Community discussions

MikroTik App
 
nshchukin
just joined
Topic Author
Posts: 10
Joined: Thu May 02, 2019 1:10 am

How to specify source interface for MikroTik's own requests?

Thu Sep 28, 2023 10:56 pm

Hello,
In one company I set up a geo-distributed network with several sites and providers.
The diagram shows a simplified and anonymized version of the network.

ISP1 - Autonomous System of the 1st provider
ISP1 Forward Network - bridge network to the 1st provider
ISP2 - Autonomous System of the 2nd provider
ISP2 Forward Network - bridge network to the 2nd provider
AS NET - Autonomous System of organization, size /24
AS Subnet1 - the 1st subnet from the organization's Autonomous System, size /25
AS Subnet2 - the 2nd subnet from the organization’s Autonomous System, size /25
Internal Forward Network - a bridge network between MikroTiks with addresses from a private range.

High availability access to Internet is ensured using BGP.
Let's consider the case when the ISP2 provider fails:
In this case Server2 will have access to the Internet through ISP1. The traffic will be routed through MikroTik2 and MikroTik1.

The problem is that in this case MikroTik2 won't have access to the Internet. This is due to the fact that the source IP will have private address from the "Internal Forward Network".

To operate the BGP, each router has a loopback interface with an address from the organization’s autonomous system:
/interface bridge
add comment="BGP loopback1" name=loopback1
Tell me, please, how can I configure it so that all requests from the MikroTiks themselves go through the loopback1 interface? (for DNS-client, NTP-client, ping, system update, etc).
You do not have the required permissions to view the files attached to this post.
 
nshchukin
just joined
Topic Author
Posts: 10
Joined: Thu May 02, 2019 1:10 am

Re: How to specify source interface for MikroTik's own requests?

Fri Sep 29, 2023 10:28 pm

Hi!
I found a solution in the next topic: viewtopic.php?p=669037#p669037
And I adapted the settings to suit my case:
/ip firewall address-list
add address=10.0.0.0/8 list=RFC1918_10
add address=172.16.0.0/12 list=RFC1918_172
add address=192.168.0.0/16 list=RFC1918_192
add address=<AS NET/24> list=ASNet
/ip firewall mangle
add action=mark-connection chain=output comment=own-traffic dst-address-list=!RFC1918_10,RFC1918_192,RFC1918_172,ASNet new-connection-mark=own-traffic out-interface=Internal passthrough=yes
/ip firewall nat
add action=src-nat chain=srcnat connection-mark=own-traffic to-addresses=<loopback1_address>

Who is online

Users browsing this forum: No registered users and 4 guests