Geekzone: technology news, blogs, forums
Guest
Welcome Guest.
You haven't logged in yet. If you don't have an account you can register now.




3182 posts

Uber Geek
+1 received by user: 988

Subscriber

Topic # 148776 30-Jun-2014 21:18
Send private message

Just a quick one that maybe someone on here knows the answer to - this forum is a bit more friendly than Mikrotiks.

I have my routing that has two PPPoE WAN interfaces on it. Lets say they are pppoe-wan1 & pppoe-wan2

The first interface (pppoe-wan1) is just for the entire network (192.168.2.0/24), the other (pppoe-wan2) I just want one host (192.168.2.250) to go out over it.

From reading, and from my general thoughts, I thought it would be fairly simple and did the following....

- Create Mangle rule.
     - Chain: prerouting, src address: 192.168.2.250
     - Action: mark routing, new routing mark: server_host

- Create second 'default' route but only for marked traffic.
     - dst address: 0.0.0.0/0
     - gateway: pppoe-wan2
     - routing mark: server_host

- Add another NAT masquerade rule to NAT single host to the second gateway
     - Chain: src nat
     - Src addr: 192.168.2.250
     - Out int: pppoe-wan2
     - Action: masquerade

Now the issue I am seeing is that as soon as I enable the Mangle rule I loose connectivity to the host. When I try to load the web page on the server I see the packet counters go up by the Mangle rule so it is obviously matching packets. But, as I mentioned, I never actually get connectivity to it unless the mangle rule is disabled.

Any one got any pointers and where I am going wrong? Going a bit mad reading different wiki's and forum posts!
     

View this topic in a long page with up to 500 replies per page Create new topic
 1 | 2
214 posts

Master Geek
+1 received by user: 10


  Reply # 1078038 1-Jul-2014 16:08
Send private message

Hi Sam,

Where are you testing from?  ie.  where do you lose connection from?  The internet or local network?



3182 posts

Uber Geek
+1 received by user: 988

Subscriber

  Reply # 1078064 1-Jul-2014 16:49
Send private message

The local network looses connection to the server. Can't ping from a local machine or from the router itself, but only when the mangle rule is enabled. Haven't actually tested from the server yet.... will have another fiddle tonight.

My understanding of a routing mark is that it doesn't actually do anything to the packet itself and is only usable within routeros, but maybe it is screwing something up deeper.

 
 
 
 


214 posts

Master Geek
+1 received by user: 10


  Reply # 1078111 1-Jul-2014 17:43
Send private message

I'm not near a computer at the moment to look (on my phone at the pub) but in the mangle rule is there something to do with next action or something that should be set to forward?



3182 posts

Uber Geek
+1 received by user: 988

Subscriber

  Reply # 1078113 1-Jul-2014 17:48
Send private message

The 'action' in mangle is to simply mark the packet with a routing mark. There is a 'passthrough' checkbox but I have tried that both ticked and unticked and makes no difference.

607 posts

Ultimate Geek
+1 received by user: 119


  Reply # 1078123 1-Jul-2014 18:01
Send private message

I would be more inclined to just create an ip-->route-->rules for the 192.168.2.250/32 address to use a seperate route table, and that route table have a different default route address, or interface. Unless you want 192.168.2.250 to use the default route on the main table but only a single route entry for the server IP address to use the pppoe2 interface.

Or would that not work?

You'd still need to use masquerade if your PPPoE is on the public Internet but I don't see why you'd need to use mangle.

214 posts

Master Geek
+1 received by user: 10


  Reply # 1078124 1-Jul-2014 18:06
Send private message

Passthrough was the option I was thinking of

2242 posts

Uber Geek
+1 received by user: 353

Trusted
Subscriber

  Reply # 1078125 1-Jul-2014 18:08
Send private message

chevrolux: 

Now the issue I am seeing is that as soon as I enable the Mangle rule I loose connectivity to the host
     


But that's what a hide NAT does, it only allows outbound connections. From the server you'll be able to initiate outbound connections just fine.

607 posts

Ultimate Geek
+1 received by user: 119


  Reply # 1078126 1-Jul-2014 18:10
Send private message

Just another thought. I've had problems when I have had a default route set to a specific interface rather than specify the nexthop IP address.

607 posts

Ultimate Geek
+1 received by user: 119


  Reply # 1078128 1-Jul-2014 18:12
Send private message

insane:
chevrolux: 

Now the issue I am seeing is that as soon as I enable the Mangle rule I loose connectivity to the host
     


But that's what a hide NAT does, it only allows outbound connections. From the server you'll be able to initiate outbound connections just fine.


Ah I miss understood the problem. You'd need to create a port mapping too. I didn't realise you're talking about accessing 192.168.2.250 from the Internet not the other way around.

214 posts

Master Geek
+1 received by user: 10


  Reply # 1078132 1-Jul-2014 18:28
Send private message

No he loses connection from the local LAN, from a host on the same subnet



3182 posts

Uber Geek
+1 received by user: 988

Subscriber

  Reply # 1078139 1-Jul-2014 18:44
Send private message

kiwirock:
insane:
chevrolux: 

Now the issue I am seeing is that as soon as I enable the Mangle rule I loose connectivity to the host
     


But that's what a hide NAT does, it only allows outbound connections. From the server you'll be able to initiate outbound connections just fine.


Ah I miss understood the problem. You'd need to create a port mapping too. I didn't realise you're talking about accessing 192.168.2.250 from the Internet not the other way around.


It's not NAT that I am having issues with. I fully understand what masquerade does and it isn't access from internet that is the issue.

The issue I have is this mangle rule is mucking things up internally. Supposedly the packet should just get marked and move on but that's not happening.

I feel like the issue is probably with the route tables and it might be a case of just going through each step (again!) and checking everything is in place.



3182 posts

Uber Geek
+1 received by user: 988

Subscriber

  Reply # 1078167 1-Jul-2014 19:07
Send private message

Right, just did some tests from the server.

When I enable the mangle rule I have connectivity from the server to the internet AND it is even going out over the correct WAN (pppoe-wan2). Tested this just by doing a traceroute. The really weird thing is I can't ping the local gateway yet it shows up in the traceroute.

I think the issue I have is totally up to the routing table and not the the actual mangle rule.

25673 posts

Uber Geek
+1 received by user: 5419

Moderator
Trusted
Biddle Corp
Subscriber

  Reply # 1078188 1-Jul-2014 19:55
Send private message

Multiple PPPoE clients are just a mess because of the default route issue. I only configure multiple IPs via static IP addresses and offer this to my customers, it's a far simpler option and means you just need a simple masquerade rules to easily route traffic based on a source IP with the correct public IP and you're away.



2334 posts

Uber Geek
+1 received by user: 370

Trusted

  Reply # 1078215 1-Jul-2014 20:51
Send private message

I have similar set up and used it for a long time (but I use it to send my TV's IP Address out via a StrongVPN Connection instead of the normal internet connection for Netflix)
. Reading your post it seems "ok" but double check...

- set up 2 interfaces
- set up NAT rule for both interfaces (srcnat out wan1 -> MASQ, and srcnat out wan2 -> MASQ)
- set up default gateway out the 1st connection (make sure you can swap it over to the 2nd one and it works as well)
- set up default gateway out the 2nd but make sure its set routing mark to be called say "server"
- set up Mangle - Prerouting - src_addr (of the server) - action  mark routing to new routing mark to "server" and make sure Passthough is enabled

One thing to note.. make sure you are running the latest version of software (system packages) _AND_ are running the latest firmware (System, Routerboard) or things can go strangely/not work. people forget a lot of the time to upgrade their firmware when upgrading their software.

 



3182 posts

Uber Geek
+1 received by user: 988

Subscriber

  Reply # 1078236 1-Jul-2014 21:09
Send private message

LennonNZ: I have similar set up and used it for a long time (but I use it to send my TV's IP Address out via a StrongVPN Connection instead of the normal internet connection for Netflix)
. Reading your post it seems "ok" but double check...

- set up 2 interfaces
- set up NAT rule for both interfaces (srcnat out wan1 -> MASQ, and srcnat out wan2 -> MASQ)
- set up default gateway out the 1st connection (make sure you can swap it over to the 2nd one and it works as well)
- set up default gateway out the 2nd but make sure its set routing mark to be called say "server"
- set up Mangle - Prerouting - src_addr (of the server) - action  mark routing to new routing mark to "server" and make sure Passthough is enabled

One thing to note.. make sure you are running the latest version of software (system packages) _AND_ are running the latest firmware (System, Routerboard) or things can go strangely/not work. people forget a lot of the time to upgrade their firmware when upgrading their software.

 


Yep that's exactly what I have. Been through each step so many times. At this point I am fairly convinced it is the routing tables that are the issue.

And yes, running ROS 6.15 & 3.10 firmware - TBH though only did that upgrade yesterday due to the same thought process you had that maybe an old version had an issue.

 1 | 2
View this topic in a long page with up to 500 replies per page Create new topic



Twitter »

Follow us to receive Twitter updates when new discussions are posted in our forums:



Follow us to receive Twitter updates when news items and blogs are posted in our frontpage:



Follow us to receive Twitter updates when tech item prices are listed in our price comparison site:





News »

UAV Traffic Management Trial launching today in New Zealand
Posted 12-Dec-2017 16:06


UFB connections pass 460,000
Posted 11-Dec-2017 11:26


The Warehouse Group to adopt IBM Cloud to support digital transformation
Posted 11-Dec-2017 11:22


Dimension Data peeks into digital business 2018
Posted 11-Dec-2017 10:55


2018 Cyber Security Predictions
Posted 7-Dec-2017 14:55


Global Govtech Accelerator to drive public sector innovation in Wellington
Posted 7-Dec-2017 11:21


Stuff Pix media strategy a new direction
Posted 7-Dec-2017 09:37


Digital transformation is dead
Posted 7-Dec-2017 09:31


Fake news and cyber security
Posted 7-Dec-2017 09:27


Dimension Data New Zealand strengthens cybersecurity practice
Posted 5-Dec-2017 20:27


Epson NZ launches new Expression Premium Photo range
Posted 5-Dec-2017 20:26


Eventbrite and Twickets launch integration partnership in Australia and New Zealand
Posted 5-Dec-2017 20:23


New Fujifilm macro lens lands in New Zealand
Posted 5-Dec-2017 20:16


Cyber security not being taken seriously enough
Posted 5-Dec-2017 20:13


Sony commences Android 8.0 Oreo rollout in New Zealand
Posted 5-Dec-2017 20:08



Geekzone Live »

Try automatic live updates from Geekzone directly in your browser, without refreshing the page, with Geekzone Live now.



Are you subscribed to our RSS feed? You can download the latest headlines and summaries from our stories directly to your computer or smartphone by using a feed reader.

Alternatively, you can receive a daily email with Geekzone updates.