load-Balancing-PCC-WAN1-WAN2 ako nastavim len cez WAN 2 urcite ip

esquirepx

Zdravim pani ,
nastavil som si load balacing podla link .Vsetko funguje , len mam problem s CARD SHARE satelite . Stale ma blokuje , lebo raz to overi cez WAN1 a druhy krat cez WAN2. Potrebujem, aby napr. IP adresa 10.10.10.250 a chodila len cez WAN 2 ?. Viem ze sa to musi nastavit v /ip firewall mangle pravidlo, ale neviem to urobit. Poradi mi niekto prosim? Dakujem.

esquirepx

moje nastavenie:

/interface bridge
add name=br-local

/interface bridge port
add bridge=br-local interface=ether4
add bridge=br-local interface=ether3
add bridge=br-local interface=ether5




/ip address
add address=192.168.40.254/24 network=192.168.40.0 broadcast=192.168.40.255 interface=WAN1
add address=192.168.50.254/24 network=192.168.50.0 broadcast=192.168.50.255 interface=WAN2

/ip dns
set allow-remote-requests=yes servers=8.8.8.8

/ip firewall mangle

add action=accept chain=prerouting in-interface=WAN1

add action=accept chain=prerouting in-interface=WAN2

add action=mark-connection chain=prerouting connection-mark=no-mark \
    in-interface=WAN1 new-connection-mark=ISP1_conn passthrough=yes
	
add action=mark-connection chain=prerouting connection-mark=no-mark \
    in-interface=WAN2 new-connection-mark=ISP2_conn passthrough=yes
	
add action=mark-connection chain=prerouting dst-address-type=!local \
    in-interface=br-local new-connection-mark=ISP1_conn passthrough=yes \
    per-connection-classifier=both-addresses-and-ports:2/0
	
add action=mark-connection chain=prerouting dst-address-type=!local \
    in-interface=br-local new-connection-mark=ISP2_conn passthrough=yes \
    per-connection-classifier=both-addresses-and-ports:2/1
	
add action=mark-routing chain=prerouting connection-mark=ISP1_conn \
    in-interface=br-local new-routing-mark=to_ISP1 passthrough=yes
	
add action=mark-routing chain=prerouting connection-mark=ISP2_conn \
    in-interface=br-local new-routing-mark=to_ISP2 passthrough=yes
	
add action=mark-routing chain=output connection-mark=ISP1_conn \
    new-routing-mark=to_ISP1 passthrough=yes
	
add action=mark-routing chain=output connection-mark=ISP2_conn \
    new-routing-mark=to_ISP2

/ip firewall nat
add action=masquerade chain=srcnat out-interface=WAN1 src-address=\
    10.10.10.0/24
add action=masquerade chain=srcnat out-interface=WAN2 src-address=\
    10.10.10.0/24


/ip route
add check-gateway=ping distance=1 gateway=192.168.40.1 routing-mark=to_ISP1
add check-gateway=ping distance=1 gateway=192.168.50.1 routing-mark=to_ISP2

add dst-address=0.0.0.0/0 gateway=192.168.40.1 distance=1 check-gateway=ping
add dst-address=0.0.0.0/0 gateway=192.168.50.1 distance=2 check-gateway=ping

tar

esquirepx
Zkus tohle jako poslední z mark-connection pravidel.

add action=mark-connection chain=prerouting src-address=10.10.10.250/
    dst-address-type=!local in-interface=br-local new-connection-mark=ISP2_conn passthrough=yes

martas

V NATu nad ty 2 natovací pravidla dát nové pravidlo:

/ip firewall nat
add action=masquerade chain=srcnat out-interface=WAN2 src-address=10.10.10.250

esquirepx

martas dakujem velmi pekne ..no vyskusal som to,ale stale vsetko ide cey WAN1 (reboot mk samozrejme)

Trnec

takto to musí chodit:
/ip firewall nat add action=masquerade chain=srcnat out-interface=WAN2 src-address=\ 10.10.10.250 add action=masquerade chain=srcnat out-interface=WAN1 src-address=\ 10.10.10.0/24

tar

Trnec
Myslím že špatně chápete co to natovací pravidlo dělá. To pravidlo říká že když je zdrojová adresa 10.10.10.250 a odchozí interface WAN2 tak udělej maškarádu. Ono nerozhoduje přes který interface bude daný trafik odcházet. Ani nemůže protože se provádí až po routování kdy už je odchozí interface vybrán (viz. packet flow diagram). To co tazatel požaduje se musí nastavit mangle prerouting pravidlem.

esquirepx

dakujem za pomoc ... teraz som mimo domu, ked pridem hned vyskusam...