Tak nějak jsem na tohle vlákno už zapomněl, ale se zpožděním přikládám config.
Vše funguje vcelku dobře, je tu pár věcí, co mě štvou, ale nějak jsem si zatím nenašel čas, jak to upravit.
1. Když přetěžuji linku, tak se mi cca na vteřinu vypnou routes k danému providerovi, většinou si toho člověk ani nevšimne. Zkoušel jsem to pořešit pomocí queue na icmp packety, ale nefunguje to a nevím proč. Možná kdyby se nastavila nějaká další queue pro ostatní traffic, ale to bych musel nějak pořešit to aby se upravil bandwidth podle toho přes kterého providera jsem zrovna připojen.
2. Router nenajde update baličky, vypíše chybu, že není připojen k Internetu. Zkoušel jsem zmenšit subnet pro ISP2-GroupB a markovat ho separátně, ale nepodařilo se mi to vyřešit. Pravděpodobně to je tím, že na marking se používá prerouting. Moc se v tom nevyznám, tak to neřeším. Pro update stačí nahodit výchozí config a pak obnovit zálohu... ale bylo by fajn, kdybych nějak získal IP adresy serverů odkud tahá packages, pak bych mohl přidat jen routu, jako jsem to udělal pro SNTP server.
[admin@MikroTik] > /export
# jun/17/2017 14:10:48 by RouterOS 6.34.3
# software id = vymazano
#
/interface bridge
add admin-mac=6C:3B:6B:8B:55:4A auto-mac=no comment=defconf name=bridge
/interface ethernet
set [ find default-name=ether1 ] name=ether1-isp1
set [ find default-name=ether2 ] name=ether2-master
set [ find default-name=ether3 ] master-port=ether2-master
set [ find default-name=ether4 ] master-port=ether2-master
set [ find default-name=ether5 ] name=ether5-isp2
set [ find default-name=ether6 ] name=ether6-master
set [ find default-name=ether7 ] master-port=ether6-master
set [ find default-name=ether8 ] master-port=ether6-master
set [ find default-name=ether9 ] master-port=ether6-master
set [ find default-name=ether10 ] master-port=ether6-master
/ip neighbor discovery
set ether1-isp1 discover=no
set bridge comment=defconf
/ip pool
add name=dhcp ranges=10.0.0.1-10.0.0.254
/ip dhcp-server
add address-pool=dhcp disabled=no interface=bridge lease-time=23h59m name=defconf
/queue simple
add limit-at=512k/512k max-limit=512k/512k name=icmp packet-marks=icmp-pkt target=""
/interface bridge port
add bridge=bridge comment=defconf interface=ether2-master
add bridge=bridge comment=defconf interface=ether6-master
/ip address
add address=10.0.0.254/24 comment="LAN subnet" interface=ether2-master network=10.0.0.0
add address=192.168.1.2/29 comment=IPS-1 interface=ether1-isp1 network=192.168.1.0
add address=192.168.0.2/24 comment=ISP-2 interface=ether5-isp2 network=192.168.0.0
/ip dhcp-client
add comment=defconf dhcp-options=hostname,clientid interface=ether1-isp1
/ip dhcp-server lease
# vymazano
/ip dhcp-server network
add address=10.0.0.0/24 comment=defconf gateway=10.0.0.254
/ip dns
set allow-remote-requests=yes servers=8.8.8.8,208.67.222.222
/ip dns static
add address=10.0.0.254 name=router
/ip firewall filter
add chain=input comment="defconf: accept ICMP" protocol=icmp
add chain=input comment="defconf: accept established,related" connection-state=established,related
add action=drop chain=input comment="defconf: drop all from WAN" in-interface=ether1-isp1
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" connection-state=established,related
add chain=forward comment="defconf: accept established,related" connection-state=established,related
add action=drop chain=forward comment="defconf: drop invalid" connection-state=invalid
add action=drop chain=forward comment="defconf: drop all from WAN not DSTNATed" connection-nat-state=!dstnat connection-state=new in-interface=ether1-isp1
/ip firewall mangle
add action=mark-routing chain=prerouting comment="ISP1 - vymazano" new-routing-mark=GroupA passthrough=no src-address=10.0.0.0/25
add action=mark-routing chain=prerouting comment="ISP2 - vymazano" new-routing-mark=GroupB passthrough=no src-address=10.0.0.128/25
add action=mark-connection chain=prerouting new-connection-mark=icmp-con protocol=icmp
add action=mark-connection chain=postrouting new-connection-mark=icmp-con protocol=icmp
add action=mark-packet chain=prerouting connection-mark=icmp-con new-packet-mark=icmp-pkt passthrough=no protocol=icmp
add action=mark-packet chain=postrouting connection-mark=icmp-con new-packet-mark=icmp-pkt passthrough=no protocol=icmp
/ip firewall nat
add action=masquerade chain=srcnat comment="defconf: masquerade" out-interface=ether1-isp1
add action=masquerade chain=srcnat out-interface=ether5-isp2
add action=masquerade chain=srcnat src-address=10.0.0.0/24
/ip route
add comment=ISP1 distance=1 gateway=192.168.1.1 routing-mark=GroupA
add comment=ISP2 distance=10 gateway=192.168.0.1 routing-mark=GroupA
add comment=ISP2 distance=1 gateway=192.168.0.1 routing-mark=GroupB
add comment=ISP1 distance=10 gateway=192.168.1.1 routing-mark=GroupB
add comment="test route isp2" distance=1 dst-address=8.8.8.8/32 gateway=192.168.0.1
add comment="sntp server - time server" distance=1 dst-address=91.103.163.212/32 gateway=192.168.0.1,192.168.1.1
add comment="test route isp1" distance=1 dst-address=208.67.222.222/32 gateway=192.168.1.1
/ip upnp
set enabled=yes
/system clock
set time-zone-name=Europe/Prague
/system ntp client
set enabled=yes primary-ntp=91.103.163.212
/system routerboard settings
set protected-routerboot=disabled
/system scheduler
add comment="pole On Event musi byt totozne s nazvem skriptu, ktery se ma spustit" interval=2s name=Failover on-event=Failover policy=ftp,reboot,read,write,policy,test,password,sniff,sensitive start-time=startup
/system script
add comment="Aby script spravne fungoval a vypinal patricne routy podle commentu, musi byt commenty v IP - route nastaveny presne stejne jako retezec ve skriptu. Coz znamena pro ISP1 musi myt komentar u routes \"XXX\" a pro ISP2 t\
o musi byt \"YYY\"" name=Failover owner=admin policy=ftp,reboot,read,write,policy,test,password,sniff,sensitive source="# ------------------- header -------------------\
\n# Script by Tomas Kirnak, version 1.0.7\
\n# If you use this script, or edit and\
\n# re-use it, please keep the header intact.\
\n#\
\n# For more information and details about\
\n# this script please visit the wiki page at\
\n# http://wiki.mikrotik.com/wiki/Failover_Scripting\
\n# ------------------- header -------------------\
\n\
\n\
\n\
\n# ------------- start editing here -------------\
\n# Edit the variables below to suit your needs\
\n\
\n# Please fill the WAN interface names\
\n:local InterfaceISP1 ether1-isp1\
\n:local InterfaceISP2 ether5-isp2\
\n\
\n# Please fill the gateway IPs (or interface names in case of PPP)\
\n:local GatewayISP1 192.168.1.1\
\n:local GatewayISP2 192.168.0.100\
\n\
\n# Please fill the ping check host - currently: resolver1.opendns.com\
\n:local PingTarget1 208.67.222.222\
\n:local PingTarget2 8.8.8.8\
\n\
\n# Please fill how many ping failures are allowed before fail-over happends\
\n:local FailTreshold 3\
\n\
\n# Define the distance increase of a route when it fails\
\n:local DistanceIncrease 2\
\n\
\n# Editing the script after this point may break it\
\n# -------------- stop editing here --------------\
\n\
\n\
\n\
\n# Declare the global variables\
\n:global PingFailCountISP1\
\n:global PingFailCountISP2\
\n\
\n# This inicializes the PingFailCount variables, in case this is the 1st time the script has ran\
\n:if ([:typeof \$PingFailCountISP1] = \"nothing\") do={:set PingFailCountISP1 0}\
\n:if ([:typeof \$PingFailCountISP2] = \"nothing\") do={:set PingFailCountISP2 0}\
\n\
\n# This variable will be used to keep results of individual ping attempts\
\n:local PingResult\
\n\
\n\
\n\
\n# Check ISP1\
\n:set PingResult [ping \$PingTarget1 count=1 interface=\$InterfaceISP1]\
\n:put \$PingResult\
\n\
\n:if (\$PingResult = 0) do={\
\n\t:if (\$PingFailCountISP1 < (\$FailTreshold+2)) do={\
\n\t\t:set PingFailCountISP1 (\$PingFailCountISP1 + 1)\
\n\t\t\
\n\t\t:if (\$PingFailCountISP1 = \$FailTreshold) do={\
\n\t\t\t:log warning \"ISP1 ma problem na route k openDNS \$PingTarget1 - vypinam routes.\"\
\n\t\t\t:foreach i in=[/ip route find comment=XXX && static] do=\\\
\n\t\t\t\t{/ip route set \$i disabled=yes}\
\n\t\t\t:log warning \"ISP1 routes byly vypnuty.\"\
\n\t\t}\
\n\t}\
\n}\
\n:if (\$PingResult = 1) do={\
\n\t:if (\$PingFailCountISP1 > 0) do={\
\n\t\t:set PingFailCountISP1 (\$PingFailCountISP1 - 1)\
\n\t\t\
\n\t\t:if (\$PingFailCountISP1 = (\$FailTreshold -1)) do={\
\n\t\t\t:log warning \"ISP1 muze zase pingnout \$PingTarget1 - zapinam routes.\"\
\n\t\t\t:foreach i in=[/ip route find comment=XXX && static] do=\\\
\n\t\t\t\t{/ip route set \$i disabled=no}\
\n\t\t\t:log warning \"ISP1 routes byly zapnuty.\"\
\n\t\t}\
\n\t}\
\n}\
\n\
\n\
\n\
\n# Check ISP2\
\n:set PingResult [ping \$PingTarget2 count=1 interface=\$InterfaceISP2]\
\n:put \$PingResult\
\n\
\n:if (\$PingResult = 0) do={\
\n\t:if (\$PingFailCountISP2 < (\$FailTreshold+2)) do={\
\n\t\t:set PingFailCountISP2 (\$PingFailCountISP2 + 1)\
\n\t\t\
\n\t\t:if (\$PingFailCountISP2 = \$FailTreshold) do={\
\n\t\t\t:log warning \"ISP2 ma problem na route k Google DNS \$PingTarget2 - vypinam routes.\"\
\n\t\t\t:foreach i in=[/ip route find comment=YYY && static] do=\\\
\n\t\t\t\t{/ip route set \$i disabled=yes}\
\n\t\t\t:log warning \"ISP2 routes byly vypnuty.\"\
\n\t\t}\
\n\t}\
\n}\
\n:if (\$PingResult = 1) do={\
\n\t:if (\$PingFailCountISP2 > 0) do={\
\n\t\t:set PingFailCountISP2 (\$PingFailCountISP2 - 1)\
\n\t\t\
\n\t\t:if (\$PingFailCountISP2 = (\$FailTreshold -1)) do={\
\n\t\t\t:log warning \"ISP2 muze zase pingnout \$PingTarget2 - zapinam routes.\"\
\n\t\t\t:foreach i in=[/ip route find comment=YYY && static] do=\\\
\n\t\t\t\t{/ip route set \$i disabled=no}\
\n\t\t\t:log warning \"ISP2 routes byly zapnuty.\"\
\n\t\t}\
\n\t}\
\n}\
\n"
/tool graphing interface
add allow-address=10.0.0.0/24 interface=ether1-isp1
add allow-address=10.0.0.0/24 interface=ether5-isp2
add allow-address=10.0.0.0/24 interface=ether2-master
add allow-address=10.0.0.0/24 interface=ether3
add allow-address=10.0.0.0/24 interface=ether6-master
/tool graphing queue
add allow-address=10.0.0.0/24
/tool graphing resource
add allow-address=10.0.0.0/24
/tool mac-server
set [ find default=yes ] disabled=yes
add interface=bridge
/tool mac-server mac-winbox
set [ find default=yes ] disabled=yes
add interface=bridge
[admin@MikroTik] >
