Answer the question
In order to leave comments, you need to log in
Is the gateway on a different subnet unreachable for tagged traffic?
Two Mikrotiks. Connected by GRE tunnel. Hosts from both subnets (192.168.99.0/24 and 192.168.77.0/24) see each other.
There was a need to redirect http traffic to squid (192.168.99.55). Added to the mangle table and to the routes (with the corresponding changes in subnet addresses):
/ip firewall mangle
chain=prerouting action=mark-routing new-routing-mark=web passthrough=yes protocol=tcp src-address=!192.168.99.55 dst-address=!192.168.99.0/24
src-address-list=http_to_squid dst-port=80
/ip route
dst-address=0.0.0.0/0 gateway=192.168.99.55 distance=1 scope=30 target-scope=10
routing-mark=web
Answer the question
In order to leave comments, you need to log in
In general, I figured it out by reading the manual .
Value of gateway can be specified as an interface name instead of the nexthop IP address. Such route has the following special properties:
Unlike connected routes, routes with interface nexthops are not used for nexthop lookup.
And since I had a long-standing habit (for the convenience of addressing reconfiguration) to specify the interface name, and not the IP address, as the gateway to vpn subnets, such a gag arose.
In general, it worked as soon as I changed:
on the
And also changed the target-scope=30 value in the tagged traffic route to the squid:
Thanks to all.
Didn't find what you were looking for?
Ask your questionAsk a Question
731 491 924 answers to any question