Scribd
Upload
333 views22 pages

Load Balance Mikrotik

The document discusses load balancing and policy routing. It presents a sample network topology using two ISPs with policy routing to a VPN server. It then provides configuration examples for getting IP addresses, establishing the VPN connection, using mangle rules to mark traffic for routing, adding routes and NAT rules. Packet flow is illustrated with an example of how a packet and its reply would be processed through the mangle rules and connection tracking.

Uploaded by

dlookung
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PDF, TXT or read online on Scribd
333 views22 pages

Load Balance Mikrotik

The document discusses load balancing and policy routing. It presents a sample network topology using two ISPs with policy routing to a VPN server. It then provides configuration examples for getting IP addresses, establishing the VPN connection, using mangle rules to mark traffic for routing, adding routes and NAT rules. Packet flow is illustrated with an example of how a packet and its reply would be processed through the mangle rules and connection tracking.

Uploaded by

dlookung
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PDF, TXT or read online on Scribd
You are on page 1/ 22

Understanding Load

Balance and Policy


Route
1

andrew zheng!
edcwifi co limited

About Me

Mikrotik Trainer No. 75!


Certificate: MTCNA, MTCWE, MTCRE,
MTCTCE, MTCUME, MTCINE, UBWA,
UEWA

EDCwifi - Andrew Zheng

2015, April 17 - Vietnam MUM

About EDCwifi
Mikrotik Distributor with stock point at
Hongkong, Shenzhen and Beijing.!
Mikrotik Authorized Training partner.!
Customizing partner for MfM (made for
Mikrotik) product.!
www.edcwifi.com & www.edcwifi.com.cn
EDCwifi - Andrew Zheng

2015, April 17 - Vietnam MUM

Made for Mikrotik


Face off your device
RB750series

RB450series

EDCwifi - Andrew Zheng

2015, April 17 - Vietnam MUM

SOHO customers mostly requires:

Automatic Fail Over!


Reliable Load Balance!
Policy Route

EDCwifi - Andrew Zheng

2015, April 17 - Vietnam MUM

Topology

ISP1
192.168.0.1

Policy route to VPN

10.1.1.88
ether1!
192.168.0.1

LAN

VPN!
Server!
ISP

VPN!
Server

Router

local IP 192.168.12.99!
remote IP 192.168.12.165

ISP2

10.2.2.88

EDCwifi - Andrew Zheng

2015, April 17 - Vietnam MUM

Sample configuration
Get IP address from ISP

EDCwifi - Andrew Zheng

2015, April 17 - Vietnam MUM

Dial VPN connection (optional for


policy route)

EDCwifi - Andrew Zheng

2015, April 17 - Vietnam MUM

Mangle Rules!
All packets with gateway router IP as destination
should be accept

0
EDCwifi - Andrew Zheng

Skipping PCC rules for packets with !


router gateway IP as its destination!
to their gateway router.!
(for correcting DNS request and!
other services)

2015, April 17 - Vietnam MUM

Mangle Rules!
Make sure all packets coming from WAN interface
going out from the same WAN interface

EDCwifi - Andrew Zheng

10

2015, April 17 - Vietnam MUM

Mangle Rules and Address list!


VPN policy route
Address list example

6
Add all IP addresses that !
planned to go !
through VPN connection

EDCwifi - Andrew Zheng

mark connection of every packets with !


IP destination address listed in !
VPN address list
11

2015, April 17 - Vietnam MUM

Mangle Rules!
Connection Mark base on PCC

EDCwifi - Andrew Zheng

12

2015, April 17 - Vietnam MUM

Mangle Rules!
Route Mark for PCC

EDCwifi - Andrew Zheng

10

13

11

2015, April 17 - Vietnam MUM

Mangle Rules!
Route Mark for Output Chain

12

EDCwifi - Andrew Zheng

13

14

14

2015, April 17 - Vietnam MUM

IP Route Rules!
Add Default Gateway for our Routing Mark

EDCwifi - Andrew Zheng

15

2015, April 17 - Vietnam MUM

IP Route Rules!
Fail Over
By adding default gateway!
that not booked for routing mark!
we already create fail over system.!
Just adjust the distance for !
priority purpose

EDCwifi - Andrew Zheng

16

2015, April 17 - Vietnam MUM

NAT

EDCwifi - Andrew Zheng

17

2015, April 17 - Vietnam MUM

Checking PCC Result

EDCwifi - Andrew Zheng

18

2015, April 17 - Vietnam MUM

Checking Policy routes Result

EDCwifi - Andrew Zheng

19

2015, April 17 - Vietnam MUM

Packet Flow with mangle chain simple explanation


packet A, going into ether1 with src add: 192.168.0.2 and dst add: 222.111.222.111
checking DST-IP!
to local or forward-!
checking DST-NAT!
packet A!
packet
A!
packet A!
output interfacesrc:192.168.0.2!
rules
src:192.168.0.2!
dst: 222.111.222.111!
1-conn!
1-route!
in int: ether1

src:192.168.0.2!
dst: 222.111.222.111!
1-conn!
1-route!
in int: ether1

DSTNAT

checking mangle forward-!


filter forward

dst: 222.111.222.111!
1-conn!
1-route!
in int: ether1!
out int: ISP1

Mangle
forward

Routing
Decision

add mangle 1-conn!


and 1-route

packet A!
src:192.168.0.2!
dst: 222.111.222.111!
in int: ether1!
no mark

Recording !
conn track

packet A!
src:192.168.0.2!
dst: 222.111.222.111!
in int: ether1!
no mark

packet A!
src:192.168.0.2!
dst: 222.111.222.111!
1-conn!
1-route!
in int: ether1!
out int ISP1

Filter!
Forward

Routing
Adjustment

Mangle
postrouting

Mangle
prerouting

connection
tracking

Input interface!
eq: ether1,
ether2,ether3, etc

EDCwifi - Andrew Zheng

SRCNAT

Mangle
input

Local Process

connection
tracking

Mangle
output

Output interface!
eq: ether1,
ether2,ether3, etc

checking mangle !
post routing
packet A!
src:192.168.0.2!
dst: 222.111.222.111!
1-conn!
1-route!
out int ISP1

Change SRC IP
packet A!
src:10.1.1.97!
dst: 222.111.222.111!
1-conn!
1-route!
out int ISP1

packet A!
src:10.1.1.97!
dst: 222.111.222.111!

20

2015, April 17 - Vietnam MUM

Packet Flow with mangle chain simple explanation


replied packet A (A-1), going into ISP1 interface with src add: 222.111.222.111 and dst add: 10.1.1.97
checking DST-IP!
to local or forward-!
checking DST-NAT!
packet A-1!
rules
packet A-1! output interface
packet A-1!
src: 222.111.222.111!
dst: 192.168.0.2!
1-conn!
in int: ISP1

src: 222.111.222.111!
dst: 10.1.1.97!
1-conn!
in int: ISP1

DSTNAT

checking mangle forward-!


filter forward

src: 222.111.222.111!
dst: 192.168.0.2!
1-conn!
in int: ISP1!
goto Ether1

Mangle
forward

Routing
Decision

Check mangle pre-routing,!


adding mark !
1-conn

packet A-1!
src: 222.111.222.111!
dst: 10.1.1.97!
in int: ISP1!
recognize this packet is
one connection with A

check and update!


conn-track

packet A-1!
src: 222.111.222.111!
dst: 10.1.1.97!
in int: ISP1

packet A-1!
src: 222.111.222.111!
dst: 192.168.0.2!
1-conn!
in int: ISP1!
out int ether1

Filter!
Forward

Routing
Adjustment

Mangle
postrouting

Mangle
prerouting

connection
tracking

Input interface!
eq: ether1,
ether2,ether3, etc

checking mangle !
post routing
packet A-1!
src: 222.111.222.111!
dst: 192.168.0.2!
1-conn!
out int ether1

SRCNAT

Mangle
input

Local Process

connection
tracking

Mangle
output

Output interface!
eq: ether1,
ether2,ether3, etc

Change SRC IP
packet A-1!
src: 222.111.222.111!
dst: 192.168.0.2!
1-conn!
out int ether1

packet A-1!
src: 222.111.222.111!
dst: 192.168.0.2!

EDCwifi - Andrew Zheng

21

2015, April 17 - Vietnam MUM

Any Question?
Thank you!
For Goods Inquiry: marketing@edcwifi.com!
For Training Inquiry: training@edcwifi.com!
See you again

EDCwifi - Andrew Zheng

22

2015, April 17 - Vietnam MUM

You might also like

pFad - Phonifier reborn

Pfad - The Proxy pFad of © 2024 Garber Painting. All rights reserved.

Note: This service is not intended for secure transactions such as banking, social media, email, or purchasing. Use at your own risk. We assume no liability whatsoever for broken pages.


Alternative Proxies:

Alternative Proxy

pFad Proxy

pFad v3 Proxy

pFad v4 Proxy