I have 2 internet connections from 2 separate ISPs
ISP1 with Static IP (Say, 10.11.12.13/24)
ISP2 with PPPoE.(Say user=pppoe_id and password=pppoepass)
And local network is 192.168.77.0/24
I've generated the following script from www.mikrotikwizard.com which is
Code: Select all
# Created by MikroTik configuration wizard v2.9 (www.mikrotikwizard.com)
#
# Configuration Name: Test
# Modified: 2020-01-29 23:18
# Downloaded: 2020-01-30 13:44
#
# wait for interfaces
:local count 0;
:while ([/interface ethernet find] = "") do={
:if ($count = 30) do={
:log warning "mikrotikwizard: Unable to find ethernet interfaces";
/quit;
}
:delay 1s;
:set count ($count +1);
};
# Ports
:global wan1name "";
:global wan2name "";
:global tmp1name "";
:global tmp2name "";
:foreach k in=[/interface ethernet find] do={
if ($tmp1name = "") do={
:set tmp1name [/interface ethernet get $k name];
} else {
:if ($tmp2name = "") do={
:set tmp2name [/interface ethernet get $k name];
}
}
}
/interface list add name=WAN comment="WAN ports"
/ip firewall nat add chain=srcnat out-interface-list=WAN ipsec-policy=out,none action=masquerade comment="masquerade"
:set wan1name ($tmp1name."-wan");
/interface ethernet set [find name="$tmp1name"] name="$wan1name" comment="isp1"
:set wan2name ($tmp2name."-wan2");
/interface ethernet set [find name="$tmp2name"] name="$wan2name"
/interface bridge add name=bridge-local disabled=no auto-mac=yes protocol-mode=rstp;
:delay 1s;
/interface list add name=LAN comment="LAN ports"
:local bMACIsSet 0;
:foreach p in=[/interface ethernet find where !(name~"wan" || name~"bridge")] do={
:local tmpPortName [/interface ethernet get $p name];
:if ($bMACIsSet = 0) do={
:if ([/interface get $p type] = "ether") do={
/interface bridge set "bridge-local" auto-mac=no admin-mac=[/interface ethernet get $tmpPortName mac-address];
:set bMACIsSet 1;
}
}
/interface bridge port add bridge="bridge-local" interface="$tmpPortName";
/interface list member add list=LAN interface=$tmpPortName
}
# WiFi setup
/interface wireless security-profiles set [ find default=yes ] authentication-types=wpa-psk,wpa2-psk eap-methods="" mode=dynamic-keys supplicant-identity="WIFISSID" wpa-pre-shared-key="WIFIPASS" wpa2-pre-shared-key="WIFIPASS"
:foreach p in=[/interface wireless find] do={
:local tmpWName [/interface wireless get $p name];
:local tmpBand [:pick [/interface wireless get $p band] 0 1];
:if ($tmpBand = "5") do={
/interface wireless set $p band=5ghz-a/n/ac channel-width=20/40mhz-Ce wireless-protocol=802.11 frequency=auto mode=ap-bridge ssid="WIFISSID" distance=indoors disabled=no
} else {
/interface wireless set $p band=2ghz-b/g/n channel-width=20/40mhz-Ce wireless-protocol=802.11 frequency=auto mode=ap-bridge ssid="WIFISSID" distance=indoors disabled=no
}
/interface bridge port add bridge=bridge-local interface=$tmpWName
/interface list member add list=LAN interface=$tmpWName
}
# LAN
/ip address add address=192.168.77.1/24 disabled=no interface=bridge-local
/ip pool add name=pool-lan ranges=192.168.77.2-192.168.77.254
/ip dhcp-server add address-pool=pool-lan interface=bridge-local name=dhcp-lan disable=no
/ip dhcp-server network add address=192.168.77.0/24 dns-server=192.168.77.1 gateway=192.168.77.1
# ISP1
/ip address add address=10.11.12.13/24 disabled=no interface=$wan1name
/interface list member add list=WAN interface=$wan1name
# ISP2
/interface pppoe-client add add-default-route=no use-peer-dns=no disabled=no interface=$wan2name name="pppoe-wan2" user=pppoe_id password=pppoepass comment="isp2"
:set wan2name "pppoe-wan2";
/interface list member add list=WAN interface=$wan2name
# Recursive
/ip route add dst-address=8.8.8.8 gateway=10.11.12.1 distance=1 scope=30 comment=isp1
/ip route add dst-address=8.8.4.4 gateway=127.0.0.1 distance=1 scope=30 comment=isp2
/ip route add dst-address=0.0.0.0/0 gateway=8.8.8.8 distance=1 check-gateway=ping target-scope=30
/ip route add dst-address=0.0.0.0/0 gateway=8.8.4.4 distance=2 check-gateway=ping target-scope=30
/ip firewall mangle add action=mark-connection chain=input in-interface=$wan1name new-connection-mark=isp1in_c passthrough=yes
/ip firewall mangle add action=mark-connection chain=input in-interface=$wan2name new-connection-mark=isp2in_c passthrough=yes
/ip firewall mangle add action=mark-routing chain=output connection-mark=isp1in_c new-routing-mark=isp1 passthrough=no
/ip firewall mangle add action=mark-routing chain=output connection-mark=isp2in_c new-routing-mark=isp2 passthrough=no
/ip route add dst-address=0.0.0.0/0 gateway=10.11.12.1 distance=1 routing-mark=isp1 comment=isp1
/ip route add dst-address=0.0.0.0/0 gateway=127.0.0.1 distance=1 routing-mark=isp2 comment=isp2
# Load balancing
/ip firewall mangle add in-interface=bridge-local dst-address-type=!local action=mark-routing chain=prerouting new-routing-mark=isp1lb per-connection-classifier=both-addresses:4/0 comment=isp1-40
/ip firewall mangle add in-interface=bridge-local dst-address-type=!local action=mark-routing chain=prerouting new-routing-mark=isp1lb per-connection-classifier=both-addresses:4/1 comment=isp1-41
/ip firewall mangle add in-interface=bridge-local dst-address-type=!local action=mark-routing chain=prerouting new-routing-mark=isp1lb per-connection-classifier=both-addresses:4/2 comment=isp1-42
/ip firewall mangle add in-interface=bridge-local dst-address-type=!local action=mark-routing chain=prerouting new-routing-mark=isp2lb per-connection-classifier=both-addresses:4/3 comment=isp2-43
/ip route add dst-address=0.0.0.0/0 gateway=8.8.8.8 distance=1 check-gateway=ping target-scope=30 routing-mark=isp1lb
/ip route add dst-address=0.0.0.0/0 gateway=8.8.4.4 distance=2 check-gateway=ping target-scope=30 routing-mark=isp1lb
/ip route add dst-address=0.0.0.0/0 gateway=8.8.4.4 distance=1 check-gateway=ping target-scope=30 routing-mark=isp2lb
/ip route add dst-address=0.0.0.0/0 gateway=8.8.8.8 distance=2 check-gateway=ping target-scope=30 routing-mark=isp2lb
/system scheduler add disabled=no interval=30s name=CheckGateway on-event=CheckGateway
/system script add name=CheckGateway owner=admin policy=ftp,reboot,read,write,policy,test,password,sniff,sensitive source="#Name: CheckGateway v.1\r\
\n#Created by MikroTik configuration wizard (www.mikrotikwizard.com)\r\
\n:local debug false;\r\
\n# isp2 \r\
\n:if ([/interface find comment=isp2] != \"\") do={\r\
\n:local wan2 [/interface get [find comment=isp2] name];\r\
\n:if ( [/interface pppoe-client get \$wan2 running]) do={\r\
\n:local NewGW [/ip address get [find interface=\$wan2] network];\r\
\n:foreach g in=[/ip route find where comment=isp2] do={\r\
\n:local OldGW [/ip route get \$g gateway];\r\
\n:if (\$OldGW!=\$NewGW) do={\r\
\n/ip route set \$g gateway=\$NewGW;\r\
\n:log info \"CheckGateway: isp2 change gateway from \$OldGW to \$NewGW\";\r\
\n} else {\r\
\nif (\$debug) do={:log info \"CheckGateway: isp2 route is not change \$OldGW / \$NewGW\";}\r\
\n}\r\
\n} \r\
\n} else {\r\
\nif (\$debug) do={:log info \"CheckGateway: interface \$wan2 is not ready\";}\r\
\n}\r\
\n} else {\r\
\n:log warning \"CheckGateway: ERROR isp2 interface NOT found\";\r\
\n}\r\
\n \r\
"
# DNS
/ip dns set allow-remote-requests=yes servers=8.8.8.8,8.8.4.4
/ip dns static add address=192.168.77.1 name=router
# Firewall Input
/ip firewall filter add chain=input action=accept connection-state=established,related,untracked comment="Accept established,related,untracked"
/ip firewall filter add chain=input action=drop connection-state=invalid comment="Drop invalid"
/ip firewall filter add chain=input action=accept protocol=icmp comment="Accept ICMP"
/ip firewall filter add chain=input action=accept in-interface=bridge-local comment="Accept all from bridge-local"
/ip firewall filter add chain=input action=accept src-address-list=ManageIP comment="Accept access for ManageIP group"
/ip firewall filter add chain=input action=drop comment="Drop all other"
# Firewall Forward
/ip firewall filter add chain=forward action=fasttrack-connection connection-state=established,related disabled=yes comment="fasttrack"
/ip firewall filter add chain=forward action=accept connection-state=established,related,untracked comment="accept established,related,untracked"
/ip firewall filter add action=drop chain=forward connection-state=invalid comment="Drop invalid"
/ip firewall address-list add address=192.168.77.0/24 list=Internet
/ip firewall filter add chain=forward action=accept in-interface=bridge-local out-interface=$wan1name src-address-list=Internet connection-state=new comment="Accept Internet via ISP1 for Internet group"
/ip firewall address-list add address=192.168.77.0/24 list=Internet2
/ip firewall filter add chain=forward action=accept in-interface=bridge-local out-interface=$wan2name src-address-list=Internet2 connection-state=new comment="Accept Internet via ISP2 for Internet2 group"
/ip firewall filter add chain=forward action=drop comment="Drop all other"
# Other
/system clock set time-zone-autodetect=yes
/ip cloud set ddns-enabled=yes update-time=yes
/ip neighbor discovery-settings set discover-interface-list=LAN
/tool mac-server set allowed-interface-list=LAN
/tool mac-server mac-winbox set allowed-interface-list=LAN
/system identity set name="MyRouter"
# End
- I'm unable to do port forwarding. with this configuration
Say I want to forward 10.11.12.13:443 (of ISP1) to 192.168.77.13:443
I'm using
alsoCode: Select allip firewall nat add chain=dstnat action=dst-nat to-addresses=192.168.77.13 to-ports=443 protocol=tcp dst-port=443
but none of these are working.Code: Select allip firewall nat add action=dst-nat chain=dstnat disabled=no dst-port=443 in-interface=ether1 protocol=tcp to-addresses=192.168.77.13 to-ports=443 - I'm unable to set primary ISP1 as primary WAN of specific host
Such as I want to set ISP1 as the primary wan of 192.168.77.100/24. i.e. it will always communicate via ISP1 until ISP1 is down.
How to do that? - I want local hosts to reach specific remote server via specific wan.
Let's say I always want to reach 1.2.3.4 via ISP1. What shall I do?
Regards
