Community discussions

MikroTik App
 
mafiosa
Member Candidate
Member Candidate
Topic Author
Posts: 266
Joined: Fri Dec 09, 2016 8:10 pm
Location: Kolkata, India
Contact:

Very high CPU usage on PCC Loadbalancing with 7.x

Wed Dec 22, 2021 6:16 pm

I am using RB3011 with two ISPs 140mbps + 105mbps. Router was running 7.1 stable and now 7.1.1 stable. However, with just 245mbps of load balancing the CPU usage increases to 75-85%. Earlier in v6 it was 35-45% maximum. Kindly check my PCC configuration and point out if any of my mangle rules are creating excess stress on the cpu and if any alternate syntax can be used to reduce the load. Also if I want to use fastrack then where should I place the rules for it?
[kalpak@home-lab] /ip/firewall/mangle> print
Flags: X - disabled, I - invalid; D - dynamic
0 chain=prerouting action=mark-connection new-connection-mark=exclude_conn passthrough=yes src-address-list=own-lan dst-address-list=bypass-list log=no log-prefix=""
1 chain=prerouting action=mark-routing new-routing-mark=main passthrough=yes connection-mark=exclude_conn log=no log-prefix=""
2 chain=input action=mark-connection new-connection-mark=abspl_out_conn passthrough=yes in-interface=ether2
3 chain=output action=mark-routing new-routing-mark=abspl-inbound passthrough=no connection-mark=abspl_out_conn
4 chain=input action=mark-connection new-connection-mark=sswl_out_conn passthrough=yes in-interface=ether4
5 chain=output action=mark-routing new-routing-mark=sswl-inbound passthrough=no connection-mark=sswl_out_conn
6 chain=forward action=mark-connection new-connection-mark=abspl_out_pfw passthrough=no connection-state=new in-interface=ether2
7 chain=prerouting action=mark-routing new-routing-mark=abspl-inbound passthrough=no connection-mark=abspl_out_pfw in-interface-list=lans
8 chain=forward action=mark-connection new-connection-mark=sswl_out_pfw passthrough=no connection-state=new in-interface=ether4
9 chain=prerouting action=mark-routing new-routing-mark=sswl-inbound passthrough=no connection-mark=sswl_out_pfw in-interface-list=lans
10 chain=prerouting action=accept in-interface=ether2
11 chain=prerouting action=accept in-interface=ether4
12 chain=prerouting action=mark-connection new-connection-mark=abspl_conn passthrough=yes dst-address-type=!local connection-mark=!exclude_conn per-connection-classifier=both-addresses-and-ports:2/0 log=no log-prefix=""
13 chain=prerouting action=mark-connection new-connection-mark=sswl_conn passthrough=yes dst-address-type=!local connection-mark=!exclude_conn per-connection-classifier=both-addresses-and-ports:2/1 log=no log-prefix=""
14 chain=prerouting action=mark-routing new-routing-mark=abspl-outbound passthrough=yes connection-mark=abspl_conn in-interface-list=lans
15 chain=prerouting action=mark-routing new-routing-mark=sswl-outbound passthrough=yes connection-mark=sswl_conn in-interface-list=lans
 
sindy
Forum Guru
Forum Guru
Posts: 10205
Joined: Mon Dec 04, 2017 9:19 pm

Re: Very high CPU usage on PCC Loadbalancing with 7.x

Sat Dec 25, 2021 12:33 pm

Are you saying that if you disable the load distribution rules completely, the CPU load becomes lower by an order of magnitude?

Second, unless something has dramatically changed about the essence of fasttracking in ROS 7, packets belonging to fasttracked connections bypass mangle rules (and other processing steps not relevant here). So to have fasttracking and load distribution work together, you have to allow only connections via the highest bandwidth WAN to ever get fasttracked.
 
mafiosa
Member Candidate
Member Candidate
Topic Author
Posts: 266
Joined: Fri Dec 09, 2016 8:10 pm
Location: Kolkata, India
Contact:

Re: Very high CPU usage on PCC Loadbalancing with 7.x

Sat Dec 25, 2021 1:18 pm

Are you saying that if you disable the load distribution rules completely, the CPU load becomes lower by an order of magnitude?
Yes!!! it is lot less like with 140mbps it is 20-30% max.
 
mafiosa
Member Candidate
Member Candidate
Topic Author
Posts: 266
Joined: Fri Dec 09, 2016 8:10 pm
Location: Kolkata, India
Contact:

Re: Very high CPU usage on PCC Loadbalancing with 7.x

Sat Dec 25, 2021 1:19 pm

Second, unless something has dramatically changed about the essence of fasttracking in ROS 7, packets belonging to fasttracked connections bypass mangle rules (and other processing steps not relevant here). So to have fasttracking and load distribution work together, you have to allow only connections via the highest bandwidth WAN to ever get fasttracked.
If I enable fasttrack rules then all packets simply bypass the mangle and therefore the PCC loadbalancing.
 
sindy
Forum Guru
Forum Guru
Posts: 10205
Joined: Mon Dec 04, 2017 9:19 pm

Re: Very high CPU usage on PCC Loadbalancing with 7.x

Sat Dec 25, 2021 1:47 pm

Yes!!! it is lot less like with 140mbps it is 20-30% max.
That sounds as if disabling the mangle rules was disabling something else (connection tracking?) as well, so post your complete configuration (hide-sensitive is not necessary any more in ROS 7, the rest of my automatic signature remains valid).

If I enable fasttrack rules then all packets simply bypass the mangle and therefore the PCC loadbalancing.
This is correct. That's why I say you have to allow only connections running via the highest bandwidth uplink to get fasttracked. To do that, assign some connection-mark to the connections leaving via other WANs, and add a connection-mark=no-mark match condition to the action=fasttrack-connection rule.
 
mafiosa
Member Candidate
Member Candidate
Topic Author
Posts: 266
Joined: Fri Dec 09, 2016 8:10 pm
Location: Kolkata, India
Contact:

Re: Very high CPU usage on PCC Loadbalancing with 7.x

Sun Dec 26, 2021 9:54 am

Yes!!! it is lot less like with 140mbps it is 20-30% max.
That sounds as if disabling the mangle rules was disabling something else (connection tracking?) as well, so post your complete configuration (hide-sensitive is not necessary any more in ROS 7, the rest of my automatic signature remains valid).
Here is my config:
# dec/26/2021 13:22:07 by RouterOS 7.2rc1
# software id = 7HJJ-N0I9
#
# model = RouterBOARD 3011UiAS
# serial number = 783D066965C5
/interface bridge
add name=LAN
add name=Loopback
/interface ethernet
set [ find default-name=ether2 ] mac-address=6C:3B:6B:69:69:69
set [ find default-name=ether3 ] mac-address=6C:3B:6B:96:96:96
set [ find default-name=ether4 ] mac-address=6C:3B:6B:99:99:99
/interface l2tp-server
add name=DumDum user=mainak
/interface gre
add !keepalive local-address=10.28.115.18 mtu=1472 name=Madhyamgram \
remote-address=10.14.96.109
/interface list
add name=lans
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
/ip ipsec profile
set [ find default=yes ] enc-algorithm=aes-256 hash-algorithm=sha256
/ip ipsec proposal
set [ find default=yes ] auth-algorithms=sha256 enc-algorithms=\
aes-256-cbc,aes-256-ctr pfs-group=modp2048
/ip pool
add name=dhcp_pool0 ranges=172.22.146.2-172.22.146.62
add name=dhcp_pool1 ranges=172.22.146.66-172.22.146.126
/ip dhcp-server
add address-pool=dhcp_pool0 interface=LAN lease-time=1w name=dhcp1
add address-pool=dhcp_pool1 interface=ether10 lease-time=1w name=dhcp2
/port
set 0 name=serial0
/interface pppoe-client
add ac-name=abs_78 allow=pap disabled=no interface=ether3 name=ABSPL profile=\
default-encryption service-name=abs_78 user=kanika_cenn
/routing ospf instance
add name=ospf-instance-v2
/routing ospf area
add instance=ospf-instance-v2 name=ospf-backbone-v2
add area-id=0.0.0.1 instance=ospf-instance-v2 name=ospf-area-1
add area-id=0.0.0.2 instance=ospf-instance-v2 name=ospf-area-2
/routing table
add disabled=no fib name=abspl-inbound
add disabled=no fib name=sswl-inbound
add disabled=no fib name=abspl-outbound
add disabled=no fib name=sswl-outbound
/zerotier
set zt1 comment="ZeroTier Central controller - https://my.zerotier.com/" \
disabled=yes disabled=yes name=zt1 port=9993
/interface bridge port
add bridge=LAN interface=ether6
add bridge=LAN interface=ether7
add bridge=LAN interface=ether8
add bridge=LAN interface=ether9
/ip neighbor discovery-settings
set discover-interface-list=all
/interface l2tp-server server
set allow-fast-path=yes authentication=pap,chap enabled=yes \
one-session-per-host=yes use-ipsec=yes
/interface list member
add interface=LAN list=lans
add interface=ether5 list=lans
add interface=ether10 list=lans
/interface ovpn-server server
set auth=sha1,md5
/ip address
add address=172.28.55.3/24 interface=ether4 network=172.28.55.0
add address=192.168.72.1/23 interface=ether5 network=192.168.72.0
add address=10.28.115.18/30 interface=ether2 network=10.28.115.16
add address=172.22.146.65/26 interface=ether10 network=172.22.146.64
add address=172.22.146.1/26 interface=LAN network=172.22.146.0
add address=192.168.254.1 interface=Loopback network=192.168.254.1
add address=192.168.168.13/30 interface=Madhyamgram network=192.168.168.12
/ip cloud
set ddns-enabled=yes
/ip dhcp-server network
add address=172.22.146.0/26 gateway=172.22.146.1
add address=172.22.146.64/26 gateway=172.22.146.65
/ip dns
set servers=2407:cb00:c702:dead:beef::7272
/ip firewall address-list
add address=10.0.0.0/8 list=bypass-list
add address=172.16.0.0/12 list=bypass-list
add address=192.168.0.0/16 list=bypass-list
add address=192.168.72.0/23 list=own-lan
add address=172.22.146.0/26 list=own-lan
add address=172.22.146.64/26 list=own-lan
add address=192.168.55.0/29 list=own-lan
add address=4.2.2.0/24 list=bypass-list
/ip firewall mangle
add action=mark-connection chain=prerouting dst-address-list=bypass-list \
new-connection-mark=exclude_conn passthrough=yes src-address-list=own-lan
add action=mark-routing chain=prerouting connection-mark=exclude_conn \
new-routing-mark=main passthrough=yes
add action=mark-connection chain=input in-interface=ether2 \
new-connection-mark=abspl_out_conn passthrough=yes
add action=mark-routing chain=output connection-mark=abspl_out_conn \
new-routing-mark=abspl-inbound passthrough=no
add action=mark-connection chain=input in-interface=ether4 \
new-connection-mark=sswl_out_conn passthrough=yes
add action=mark-routing chain=output connection-mark=sswl_out_conn \
new-routing-mark=sswl-inbound passthrough=no
add action=mark-connection chain=forward connection-state=new in-interface=\
ether2 new-connection-mark=abspl_out_pfw passthrough=no
add action=mark-routing chain=prerouting connection-mark=abspl_out_pfw \
in-interface-list=lans new-routing-mark=abspl-inbound passthrough=no
add action=mark-connection chain=forward connection-state=new in-interface=\
ether4 new-connection-mark=sswl_out_pfw passthrough=no
add action=mark-routing chain=prerouting connection-mark=sswl_out_pfw \
in-interface-list=lans new-routing-mark=sswl-inbound passthrough=no
add action=accept chain=prerouting in-interface=ether2
add action=accept chain=prerouting in-interface=ether4
add action=mark-connection chain=prerouting connection-mark=!exclude_conn \
dst-address-type=!local new-connection-mark=abspl_conn passthrough=yes \
per-connection-classifier=both-addresses-and-ports:2/0
add action=mark-connection chain=prerouting connection-mark=!exclude_conn \
dst-address-type=!local new-connection-mark=sswl_conn passthrough=yes \
per-connection-classifier=both-addresses-and-ports:2/1
add action=mark-routing chain=prerouting connection-mark=abspl_conn \
in-interface-list=lans new-routing-mark=abspl-outbound passthrough=yes
add action=mark-routing chain=prerouting connection-mark=sswl_conn \
in-interface-list=lans new-routing-mark=sswl-outbound passthrough=yes
/ip firewall nat
add action=masquerade chain=srcnat out-interface=ether2
add action=masquerade chain=srcnat out-interface=ether4
add action=masquerade chain=srcnat out-interface=DumDum
add action=dst-nat chain=dstnat dst-address=10.28.115.18 dst-port=8006 \
in-interface=ether2 protocol=tcp to-addresses=192.168.72.2 to-ports=8006
add action=dst-nat chain=dstnat dst-address=10.28.115.18 dst-port=80 \
in-interface=ether2 protocol=tcp to-addresses=192.168.72.72 to-ports=80
/ip firewall service-port
set ftp disabled=yes
set tftp disabled=yes
set irc disabled=yes
set h323 disabled=yes
set sip disabled=yes
set pptp disabled=yes
set udplite disabled=yes
set dccp disabled=yes
set sctp disabled=yes
/ip route
add check-gateway=ping disabled=no dst-address=0.0.0.0/0 gateway=10.28.115.17 \
routing-table=main suppress-hw-offload=no
add disabled=no distance=2 dst-address=0.0.0.0/0 gateway=172.28.55.1 \
pref-src="" routing-table=main scope=30 suppress-hw-offload=no \
target-scope=10
add distance=1 gateway=10.28.115.17 routing-table=abspl-inbound
add distance=1 gateway=172.28.55.1 routing-table=sswl-inbound
add check-gateway=ping distance=1 gateway=10.28.115.17 routing-table=\
abspl-outbound
add check-gateway=ping distance=2 gateway=172.28.55.1 routing-table=\
sswl-outbound
add disabled=no dst-address=4.2.2.1/32 gateway=10.28.115.17 routing-table=\
main suppress-hw-offload=no
add disabled=no distance=1 dst-address=4.2.2.2/32 gateway=172.28.55.1 \
pref-src="" routing-table=main scope=30 suppress-hw-offload=no \
target-scope=10
/ip service
set telnet disabled=yes
set ftp disabled=yes
set ssh disabled=yes
set api disabled=yes
set api-ssl disabled=yes
/ip upnp
set enabled=yes
/ip upnp interfaces
add interface=ether2 type=external
add interface=LAN type=internal
add interface=ether10 type=internal
add interface=ether5 type=internal
/ipv6 address
add address=2407:cb00:c702:dead:beef::1 advertise=no interface=ether5
add address=2407:cb00:c702:babe::1 interface=ether10
add address=2407:cb00:c702:b00b::1 interface=LAN
/ipv6 dhcp-client
add add-default-route=yes interface=ABSPL pool-name=ABSPL-v6 \
pool-prefix-length=48 request=prefix use-peer-dns=no
/ipv6 nd
set [ find default=yes ] dns=\
2407:cb00:c702:dead:beef::7272,2407:cb00:c702:dead:beef::7373 mtu=1492
/ppp secret
add local-address=192.168.168.21 name=mainak profile=default-encryption \
remote-address=192.168.168.22 service=l2tp
add local-address=192.168.55.1 name=kalpak profile=default-encryption \
remote-address=192.168.55.2 remote-ipv6-prefix=2407:cb00:c702:d0d0::/64 \
service=l2tp
/routing igmp-proxy interface
add interface=ether2 upstream=yes
add interface=LAN
add interface=ether10
/routing ospf interface-template
add area=ospf-area-1 interfaces=DumDum networks=192.168.168.20/30 type=ptp
add area=ospf-backbone-v2 interfaces=Loopback networks=192.168.254.1/32
add area=ospf-area-2 interfaces=Madhyamgram networks=192.168.168.12/30 type=\
ptp
/system clock
set time-zone-name=Asia/Kolkata
/system identity
set name=home-lab
/system logging
add disabled=yes topics=ospf
/system ntp client
set enabled=yes
/system ntp client servers
add address=10.28.115.17
add address=172.28.55.1
/system package update
set channel=testing
/system routerboard settings
set auto-upgrade=yes
/tool netwatch
add host=10.28.115.17 interval=5s
add host=172.28.55.1 interval=5s
/tool romon
set enabled=yes
 
com2com
just joined
Posts: 4
Joined: Wed Jun 11, 2014 6:24 pm

Re: Very high CPU usage on PCC Loadbalancing with 7.x

Tue Dec 28, 2021 3:45 pm

RB5009: 2 wan 1gb+ 500mb pcc about 80% cpu use.
 
sindy
Forum Guru
Forum Guru
Posts: 10205
Joined: Mon Dec 04, 2017 9:19 pm

Re: Very high CPU usage on PCC Loadbalancing with 7.x

Tue Dec 28, 2021 4:40 pm

Here is my config:
As expected - when the mangle rules are disabled, connection tracking is deactivated because enabled under ip/firewall/connection/tracking is set to the default value auto, and therefore connection tracking is only activated if at least one firewall rule refers to metafields that connection tracking provides or assigns them (i.e. anything related to matching or assigning connection-mark, connection-state, or connection-nat-state).

So first of all, keep the mangle rules disabled, and set enabled under ip/firewall/connection/tracking to yes. This will show you the CPU usage caused by connection tracking alone.

Your mangle rules may be simplified a bit (you seem to assign a connection mark to every packet of a connection), but I'm afraid the biggest difference in CPU load is caused by the activation of connection tracking.
 
User avatar
CZFan
Forum Guru
Forum Guru
Posts: 2098
Joined: Sun Oct 09, 2016 8:25 pm
Location: South Africa, Krugersdorp (Home town of Brad Binder)
Contact:

Re: Very high CPU usage on PCC Loadbalancing with 7.x

Tue Dec 28, 2021 5:10 pm

My understanding is that there is no "Route Caching" in ROS7, hence the jump in CPU utilization from V6 to V7.
 
User avatar
anav
Forum Guru
Forum Guru
Posts: 19107
Joined: Sun Feb 18, 2018 11:28 pm
Location: Nova Scotia, Canada
Contact:

Re: Very high CPU usage on PCC Loadbalancing with 7.x

Tue Dec 28, 2021 5:26 pm

This post is getting confusing. Seems like V7 has made some changes under the hood that need to be better explained.
 
sindy
Forum Guru
Forum Guru
Posts: 10205
Joined: Mon Dec 04, 2017 9:19 pm

Re: Very high CPU usage on PCC Loadbalancing with 7.x

Tue Dec 28, 2021 6:53 pm

This post is getting confusing.
It's because these are two separate issues.

One is the impact of connection tracking being activated by the addition of the load balancing rules (something you normally do not notice if the default stateful firewall is in place, which is not the case here), and this one is common to v6 and v7.

The other one is the impact of the absence of routing cache in v7, which has been mentioned multiple times here and there, but does not explain the difference in this topic.
 
mafiosa
Member Candidate
Member Candidate
Topic Author
Posts: 266
Joined: Fri Dec 09, 2016 8:10 pm
Location: Kolkata, India
Contact:

Re: Very high CPU usage on PCC Loadbalancing with 7.x

Tue Dec 28, 2021 8:44 pm

This post is getting confusing.
It's because these are two separate issues.

One is the impact of connection tracking being activated by the addition of the load balancing rules (something you normally do not notice if the default stateful firewall is in place, which is not the case here), and this one is common to v6 and v7.

The other one is the impact of the absence of routing cache in v7, which has been mentioned multiple times here and there, but does not explain the difference in this topic.
I am using CHR v7.2 RC1 with AMD athlon 200GE and utilization is 12-17% max with the same set of rules.
 
mafiosa
Member Candidate
Member Candidate
Topic Author
Posts: 266
Joined: Fri Dec 09, 2016 8:10 pm
Location: Kolkata, India
Contact:

Re: Very high CPU usage on PCC Loadbalancing with 7.x

Wed Dec 29, 2021 5:35 pm

The other one is the impact of the absence of routing cache in v7, which has been mentioned multiple times here and there, but does not explain the difference in this topic.
Then why is ip route cache option present in ip>setting?
 
mafiosa
Member Candidate
Member Candidate
Topic Author
Posts: 266
Joined: Fri Dec 09, 2016 8:10 pm
Location: Kolkata, India
Contact:

Re: Very high CPU usage on PCC Loadbalancing with 7.x

Sat Jan 29, 2022 8:45 pm

with v7.2RC3 the cpu utilization has reduced to 55-60% from 86%+ previously. However, a lot of work in optimizing throughput is required. I cannot get more that 270-300mbps on file transfer between two vlans.
 
mducharme
Trainer
Trainer
Posts: 1777
Joined: Tue Jul 19, 2016 6:45 pm
Location: Vancouver, BC, Canada

Re: Very high CPU usage on PCC Loadbalancing with 7.x

Sat Jan 29, 2022 8:53 pm

Then why is ip route cache option present in ip>setting?
They haven't removed the setting yet. It is now a dummy setting, the only thing it does is disables fast path, and there is already a check box for disabling fast path.
 
wispvt
Member Candidate
Member Candidate
Posts: 109
Joined: Tue May 10, 2011 4:20 pm

Re: Very high CPU usage on PCC Loadbalancing with 7.x

Thu Sep 14, 2023 8:05 pm

We have noticed the same thing on CPU usage, we just upgraded a NAT firewall that does PCC load balancing from 6.48.9 to 7.11.2 yesterday and you can see the huge difference in CPU usage. I would have thought with the newer OS it would be dramatically lower not signifigantly highter. This is on a CCR2004 router runnning about 2Gps at peak time.
CPU Usage.pdf
You do not have the required permissions to view the files attached to this post.
 
msatter
Forum Guru
Forum Guru
Posts: 2897
Joined: Tue Feb 18, 2014 12:56 am
Location: Netherlands / Nīderlande

Re: Very high CPU usage on PCC Loadbalancing with 7.x

Thu Sep 14, 2023 8:18 pm

In RouterOS there is no routing cache anymore. That might have a impact in a high load setting.
 
User avatar
Larsa
Forum Guru
Forum Guru
Posts: 1041
Joined: Sat Aug 29, 2015 7:40 pm
Location: The North Pole, Santa's Workshop

Re: Very high CPU usage on PCC Loadbalancing with 7.x

Thu Sep 14, 2023 8:46 pm

Once again, that's a myth and misconception spread on this forum. The current V7 kernel utilizes a more modern network stack that divides the cache into distinct layers, achieving greater efficiency where it's most needed.

Some relevant reading on the subject:
 
msatter
Forum Guru
Forum Guru
Posts: 2897
Joined: Tue Feb 18, 2014 12:56 am
Location: Netherlands / Nīderlande

Re: Very high CPU usage on PCC Loadbalancing with 7.x

Thu Sep 14, 2023 10:36 pm

 
wispvt
Member Candidate
Member Candidate
Posts: 109
Joined: Tue May 10, 2011 4:20 pm

Re: Very high CPU usage on PCC Loadbalancing with 7.x

Thu Sep 14, 2023 11:01 pm

Thanks for the response. Is there anything I can do to lower the CPU usage to achieve more than 2Gbps on my CCR2004 in real world scenario? Is there anyway to diagnose and tell if certain mangle or firewall rules are the cause of the slow down or inefficient? If you look at the cpu profile is only shows generic cpu usage for networking or firewall but no details.
 
User avatar
Larsa
Forum Guru
Forum Guru
Posts: 1041
Joined: Sat Aug 29, 2015 7:40 pm
Location: The North Pole, Santa's Workshop

Re: Very high CPU usage on PCC Loadbalancing with 7.x

Thu Sep 14, 2023 11:28 pm

@msatter: Yes, the previous v6 kernel global routing cache (that was prone to pollution attacks) has been removed and replaced with a more efficient (faster) multi-layer cache in the v7 kernel. However, in some specific scenarios it might consume more CPU resources which could be noticeable on older low-end devices. Check out the articles that will explain the whole thing in more detail.
 
msatter
Forum Guru
Forum Guru
Posts: 2897
Joined: Tue Feb 18, 2014 12:56 am
Location: Netherlands / Nīderlande

Re: Very high CPU usage on PCC Loadbalancing with 7.x

Fri Sep 15, 2023 1:03 pm

You are writing that think the PCC are taking to much CPU in v7 wiithout any showing us your PCC lines?

It is then difficult to tell you what can be improved.
 
wispvt
Member Candidate
Member Candidate
Posts: 109
Joined: Tue May 10, 2011 4:20 pm

Re: Very high CPU usage on PCC Loadbalancing with 7.x

Tue Sep 19, 2023 8:43 pm

/ip firewall mangle
add action=accept chain=prerouting comment="Allow usage of default routing table for traffic to connected networks." \
dst-address=75.xxx.xxx.0/24 in-interface-list=LAN
add action=accept chain=prerouting comment="Allow usage of default routing table for traffic to connected networks." \
dst-address=227.xxx.xxx.0/24 in-interface-list=LAN
add action=mark-connection chain=prerouting comment="Make sure connection goes out on the provider it originated on." \
connection-mark=no-mark in-interface="sfp-sfpplus1 - Provider1 WAN" new-connection-mark=provider1_conn passthrough=yes
add action=mark-connection chain=prerouting comment="Make sure connection goes out on the provider it originated on." \
connection-mark=no-mark in-interface="sfp-sfpplus2 - Provider2 WAN" new-connection-mark=provider2_conn passthrough=yes
add action=mark-connection chain=prerouting comment="Make sure our Overdue customers go out over the proper connection." \
connection-mark=no-mark dst-address-type=!local in-interface-list=LAN new-connection-mark=provider1_conn passthrough=yes \
src-address-list=captive_portal
add action=mark-connection chain=prerouting comment="Make sure our StaticIP customers go out over the proper connection." \
connection-mark=no-mark dst-address-type=!local in-interface-list=LAN new-connection-mark=provider1_conn passthrough=yes \
src-address=172.xxx.xxx.0/24
add action=mark-connection chain=prerouting comment="Balance out the connections over these providers - Provider1" \
connection-mark=no-mark dst-address-type=!local in-interface-list=LAN new-connection-mark=provider1_conn passthrough=yes \
per-connection-classifier=src-address:2/0
add action=mark-connection chain=prerouting comment="Balance out the connections over these providers - Provider2" \
connection-mark=no-mark dst-address-type=!local in-interface-list=LAN new-connection-mark=provider2_conn passthrough=yes \
per-connection-classifier=src-address:2/1
add action=mark-routing chain=prerouting comment="Route the connection properly." connection-mark=provider1_conn \
in-interface-list=LAN new-routing-mark=to_provider1 passthrough=no
add action=mark-routing chain=prerouting comment="Route the connection properly." connection-mark=provider2_conn \
in-interface-list=LAN new-routing-mark=to_provider2 passthrough=no
add action=mark-routing chain=output comment="Mark outgoing connections." connection-mark=provider1_conn new-routing-mark=\
to_provider1 passthrough=no
add action=mark-routing chain=output comment="Mark outgoing connections." connection-mark=provider2_conn new-routing-mark=\
to_provider2 passthrough=no

Who is online

Users browsing this forum: loloski and 14 guests