Answer the question
In order to leave comments, you need to log in
Mikrotik: how to set up a route for one of the addresses arrived via BGP?
I have little experience in Mikrotik settings, I'm trying to set up blocking bypass according to the article: https://habr.com/post/413049/.
The VPN tunnel is already working and tested, but there is the following problem: the data arriving via BGP contains the range in which the IP of my VPN server is located (although it is not blocked, but for some reason it is there), as a result of which the route apparently loops and VPN on the router stops working at all.
I plan to solve this problem by creating a static route that will send packets to the VPN IP address on the WAN. I tried to solve the problem head-on (ether1 - WAN, 1.2.3.4 - VPN server IP): /ip route add dst-address=1.2.3.4 gateway=ether1
, after that the VPN immediately stops working, even with BGP turned off.
The questions are:
1) Why does the rule break the VPN?
2) Is it possible to solve this problem at all through a similar static route, and how, in this case, will the priorities of such routes be configured over those that arrive via BGP?
3) If my option is wrong, please tell me how to solve this problem correctly?
Thanks a lot!
---
UPD: I also tried to do it through the mangle - the VPN connection does not disappear before the BGP rules are enabled, then everything falls off again:
/ip route add dst-address=0.0.0.0/0 gateway=ether1 routing-mark=DIRECT-mark
/ip firewall nat add chain=srcnat out-interface=ether1 action=masquerade
/ip firewall mangle add chain=prerouting dst-address-list=DIRECT action=mark-routing new-routing-mark=DIRECT-mark
/ip firewall address-list add list=DIRECT address=1.2.3.4
Answer the question
In order to leave comments, you need to log in
/routing filter should help.
3) Approach curve. In any case, many thanks to the author of the original article, but this is from the "see how I can" series.
Subnets go into blocking in batches, do you definitely need all these routes on the router? On microte, it has long been possible to shove a domain name into the address of the sheet, hang the routing mark in the mangle and wrap it in the tunnel.
P.S.
gateway=ether1 - this is where the gateway should be.
Didn't find what you were looking for?
Ask your questionAsk a Question
731 491 924 answers to any question