Page 1 of 1

OVPN + policy routing issue

Posted: Sun Sep 08, 2019 9:43 pm
by SJB
Hi all; I'd like to post an issue I'm having with my OVPN setup.
Short explanation; I have 2 WAN's , 1 LAN and 1 OVPN connection + PCC load balancing.
When logging into the router (Hex-s)with all WAN's up and running I'm well able to ping an address which is to be reached through the OVPN tunnel (10.0.0.3) only. From any workstation on the LAN however this is impossible (no ping)
If I bring down WAN2 I am able to ping the 10.0.0.3 from any ws. Beats me why this is impossible with both WAN;s running.
What do I need to change to make this 10.0.0.3 / tunnel reachable from the ws at any time with both WAN's up.
If necessary to allocate a WAN to the tunnel I'd like the tunnel to run over WAN_EOLO.

Re: OVPN + policy routing issue

Posted: Mon Sep 09, 2019 2:45 am
by Sob
Either make this your first mangle rule, so connections to 10.0.0.3 won't get marked by PCC:
/ip firewall mangle
add action=accept chain=prerouting in-interface=bridge dst-address=10.0.0.3
Or tell the router that 10.0.0.3 should be only looked up in main routing table, no matter what routing mark will packets have:
/ip route rule
add action=lookup-only-in-table dst-address=10.0.0.3/32 table=main

Re: OVPN + policy routing issue

Posted: Wed Sep 11, 2019 12:09 am
by SJB
Tks, all working well on basis of adding the specific mangle rule upfront.