Following post is an reference guide or scrapbook, which have working codes for following.
- Dual WAN PCC with 2 DSL modems [configured in bridge mode] and dialing is done via mikrotik
- Port forwarding various ports [as required] from the internet to local web server
- PPPoE Server
Note: I have used SOURCE BASE classifier in this example, to avoid common load balancing problems like https links breakup, buffering issues stuck problem etc etc : )
Just to remind this is not a copy paste version. its not complete export version. I modified the data for reference. Read them carefully for better understanding. You can pick any section of your choice or as required. I will add more sections later …
For port forwarding under PCC, You need to play with the PCC router. Logic is simple, let router knows the return path !! You should mark incoming connection to remember incoming interface, and then via route responses , using that marked packet to send them via same interface.
First You need to mark new incoming connections from WANs with connection marks (to identify via which wan request came from). & then for outgoing packets of these previously marked connections, you need to mark routing, to make them use the right WAN (via which packets arrived)
NETWORK DETAiLS :
Mikrotik LAN Interface name = Local
Mikrotik WAN 1 interface name = WAN1
Mikrotik WAN 2 interface name = WAN2
Mikrotik LAN IP Address = 192.168.0.1
WEB Server on LAN side = 192.168.0.10
Mikrotik IP POOL for LAN DHCP = 10.0.0.1/8
Mikrotik IP POOL for PPPoE Users = 172.16.0.0/16
Let’s Start ….
# Syed Jahanzaib / aacable@hotmail.com # https://aacable.wordpress.com # Adding IP pool for dhcp and pppoe /ip pool add name=pppoe-pool ranges=172.16.0.1-172.16.1.255 add name=dhcp_pool ranges=10.0.0.1-10.0.0.255 # ADD dhcp server /ip dhcp-server add address-pool=dhcp_pool authoritative=after-2sec-delay bootp-support=static disabled=no interface=Local lease-time=6h name="ZAIB DHCP SERVER" /ip dhcp-server config set store-leases-disk=5m /ip dhcp-server network add address=10.0.0.0/8 comment="zaib DHCP SERVER" dhcp-option="" dns-server=192.168.0.1,8.8.8.8 gateway="" ntp-server="" wins-server="" # Adding dsl pppoe client connections, make sure your dsl modems are in bridge mode. /interface pppoe-client add ac-name="" add-default-route=yes allow=pap,chap,mschap1,mschap2 dial-on-demand=no disabled=no interface=WAN1 max-mru=1480 max-mtu=1480 mrru=disabled name=pppoe-out1 password=ISP_DSL_PASSWORD profile=default \ service-name="" use-peer-dns=no user=ISP_DSL_USERNAME add ac-name="" add-default-route=yes allow=pap,chap,mschap1,mschap2 dial-on-demand=no disabled=no interface=WAN2 max-mru=1480 max-mtu=1480 mrru=disabled name=pppoe-out2 password=ISP_DSL_PASSWORD profile=default \ service-name="" use-peer-dns=no user=ISP_DSL_USERNAME # Adding PPPoE Default Profile /ppp profile add change-tcp-mss=default dns-server=192.168.0.1,8.8.8.8 local-address=192.168.0.1 name=pppoe-profile only-one=yes rate-limit=512k/512k remote-address=pppoe-pool use-compression=default use-encryption=no \ use-mpls=default use-vj-compression=default # Adding PPPOE Server /interface pppoe-server server add authentication=pap default-profile=pppoe-profile disabled=no interface=Local keepalive-timeout=10 max-mru=1480 max-mtu=1480 max-sessions=0 mrru=disabled one-session-per-host=no service-name=service1 # Create address list and add your users pppoe pool and web server ip addresses in this list, later we will use this list as ACL to allow specific users internet access /ip firewall address-list add address=172.16.0.1-172.16.1.255 comment="Allowed Users to Use Internet" disabled=no list="allowed users" add address=192.168.0.10 comment="Allowed Users to Use Internet" disabled=no list="allowed users" # Now start Mangling /ip firewall mangle ############################################ > Zaib # PORT FORWARDING RELATED MANGLE SECTION STARTS ############################################ # This section is related to packet marking for Marking connections/packets arrived at WAN1 link add action=mark-connection chain=input comment="Mark Connection - IN wan1,OUT wan1 Syed.Jahanzaib" disabled=no in-interface=pppoe-out1 new-connection-mark=pppoe_out1_conn passthrough=yes add action=mark-routing chain=output comment="Mark Routing - IN wan1,OUT wan1" connection-mark=pppoe_out1_conn disabled=no new-routing-mark=pppoe_out1_traffic passthrough=no # This section is related to packet marking for Marking connections/packets arrived at WAN2 link add action=mark-connection chain=input comment="Mark Connection - IN wan2, OUT wan2" disabled=no in-interface=pppoe-out2 new-connection-mark=pppoe_out2_conn passthrough=yes add action=mark-routing chain=output comment="Mark Routing - IN wan2,OUT wan2" connection-mark=pppoe_out2_conn disabled=no new-routing-mark=pppoe_out2_traffic passthrough=no add action=mark-connection chain=forward comment="Mark Connection for new conn - Packet Forward wan1, out wan1" connection-state=new disabled=no in-interface=pppoe-out1 new-connection-mark=pppoe_out1_pfw \ passthrough=no add action=mark-routing chain=prerouting comment="Mark Packets for new conn - Packet Forward wan1, out wan1" connection-mark=pppoe_out1_pfw disabled=no in-interface=Local new-routing-mark=\ pppoe_out1_traffic passthrough=no add action=mark-connection chain=forward comment="Mark Connection for new conn - Packet Forward wan2, out wan2" connection-state=new disabled=no in-interface=pppoe-out2 new-connection-mark=pppoe_out2_pfw \ passthrough=no add action=mark-routing chain=prerouting comment="Mark Routing for new conn - Packet Forward wan2, out wan2" connection-mark=pppoe_out2_pfw disabled=no in-interface=Local new-routing-mark=\ pppoe_out2_traffic passthrough=no ######################## # GENERAL PCC SECTION ######################## # This section is related to packet marking for general PCC add action=accept chain=prerouting disabled=no in-interface=pppoe-out1 add action=accept chain=prerouting disabled=no in-interface=pppoe-out2 # Classifier for dual WAN links add action=mark-connection chain=prerouting disabled=no dst-address-type=!local new-connection-mark=wan1_conn passthrough=yes per-connection-classifier=src-address:2/0 src-address-list="allowed users" add action=mark-connection chain=prerouting disabled=no dst-address-type=!local new-connection-mark=wan2_conn passthrough=yes per-connection-classifier=src-address:2/1 src-address-list="allowed users" add action=mark-routing chain=prerouting connection-mark=wan1_conn disabled=no new-routing-mark=to_wan1 passthrough=yes src-address-list="allowed users" add action=mark-routing chain=prerouting connection-mark=wan2_conn disabled=no new-routing-mark=to_wan2 passthrough=yes src-address-list="allowed users" ########################################################## # NAT / DST-NAT / MASQUERADE SECTION / PORT FORWARD ########################################################## /ip firewall nat ### Route WEB Port from wan links to local web server IP/PORT add action=dst-nat chain=dstnat comment="Route WEB Server Port 80 from INTERNET LINK1" disabled=no dst-port=80 in-interface=pppoe-out1 protocol=tcp to-addresses=192.168.0.10 to-ports=80 add action=dst-nat chain=dstnat comment="Route WEB Server Port 80 from INTERNET LINK2" disabled=no dst-port=80 in-interface=pppoe-out2 protocol=tcp to-addresses=192.168.0.10 to-ports=80 ### Allow internet access/masquerade to allowed users list only (ACL) add action=masquerade chain=srcnat disabled=no out-interface=pppoe-out1 src-address-list="allowed users" add action=masquerade chain=srcnat disabled=no out-interface=pppoe-out2 src-address-list="allowed users" ################################################## # ROUTE SECTION FOR PCC AND PORT FORWARD PACKETS ################################################## # Add routes for general PCC /ip route add check-gateway=ping disabled=no distance=1 dst-address=0.0.0.0/0 gateway=pppoe-out1 routing-mark=to_wan1 scope=30 target-scope=10 add check-gateway=ping disabled=no distance=2 dst-address=0.0.0.0/0 gateway=pppoe-out2 routing-mark=to_wan2 scope=30 target-scope=10 # Add routes for IN/OUT port forwarding packets add disabled=no distance=1 dst-address=0.0.0.0/0 gateway=pppoe-out1 routing-mark=pppoe_out1_traffic scope=30 target-scope=10 add disabled=no distance=1 dst-address=0.0.0.0/0 gateway=pppoe-out2 routing-mark=pppoe_out2_traffic scope=30 target-scope=10
Regard’s
Syed Jahanzaib
Syed Jahanzaib - Personal Blog to Share Knowledge ! 