Community discussions

MikroTik App
 
User avatar
camg
newbie
Topic Author
Posts: 29
Joined: Sun Aug 29, 2021 2:37 pm

Multiple WAN port access problems

Sat Feb 18, 2023 6:31 pm

Hello, I am currently connected to two ISPs, each of which needs to provide external services. Currently, I have set up source in and source out, and marked the routing table. But the test port mapping 3389 still fails. May I ask where my configuration is faulty?
The following is the exported configuration。
[admin@MikroTik] > export 
# feb/18/2023 16:25:03 by RouterOS 7.8rc1
# software id = TI09-7WK3
#
/interface ethernet
set [ find default-name=ether2 ] disable-running-check=no name=Pcie_Lan_1
set [ find default-name=ether2 ] disable-running-check=no name=Pcie_Lan_2
set [ find default-name=ether1 ] disable-running-check=no name=R730xd_Exsi_Lan
set [ find default-name=ether3 ] disable-running-check=no name=R730xd_Lan
set [ find default-name=ether4 ] disable-running-check=no name=Wan_DX
set [ find default-name=ether5 ] disable-running-check=no name=Wan_LT
/interface pppoe-client
add add-default-route=yes disabled=no interface=Wan_DX name=pppoe_DX user=\
    XXXXXXXXXX
add add-default-route=yes disabled=no interface=Wan_LT name=pppoe_LT user=\
    XXXXXXXXXX
/ip pool
add name=dhcp_pool0 ranges=223.255.255.2-223.255.255.254
/ip dhcp-server
add address-pool=dhcp_pool0 interface=R730xd_Lan name=dhcp1
/lora servers
add address=eu.mikrotik.thethings.industries down-port=1700 name=TTN-EU \
    up-port=1700
add address=us.mikrotik.thethings.industries down-port=1700 name=TTN-US \
    up-port=1700
add address=eu1.cloud.thethings.industries down-port=1700 name=\
    "TTS Cloud (eu1)" up-port=1700
add address=nam1.cloud.thethings.industries down-port=1700 name=\
    "TTS Cloud (nam1)" up-port=1700
add address=au1.cloud.thethings.industries down-port=1700 name=\
    "TTS Cloud (au1)" up-port=1700
add address=eu1.cloud.thethings.network down-port=1700 name="TTN V3 (eu1)" \
    up-port=1700
add address=nam1.cloud.thethings.network down-port=1700 name="TTN V3 (nam1)" \
    up-port=1700
add address=au1.cloud.thethings.network down-port=1700 name="TTN V3 (au1)" \
    up-port=1700
/port
set 0 name=serial0
set 1 name=serial1
/ppp profile
add name=L2TP-Profile use-encryption=yes
/routing table
add disabled=no name=to_LT
add disabled=no name=to_DX
/interface l2tp-server server
set default-profile=L2TP-Profile enabled=yes use-ipsec=yes
/ip address
add address=223.255.255.1/24 interface=R730xd_Lan network=223.255.255.0
/ip dhcp-server network
add address=223.255.255.0/24 gateway=223.255.255.1
/ip dns
set allow-remote-requests=yes servers=223.5.5.5
/ip firewall mangle
add action=mark-connection chain=input comment=LT_conn_mark connection-mark=\
    no-mark in-interface=pppoe_LT new-connection-mark=LT_conn passthrough=yes
add action=mark-connection chain=input comment=DX_conn_mark connection-mark=\
    no-mark in-interface=pppoe_DX new-connection-mark=DX_conn passthrough=yes
add action=mark-routing chain=output comment=to_LT connection-mark=LT_conn \
    new-routing-mark=*400 passthrough=yes
add action=mark-routing chain=output comment=to_DX connection-mark=DX_conn \
    new-routing-mark=*401 passthrough=yes
/ip firewall nat
add action=masquerade chain=srcnat comment=NAT_DX out-interface=pppoe_DX
add action=masquerade chain=srcnat comment=NAT_LT out-interface=pppoe_LT
add action=dst-nat chain=dstnat comment="port forwarding 3389" dst-port=3389 \
    in-interface=pppoe_LT protocol=tcp to-addresses=223.255.255.225 to-ports=\
    3389
add action=dst-nat chain=dstnat comment="port forwarding 3389" dst-port=3389 \
    in-interface=pppoe_DX protocol=tcp to-addresses=223.255.255.225 to-ports=\
    3389
/ip service
set telnet disabled=yes
set ftp disabled=yes
set www disabled=yes
set ssh port=2000
set api disabled=yes
set api-ssl disabled=yes
/ppp secret
add local-address=223.255.255.250 name=root profile=L2TP-Profile \
    remote-address=223.255.255.249 service=l2tp
/system hardware
set allow-x86-64=yes
/system ntp client
set enabled=yes
/system ntp server
set broadcast=yes enabled=yes manycast=yes
/system ntp client servers
add address=0.pool.ntp.org
add address=1.pool.ntp.org
/system package update
set channel=testing
 
User avatar
anav
Forum Guru
Forum Guru
Posts: 19099
Joined: Sun Feb 18, 2018 11:28 pm
Location: Nova Scotia, Canada
Contact:

Re: Multiple WAN port access problems

Sat Feb 18, 2023 9:18 pm

I see no routes for the marked traffic ???
 
User avatar
camg
newbie
Topic Author
Posts: 29
Joined: Sun Aug 29, 2021 2:37 pm

Re: Multiple WAN port access problems

Sun Feb 19, 2023 12:52 pm

I see no routes for the marked traffic ???
Isn't this one? Or is it referring to the menu under /routing/tables?
[/ip firewall mangle
add action=mark-connection chain=input comment=LT_conn_mark connection-mark=\
    no-mark in-interface=pppoe_LT new-connection-mark=LT_conn passthrough=yes
add action=mark-connection chain=input comment=DX_conn_mark connection-mark=\
    no-mark in-interface=pppoe_DX new-connection-mark=DX_conn passthrough=yes
add action=mark-routing chain=output comment=to_LT connection-mark=LT_conn \
    new-routing-mark=*400 passthrough=yes
add action=mark-routing chain=output comment=to_DX connection-mark=DX_conn \
    new-routing-mark=*401 passthrough=yescode]
 
User avatar
camg
newbie
Topic Author
Posts: 29
Joined: Sun Aug 29, 2021 2:37 pm

Re: Multiple WAN port access problems

Sun Feb 19, 2023 12:54 pm

I see no routes for the marked traffic ???
Is this marker incorrect?
/routing table
add disabled=no name=to_LT
add disabled=no name=to_DX
[code]
 
User avatar
anav
Forum Guru
Forum Guru
Posts: 19099
Joined: Sun Feb 18, 2018 11:28 pm
Location: Nova Scotia, Canada
Contact:

Re: Multiple WAN port access problems

Sun Feb 19, 2023 2:09 pm

Go look at your ip routes and understand what you are looking at..........
How routes are created by entering IP address (for subnets or bridge for example).
See the routes created by pppoe since you selected, add default routes.

So this is all good an normal, but you have no IP routes to tie the routing mark to a particular WAN.
Marking them is NOT routing them. So you need to at least create two manual routes
 
User avatar
camg
newbie
Topic Author
Posts: 29
Joined: Sun Aug 29, 2021 2:37 pm

Re: Multiple WAN port access problems

Sun Feb 19, 2023 6:58 pm

Go look at your ip routes and understand what you are looking at..........
How routes are created by entering IP address (for subnets or bridge for example).
See the routes created by pppoe since you selected, add default routes.

So this is all good an normal, but you have no IP routes to tie the routing mark to a particular WAN.
Marking them is NOT routing them. So you need to at least create two manual routes
Thank you, finally I understand where the failure point is, just learning ros not long ago, thanks for pointing it out
 
User avatar
anav
Forum Guru
Forum Guru
Posts: 19099
Joined: Sun Feb 18, 2018 11:28 pm
Location: Nova Scotia, Canada
Contact:

Re: Multiple WAN port access problems

Sun Feb 19, 2023 7:05 pm

Awesome, the router becomes more interesting once one gains bits of knowledge. Be advised the more you know, the more your realize you dont know. :-)

One can route traffic out a specific WAN without mangling but mangling becomes mandatory if
a. you have traffic originating external to the router coming ( and needs to go out same WAN) OR
b. the users needing to go out a specific WAN are less than a subnet and too numerous to contemplate a single rule for each ( or users spread out in various subnes ) and then using mangling with a source address list becomes efficient.
 
User avatar
camg
newbie
Topic Author
Posts: 29
Joined: Sun Aug 29, 2021 2:37 pm

Re: Multiple WAN port access problems

Mon Feb 20, 2023 7:20 am

Awesome, the router becomes more interesting once one gains bits of knowledge. Be advised the more you know, the more your realize you dont know. :-)

One can route traffic out a specific WAN without mangling but mangling becomes mandatory if
a. you have traffic originating external to the router coming ( and needs to go out same WAN) OR
b. the users needing to go out a specific WAN are less than a subnet and too numerous to contemplate a single rule for each ( or users spread out in various subnes ) and then using mangling with a source address list becomes efficient.
Thanks for your pointers, I've been able to map multiple wan ports after adding static routes and marking them. Thank you again!

Who is online

Users browsing this forum: Bing [Bot], Nospam and 61 guests