" comment="" disabled=no limit-bytes-in=0 limit-bytes-out=0 \
name=soukainatradd password=123456ab profile=64/256 routes="" service=\
pppoe
add caller-id="" comment="" disabled=no limit-bytes-in=0 limit-bytes-out=0 \
name=toraliharr password=123456ab profile=64/200 routes="" service=pppoe
add caller-id="" comment="" disabled=no limit-bytes-in=0 limit-bytes-out=0 \
name=tyrdmmm password=123456ab profile=64/128 remote-address=10.10.10.46 \
routes="" service=pppoe
add caller-id="" comment="" disabled=no limit-bytes-in=0 limit-bytes-out=0 \
name=tyrdnadinee password=123456ab profile=64/128 remote-address=\
10.10.10.45 routes="" service=pppoe
add caller-id="" comment="" disabled=no limit-bytes-in=0 limit-bytes-out=0 \
name=tyrdmohamadd password=123456ab profile=64/128 remote-address=\
10.10.10.159 routes="" service=pppoe
add caller-id="" comment="" disabled=no limit-bytes-in=0 limit-bytes-out=0 \
name=tyrdmarwan password=123456ab profile=64/128 remote-address=\
10.10.10.201 routes="" service=pppoe
add caller-id="" comment="" disabled=no limit-bytes-in=0 limit-bytes-out=0 \
name=tyrdibrahimm password=123456ab profile=64/128 remote-address=\
10.10.10.97 routes="" service=pppoe
add caller-id="" comment="" disabled=no limit-bytes-in=0 limit-bytes-out=0 \
name=serverma password=123456ab profile=64/256 remote-address=10.10.10.7 \
routes="" service=pppoe
add caller-id="" comment="" disabled=no limit-bytes-in=0 limit-bytes-out=0 \
name=tyrdahmadd password=123456ab profile=64/128 remote-address=\
10.10.10.98 routes="" service=pppoe
add caller-id="" comment="" disabled=no limit-bytes-in=0 limit-bytes-out=0 \
name=tyrdsha password=123456ab profile=64/128 remote-address=10.10.10.94 \
routes="" service=pppoe
add caller-id="" comment="" disabled=no limit-bytes-in=0 limit-bytes-out=0 \
name=tyrdabdallah password=123456ab profile=64/128 remote-address=\
10.10.10.6 routes="" service=pppoe
add caller-id="" comment="" disabled=no limit-bytes-in=0 limit-bytes-out=0 \
name=tyrdhibamogg password=123456ab profile=64/128 remote-address=\
10.10.10.157 routes="" service=pppoe
add caller-id="" comment="" disabled=no limit-bytes-in=0 limit-bytes-out=0 \
name=kassemsh7ade11 password=123456ab profile=64/256 routes="" service=\
pppoe
add caller-id="" comment="" disabled=no limit-bytes-in=0 limit-bytes-out=0 \
name=tyrdh11 password=123456ab profile=64/128 remote-address=10.10.10.12 \
routes="" service=pppoe
add caller-id="" comment="" disabled=no limit-bytes-in=0 limit-bytes-out=0 \
name=ma3alansoserr password=123456ab profile=64/128 remote-address=\
10.10.10.90 routes="" service=pppoe
add caller-id="" comment="" disabled=no limit-bytes-in=0 limit-bytes-out=0 \
name=mo7moh55 password=123456ab profile=64/128 remote-address=\
10.10.10.111 routes="" service=pppoe
add caller-id="" comment="" disabled=no limit-bytes-in=0 limit-bytes-out=0 \
name=tyrdbobb password=123456ab profile=64/200 remote-address=10.10.10.47 \
routes="" service=pppoe
add caller-id="" comment="" disabled=no limit-bytes-in=0 limit-bytes-out=0 \
name=tyrdmss password=123456ab profile=64/128 remote-address=10.10.10.200 \
routes="" service=pppoe
add caller-id="" comment="" disabled=no limit-bytes-in=0 limit-bytes-out=0 \
name=ma3aliherz password=123456ab profile=64/256 remote-address=\
10.10.10.55 routes="" service=pppoe
add caller-id="" comment="" disabled=no limit-bytes-in=0 limit-bytes-out=0 \
name=tyrdsamahh password=123456ab profile=64/128 remote-address=\
10.10.10.95 routes="" service=pppoe
add caller-id="" comment="" disabled=no limit-bytes-in=0 limit-bytes-out=0 \
name=tyrdshourr password=123456ab profile=64/128 remote-address=\
10.10.10.44 routes="" service=pppoe
add caller-id="" comment="" disabled=no limit-bytes-in=0 limit-bytes-out=0 \
name=tyrdrabb password=123456ab profile=64/128 remote-address=\
10.10.10.150 routes="" service=pppoe
add caller-id="" comment="" disabled=no limit-bytes-in=0 limit-bytes-out=0 \
name=tyrdmonirr password=123456ab profile=64/128 remote-address=\
10.10.10.155 routes="" service=pppoe
add caller-id="" comment="" disabled=no limit-bytes-in=0 limit-bytes-out=0 \
name=roronajemm password=123456ab profile=64/256 remote-address=\
10.10.10.13 routes="" service=pppoe
add caller-id="" comment="" disabled=no limit-bytes-in=0 limit-bytes-out=0 \
name=jowabousaleh password=123456ab profile=64/256 remote-address=\
10.10.10.14 routes="" service=pppoe
add caller-id="" comment="" disabled=no limit-bytes-in=0 limit-bytes-out=0 \
name=sleimanqu password=123456ab profile=64/256 routes="" service=pppoe
add caller-id="" comment="" disabled=no limit-bytes-in=0 limit-bytes-out=0 \
name=aymansleimann password=123456ab profile=64/2566 remote-address=\
10.10.10.31 routes="" service=pppoe
add caller-id="" comment="" disabled=no limit-bytes-in=0 limit-bytes-out=0 \
name=fo2adsaadd password=123456ab profile=64/256 remote-address=\
10.10.10.208 routes="" service=pppoe
add caller-id="" comment="" disabled=no limit-bytes-in=0 limit-bytes-out=0 \
name=mohamadkhalill password=123456ab profile=64/512 routes="" service=\
pppoe
add caller-id="" comment="" disabled=no limit-bytes-in=0 limit-bytes-out=0 \
name=fadilee password=123456ab profile=64/128 remote-address=10.10.10.162 \
routes="" service=pppoe
add caller-id="" comment="" disabled=no limit-bytes-in=0 limit-bytes-out=0 \
name=snetg1 password=123456ab profile=64/128 routes="" service=pppoe
add caller-id="" comment="" disabled=no limit-bytes-in=0 limit-bytes-out=0 \
name=snetg2 password=123456ab profile=64/256 routes="" service=pppoe
add caller-id="" comment="" disabled=no limit-bytes-in=0 limit-bytes-out=0 \
name=snetg3 password=123456ab profile=64/256 routes="" service=pppoe
add caller-id="" comment="" disabled=no limit-bytes-in=0 limit-bytes-out=0 \
name=snetg4 password=123456ab profile=64/128 routes="" service=pppoe
add caller-id="" comment="" disabled=no limit-bytes-in=0 limit-bytes-out=0 \
name=snetg5 password=123456ab profile=64/128 routes="" service=pppoe
add caller-id="" comment="" disabled=no limit-bytes-in=0 limit-bytes-out=0 \
name=snetg7 password=123456ab profile=64/128 routes="" service=pppoe
add caller-id="" comment="" disabled=no limit-bytes-in=0 limit-bytes-out=0 \
name=snetg8 password=123456ab profile=64/128 routes="" service=pppoe
add caller-id="" comment="" disabled=no limit-bytes-in=0 limit-bytes-out=0 \
name=snetg9 password=123456ab profile=64/128 routes="" service=pppoe
add caller-id="" comment="" disabled=no limit-bytes-in=0 limit-bytes-out=0 \
name=snetg10 password=123456ab profile=64/128 routes="" service=pppoe
add caller-id="" comment="" disabled=no limit-bytes-in=0 limit-bytes-out=0 \
name=snetg11 password=123456ab profile=64/128 routes="" service=pppoe
add caller-id="" comment="" disabled=no limit-bytes-in=0 limit-bytes-out=0 \
name=snetg12 password=123456ab profile=64/128 routes="" service=pppoe
add caller-id="" comment="" disabled=no limit-bytes-in=0 limit-bytes-out=0 \
name=snetg13 password=123456ab profile=64/128 routes="" service=pppoe
add caller-id="" comment="" disabled=no limit-bytes-in=0 limit-bytes-out=0 \
name=snetg14 password=123456ab profile=64/256 remote-address=10.10.10.16 \
routes="" service=pppoe
add caller-id="" comment="" disabled=no limit-bytes-in=0 limit-bytes-out=0 \
name=jowmohmadhawiii password=123456ab profile=64/256 routes="" service=\
pppoe
add caller-id="" comment="" disabled=no limit-bytes-in=0 limit-bytes-out=0 \
name=majshawki password=123456ab profile=64/256 routes="" service=pppoe
add caller-id="" comment="" disabled=no limit-bytes-in=0 limit-bytes-out=0 \
name=hajnour password=123456ab profile=64/128 remote-address=10.10.10.209 \
routes="" service=pppoe
add caller-id="" comment="" disabled=no limit-bytes-in=0 limit-bytes-out=0 \
name=lylaserver password=123456ab profile=64/256 routes="" service=pppoe
add caller-id="" comment="" disabled=no limit-bytes-in=0 limit-bytes-out=0 \
name=mahmoudfnych password=123456ab profile=64/128 routes="" service=\
pppoe
add caller-id="" comment="" disabled=no limit-bytes-in=0 limit-bytes-out=0 \
name=aliberrii password=123456ab profile=64/256 routes="" service=pppoe
add caller-id="" comment="" disabled=no limit-bytes-in=0 limit-bytes-out=0 \
name=ma3hadjwaya password=123456ab profile=64/2566 remote-address=\
10.10.10.169 routes="" service=pppoe
add caller-id="" comment="" disabled=no limit-bytes-in=0 limit-bytes-out=0 \
name=jowibrahimm password=123456ab profile=64/256 remote-address=\
10.10.10.102 routes="" service=pppoe
add caller-id="" comment="" disabled=no limit-bytes-in=0 limit-bytes-out=0 \
name=dermohamadkassir password=123456ab profile=64/256 remote-address=\
10.10.10.163 routes="" service=pppoe
add caller-id="" comment="" disabled=no limit-bytes-in=0 limit-bytes-out=0 \
name=jowatwee password=123456ab profile=64/128 remote-address=\
10.10.10.106 routes="" service=pppoe
add caller-id="" comment="" disabled=no limit-bytes-in=0 limit-bytes-out=0 \
name=jowfadiaa password=123456ab profile=64/128 remote-address=\
10.10.10.143 routes="" service=pppoe
add caller-id="" comment="" disabled=no limit-bytes-in=0 limit-bytes-out=0 \
name=redanajem password=123456ab profile=64/256 remote-address=\
10.10.10.211 routes="" service=pppoe
add caller-id="" comment="" disabled=no limit-bytes-in=0 limit-bytes-out=0 \
name=salmanroumie password=123456ab profile=64/256 remote-address=\
10.10.10.167 routes="" service=pppoe
add caller-id="" comment="" disabled=yes limit-bytes-in=0 limit-bytes-out=0 \
name=haditrad password=123456ab profile=64/2566 remote-address=\
10.10.10.164 routes="" service=pppoe
add caller-id="" comment="" disabled=no limit-bytes-in=0 limit-bytes-out=0 \
name=tareksrour1 password=123456ab profile=64/256 remote-address=\
10.10.10.158 routes="" service=pppoe
add caller-id="" comment="" disabled=no limit-bytes-in=0 limit-bytes-out=0 \
name=majmahdi password=123456ab profile=64/2566 routes="" service=pppoe
add caller-id="" comment="" disabled=yes limit-bytes-in=0 limit-bytes-out=0 \
name=mahmoudibrahim password=123456ab profile=64/256 routes="" service=\
pppoe
add caller-id="" comment="" disabled=no limit-bytes-in=0 limit-bytes-out=0 \
name=olfat123 password=123456ab profile=64/256 remote-address=10.10.10.41 \
routes="" service=pppoe
add caller-id="" comment="" disabled=no limit-bytes-in=0 limit-bytes-out=0 \
name=fawzi password=123456ab profile=64/128 remote-address=10.10.10.51 \
routes="" service=pppoe
add caller-id="" comment="" disabled=yes limit-bytes-in=0 limit-bytes-out=0 \
name=ma3sh7adi5 password=123456ab profile=64/128 routes="" service=pppoe
add caller-id="" comment="" disabled=no limit-bytes-in=0 limit-bytes-out=0 \
name=mkhalilm7ata password=123456ab profile=64/256 remote-address=\
10.10.10.18 routes="" service=pppoe
add caller-id="" comment="" disabled=no limit-bytes-in=0 limit-bytes-out=0 \
name=mahmoudfnaysh password=123456ab profile=64/128 remote-address=\
10.10.10.93 routes="" service=pppoe
add caller-id="" comment="" disabled=no limit-bytes-in=0 limit-bytes-out=0 \
name=aliajami password=123456ab profile=64/128 remote-address=10.10.10.92 \
routes="" service=pppoe
add caller-id="" comment="" disabled=no limit-bytes-in=0 limit-bytes-out=0 \
name=haidartaleb password=123456ab profile=64/256 remote-address=\
10.10.10.196 routes="" service=pppoe
add caller-id="" comment="" disabled=no limit-bytes-in=0 limit-bytes-out=0 \
name=kassemhijaze password=123456ab profile=64/128 remote-address=\
10.10.10.207 routes="" service=pppoe
add caller-id="" comment="" disabled=no limit-bytes-in=0 limit-bytes-out=0 \
name=tyrdmm2 password=123456ab profile=64/128 remote-address=10.10.10.156 \
routes="" service=pppoe
add caller-id="" comment="" disabled=no limit-bytes-in=0 limit-bytes-out=0 \
name=majnemat password=123456ab profile=64/256 routes="" service=pppoe
add caller-id="" comment="" disabled=no limit-bytes-in=0 limit-bytes-out=0 \
name=majnematt password=123456ab profile=64/256 routes="" service=pppoe
add caller-id="" comment="" disabled=no limit-bytes-in=0 limit-bytes-out=0 \
name=ma3western password=123456ab profile=64/256 routes="" service=pppoe
add caller-id="" comment="" disabled=no limit-bytes-in=0 limit-bytes-out=0 \
name=tyrdsamirr password=123456ab profile=64/128 remote-address=\
10.10.10.154 routes="" service=pppoe
add caller-id="" comment="" disabled=no limit-bytes-in=0 limit-bytes-out=0 \
name=tyrdhomee password=123456ab profile=64/256 remote-address=\
10.10.10.43 routes="" service=pppoe
add caller-id="" comment="" disabled=no limit-bytes-in=0 limit-bytes-out=0 \
name=ma3fnych9 password=123456ab profile=64/128 remote-address=\
10.10.10.58 routes="" service=pppoe
add caller-id="" comment="" disabled=no limit-bytes-in=0 limit-bytes-out=0 \
name=ma3fnych10 password=123456ab profile=64/128 remote-address=\
10.10.10.60 routes="" service=pppoe
add caller-id="" comment="" disabled=no limit-bytes-in=0 limit-bytes-out=0 \
name=mohamadjradi password=123456ab profile=64/256 remote-address=\
10.10.10.166 routes="" service=pppoe
add caller-id="" comment="" disabled=no limit-bytes-in=0 limit-bytes-out=0 \
name=estazkassem password=123456ab profile=64/128 remote-address=\
10.10.10.198 routes="" service=pppoe
add caller-id="" comment="" disabled=no limit-bytes-in=0 limit-bytes-out=0 \
name=ma3sh7adi2 password=123456ab profile=64/128 remote-address=\
10.10.10.152 routes="" service=pppoe
add caller-id="" comment="" disabled=no limit-bytes-in=0 limit-bytes-out=0 \
name=ma3sh7adi1 password=123456ab profile=64/128 remote-address=\
10.10.10.42 routes="" service=pppoe
add caller-id="" comment="" disabled=no limit-bytes-in=0 limit-bytes-out=0 \
name=hijazima3rob password=123456ab profile=64/128 remote-address=\
10.10.10.139 routes="" service=pppoe
add caller-id="" comment="" disabled=no limit-bytes-in=0 limit-bytes-out=0 \
name=snetma7al password=123456ab profile=64/256 routes="" service=pppoe
add caller-id="" comment="" disabled=no limit-bytes-in=0 limit-bytes-out=0 \
name=aliismail password=123456ab profile=64/256 remote-address=10.10.10.9 \
routes="" service=pppoe
add caller-id="" comment="" disabled=no limit-bytes-in=0 limit-bytes-out=0 \
name=mohamadfakih password=123456ab profile=64/256 routes="" service=\
pppoe
add caller-id="" comment="" disabled=no limit-bytes-in=0 limit-bytes-out=0 \
name=hometp password=123456ab profile=64/256 routes="" service=pppoe
add caller-id="" comment="" disabled=no limit-bytes-in=0 limit-bytes-out=0 \
name=r1 password=123456ab profile=64/256 remote-address=10.10.10.28 \
routes="" service=pppoe
add caller-id="" comment="" disabled=no limit-bytes-in=0 limit-bytes-out=0 \
name=r2 password=123456ab profile=64/256 remote-address=10.10.10.33 \
routes="" service=pppoe
add caller-id="" comment="" disabled=no limit-bytes-in=0 limit-bytes-out=0 \
name=r3 password=123456ab profile=64/256 remote-address=10.10.10.66 \
routes="" service=pppoe
add caller-id="" comment="" disabled=no limit-bytes-in=0 limit-bytes-out=0 \
name=r4 password=123456ab profile=64/256 remote-address=10.10.10.118 \
routes="" service=pppoe
add caller-id="" comment="" disabled=no limit-bytes-in=0 limit-bytes-out=0 \
name=ma3ahmadsh7adii password=123456ab profile=64/256 remote-address=\
10.10.10.107 routes="" service=pppoe
add caller-id="" comment="" disabled=no limit-bytes-in=0 limit-bytes-out=0 \
name=s1 password=123456ab profile=64/2566 remote-address=10.10.10.59 \
routes="" service=pppoe
add caller-id="" comment="" disabled=no limit-bytes-in=0 limit-bytes-out=0 \
name=s2 password=123456ab profile=64/2566 remote-address=10.10.10.110 \
routes="" service=pppoe
add caller-id="" comment="" disabled=no limit-bytes-in=0 limit-bytes-out=0 \
name=s3 password=123456ab profile=64/2566 remote-address=10.10.10.172 \
routes="" service=pppoe
add caller-id="" comment="" disabled=no limit-bytes-in=0 limit-bytes-out=0 \
name=s4 password=123456ab profile=64/2566 remote-address=10.10.10.194 \
routes="" service=pppoe
add caller-id="" comment="" disabled=no limit-bytes-in=0 limit-bytes-out=0 \
name=tyrdh22 password=123456ab profile=64/128 remote-address=10.10.10.203 \
routes="" service=pppoe
add caller-id="" comment="" disabled=no limit-bytes-in=0 limit-bytes-out=0 \
name=moussatrad1 password=123456ab profile=64/2566 remote-address=\
10.10.10.164 routes="" service=pppoe
add caller-id="" comment="" disabled=no limit-bytes-in=0 limit-bytes-out=0 \
name=mahmoudmoustafa password=123456ab profile=64/256 remote-address=\
10.10.10.189 routes="" service=pppoe
add caller-id="" comment="" disabled=no limit-bytes-in=0 limit-bytes-out=0 \
name=mahmoudmostafa2 password=123456ab profile=64/256 remote-address=\
10.10.10.189 routes="" service=pppoe
add caller-id="" comment="" disabled=no limit-bytes-in=0 limit-bytes-out=0 \
name=account password=123456ab profile=64/256 remote-address=10.10.10.171 \
routes="" service=pppoe
add caller-id="" comment="" disabled=no limit-bytes-in=0 limit-bytes-out=0 \
name=ws1 password=123456ab profile=64/256 remote-address=10.10.10.56 \
routes="" service=pppoe
add caller-id="" comment="" disabled=no limit-bytes-in=0 limit-bytes-out=0 \
name=ws2 password=123456ab profile=64/256 remote-address=10.10.10.108 \
routes="" service=pppoe
add caller-id="" comment="" disabled=no limit-bytes-in=0 limit-bytes-out=0 \
name=ws3 password=123456ab profile=64/256 remote-address=10.10.10.170 \
routes="" service=pppoe
add caller-id="" comment="" disabled=yes limit-bytes-in=0 limit-bytes-out=0 \
name=missek password=123456ab profile=64/128 remote-address=10.10.10.16 \
routes="" service=pppoe
add caller-id="" comment="" disabled=no limit-bytes-in=0 limit-bytes-out=0 \
name=tyrdnew1 password=123456ab profile=64/128 remote-address=\
10.10.10.205 routes="" service=pppoe
add caller-id="" comment="" disabled=no limit-bytes-in=0 limit-bytes-out=0 \
name=satsryfa password=123456ab profile=64/128 remote-address=10.10.10.40 \
routes="" service=pppoe
add caller-id="" comment="" disabled=no limit-bytes-in=0 limit-bytes-out=0 \
name=jowalifawazz password=123456ab profile=64/256 remote-address=\
10.10.10.206 routes="" service=pppoe
add caller-id="" comment="" disabled=no limit-bytes-in=0 limit-bytes-out=0 \
name=account1 password=123456ab profile=64/256 remote-address=\
10.10.10.239 routes="" service=pppoe
add caller-id="" comment="" disabled=no limit-bytes-in=0 limit-bytes-out=0 \
name=maze7company5 password=123456ab profile=64/2566 remote-address=\
10.10.10.213 routes="" service=pppoe
add caller-id="" comment="" disabled=no limit-bytes-in=0 limit-bytes-out=0 \
name=haifaalhaj password=123456ab profile=64/256 remote-address=\
10.10.10.141 routes="" service=pppoe
add caller-id="" comment="" disabled=no limit-bytes-in=0 limit-bytes-out=0 \
name=fatmefaraj password=123456ab profile=64/256 remote-address=\
10.10.10.173 routes="" service=pppoe
add caller-id="" comment="" disabled=no limit-bytes-in=0 limit-bytes-out=0 \
name=jowhala1 password=123456ab profile=64/256 remote-address=\
10.10.10.117 routes="" service=pppoe
add caller-id="" comment="" disabled=no limit-bytes-in=0 limit-bytes-out=0 \
name=jowhala2 password=123456ab profile=64/256 remote-address=\
10.10.10.116 routes="" service=pppoe
add caller-id="" comment="" disabled=no limit-bytes-in=0 limit-bytes-out=0 \
name=tp1 password=123456 profile=64/256 routes="" service=pppoe
add caller-id="" comment="" disabled=no limit-bytes-in=0 limit-bytes-out=0 \
name=tyrdnew2 password=123456ab profile=64/256 remote-address=10.10.10.62 \
routes="" service=pppoe
add caller-id="" comment="" disabled=no limit-bytes-in=0 limit-bytes-out=0 \
name=ma7al password=123456 profile=64/512 remote-address=10.10.10.246 \
routes="" service=pppoe
add caller-id="" comment="" disabled=no limit-bytes-in=0 limit-bytes-out=0 \
name=soso password=123456ab profile=64/128 remote-address=10.10.10.61 \
routes="" service=pppoe
add caller-id="" comment="" disabled=no limit-bytes-in=0 limit-bytes-out=0 \
name=tyrdhadi password=123456ab profile=64/2566 remote-address=\
10.10.10.202 routes="" service=pppoe
add caller-id="" comment="" disabled=no limit-bytes-in=0 limit-bytes-out=0 \
name=dilink password=123456ab profile=64/2566 remote-address=10.10.10.96 \
routes="" service=pppoe
add caller-id="" comment="" disabled=no limit-bytes-in=0 limit-bytes-out=0 \
name=eng1 password=123456ab profile=64/2566 remote-address=10.10.10.21 \
routes="" service=pppoe
add caller-id="" comment="" disabled=no limit-bytes-in=0 limit-bytes-out=0 \
name=snetg6 password=123456ab profile=64/256 routes="" service=pppoe
add caller-id="" comment="" disabled=no limit-bytes-in=0 limit-bytes-out=0 \
name=tyrdnew3 password=123456ab profile=64/256 remote-address=10.10.10.22 \
routes="" service=pppoe
add caller-id="" comment="" disabled=no limit-bytes-in=0 limit-bytes-out=0 \
name=d password=d profile=64/2566 remote-address=10.10.10.26 routes="" \
service=pppoe
add caller-id="" comment="" disabled=no limit-bytes-in=0 limit-bytes-out=0 \
name=tyrdnew5 password=123456ab profile=64/256 remote-address=10.10.10.68 \
routes="" service=pppoe
add caller-id="" comment="" disabled=no limit-bytes-in=0 limit-bytes-out=0 \
name=r8 password=123456ab profile=64/128 remote-address=10.10.10.230 \
routes="" service=pppoe
add caller-id="" comment="" disabled=no limit-bytes-in=0 limit-bytes-out=0 \
name=r5 password=123456ab profile=64/128 remote-address=10.10.10.133 \
routes="" service=pppoe
add caller-id="" comment="" disabled=no limit-bytes-in=0 limit-bytes-out=0 \
name=r6 password=123456ab profile=64/128 remote-address=10.10.10.176 \
routes="" service=pppoe
add caller-id="" comment="" disabled=no limit-bytes-in=0 limit-bytes-out=0 \
name=r7 password=123456ab profile=64/128 remote-address=10.10.10.193 \
routes="" service=pppoe
add caller-id="" comment="" disabled=no limit-bytes-in=0 limit-bytes-out=0 \
name=said1974 password=123456ab profile=64/512 remote-address=10.10.10.8 \
routes="" service=pppoe
add caller-id="" comment="" disabled=no limit-bytes-in=0 limit-bytes-out=0 \
name=jowhassannourdin password=123456ab profile=64/256 remote-address=\
10.10.10.118 routes="" service=pppoe
add caller-id="" comment="" disabled=no limit-bytes-in=0 limit-bytes-out=0 \
name=jjnmohanad password=123456ab profile=64/256 remote-address=\
10.10.10.119 routes="" service=pppoe
/queue interface
set Real queue=ethernet-default
set Real2 queue=ethernet-default
set Realg1 queue=ethernet-default
set Realg2 queue=ethernet-default
set Fake queue=ethernet-default
set Dilink queue=ethernet-default
set Volcano queue=ethernet-default
set Facebook queue=ethernet-default
set dilink1 queue=ethernet-default
/radius incoming
set accept=no port=1700
/routing mme
set bidirectional-timeout=2 gateway-class=none gateway-keepalive=1m \
gateway-selection=no-gateway origination-interval=5s preferred-gateway=\
0.0.0.0 timeout=1m ttl=50
/routing ospf
set distribute-default=never metric-bgp=20 metric-connected=20 \
metric-default=1 metric-rip=20 metric-static=20 mpls-te-area=unspecified \
mpls-te-router-id=unspecified redistribute-bgp=no redistribute-connected=\
no redistribute-rip=no redistribute-static=no router-id=0.0.0.0
/routing rip
set distribute-default=never garbage-timer=2m metric-bgp=1 metric-connected=1 \
metric-default=1 metric-ospf=1 metric-static=1 redistribute-bgp=no \
redistribute-connected=no redistribute-ospf=no redistribute-static=no \
timeout-timer=3m update-timer=30s
/store
add comment="" disabled=no disk=system name=web-proxy1 type=web-proxy
/system clock manual
0.0.0.0 user=""
/system watchdog
set auto-send-supout=no automatic-supout=yes no-ping-delay=5m watch-address=\
none watchdog-timer=yes
/tool bandwidth-server
set allocate-udp-ports-from=2000 authenticate=yes enabled=yes max-sessions=10
/tool e-mail
set from=<> server=0.0.0.0
/tool graphing
set store-every=5min
/tool graphing interface
add allow-address=0.0.0.0/0 disabled=no interface=all store-on-disk=yes
/tool mac-server
add disabled=no interface=all
/tool mac-server ping
set enabled=yes
/tool sniffer
set file-limit=10 file-name="" filter-address1=0.0.0.0/0:0-65535 \
filter-address2=0.0.0.0/0:0-65535 filter-protocol=ip-only filter-stream=\
yes interface=all memory-limit=10 only-headers=no streaming-enabled=no \
streaming-server=0.0.0.0
/user aaa
set accounting=yes default-group=read interim-update=0s use-radius=no
[admin@DS new] >

Dear all,

i tried many ideas (Mangle,nat,address list) to select one isp to go only to www.facebook.com not working


many thx

address list and routing marks.

/ip firewall mangle> print
0 /ip firewall address-list> print

Flags: X - disabled, D - dynamic /ip firewall nat> print

Not working...

many thx,

Hi!

You need to make a route for your routing market packets! (not masquerade! ;-)

so, like:

ip route add dst-address=0.0.0.0/0 gateway=<msn interface> routing-mark=facebook

then facebook marked traffic will go by your selected ISP interface.

You should also add another route with a higher distance so that if that ISP goes offline for any reason, then that traffic will route vioa the backup interface.

(note: you still need your masquerade rule on each interface!)

Cheers!

[admin@DS new] /ip route> print
still same...
what about mangle,nat
plz plz step by stp


many thx,

Hi,

let's see /ip route export

what are you doing to test? are you using web proxy? if so, web proxy may prevent route marks from working because the actual requests will be coming from the router local IP address.

cheers.

I don't see any routes that use routing marks. You need to add routes to the mentioned ISPs each with a different routing mark, that were defined before in mangle.

Dear all,

please look at the pic.

many thanks,

the same problem applies to me. trying the same scenario and not working

any idea please?

how do you test to know if it is working?

also, do you have web proxy running? if so, then traffic will not get marked because your mangle rule only marks traffic with source address of your private subnet.

cheers!

i dont use web proxy
when i put dst-address or address-list no page open

i dont use web proxy
when i put dst-address or address-list no page open

So the routing is working, just that your ISP connection is broken?

Cheers.

yes
what is steps?

steps to diagnose the problem?

well,... traceroute might be a good start.

try running traceroute from the client PC to one of the IP addresses on your mangle list. Watch the mangle rule to observe that the traffic counters tick over as expected. Watch the traceroute to see how far it gets before it stops.

that will at least tell you where to look next! ;-)

Cheers!

ITS not working and the isp connection is good. but does it matter if i have mangle rules (postrouting and prerouting) knowing that they are located under the routing marks. ????

Hi,

I'm sorry, but it really doesn't give us much to work with when you just say "it doesn't work" and "the link is good"! ;-)

Maybe it "doesn't work", but there are 1001 behaviours that can be constituted as 'not working' and if we don't know which one it is, then we can't guess what the right solution might be! Maybe your 'link is good' but if you don't define what you mean by 'good' then what can we do?

So please give us some detail to work with! Did you try a traceroute? did you check that dns resolver works properly? Did you look at the traffic counters on your mangle and masquerade rules? did you watch the traffic charts on your interfaces? did you use torch on your interfaces to see if traffic is there?

If you did any of these things, please help us to help you by telling us your results!

Cheers, Mike.

Dear all,
please look at the picture

Hi,

we need traceroute to one of the addresses in your fb address list - not just to the local host! :-}

have you considered getting in touch with a MT consultant? I get the feeling that you are struggling a bit with some of the basic concepts, and so you may get a much quicker solution if you get in touch with a professional consultant who can work with you directly, and in real time.

http://www.mikrotik.com/consultants.html

cheers