A
A
Alexey Rusakov2016-05-13 15:08:28
System administration
Alexey Rusakov, 2016-05-13 15:08:28

Mikrotik: 2 gateways. No ping between marked local addresses. How to be?

There is a piece of iron Mikrotik with two gateways to the Internet.
Interfaces:
eth1-Provider1
eth2-Provider2
eth3-Local
Subnets (split /24 for convenience):
/ip pool> print detail
0 ranges=172.16.19.32/27
1 ranges=172.16.19.64/26
2 ranges= 172.16.19.128/26
3 ranges=172.16.19.192/26
Marking:
/ip route rule> print detail
Flags: X - disabled, I - inactive
0 src-address=172.16.19.64/26 action=lookup table =out2
1 src-address=172.16.19.192/26 action=lookup table=out1
2 src-address=172.16.19.128/26 action=lookup table=out2
3 src-address=172.16.19.32/27 action=lookup table=out1
Two routes to providers:
0 AS dst-address=0.0.0.0/0 pref-src=172.16.19.1 gateway=pppoe-out1
gateway-status=pppoe- out1 reachable distance=1 scope=30 target-scope=10
routing-mark=out1
1 AS dst-address=0.0.0.0/0 pref-src=172.16.19.1 gateway=pppoe-out2
gateway-status=pppoe-out2 reachable distance =1 scope=30 target-scope=10
routing-mark=out2
Forwarding to providers' gateways works fine, computers go where they need to. BUT! Pings between local subnets do not go. If you remove the routes, then everything is fine. Computers are available only from their subnet. If I do the marking personally for each IP, then in general they won’t reach a single one in LAN, only the Mikrotik address is available. The trace shows that the request goes past the Mikrotik to the provider.
What is the rule to win? It is necessary that they go to the Internet to the specified gateway, and there was accessibility between the computers.

Answer the question

In order to leave comments, you need to log in

2 answer(s)
S
satoo, 2016-05-13
@yarusakov

What are Mikrotik's local addresses?
at local computers what subnet mask and the gateway?
Show

/ip route print
/ip address print

D
Dmitry Shitskov, 2016-05-13
@Zarom

Try adding routes for each subnet. You essentially have only 2 routes now, and both of them are by default, where all traffic goes, incl. local gateway.
And why do you have routes to providers? Are you getting traffic?
Probably, an alternative option is possible - to mark the traffic (or immediately nat), heading not to 172.16.19.0/24 with a firewall, but not with routing rules.

Didn't find what you were looking for?

Ask your question

Ask a Question

731 491 924 answers to any question