Using a second ISP to forward for Nat Mikrotik?

Question

Mikrotik

Hello again. Thanks to everyone who helped with the last question.
Now a new question has arisen.
So. There is a local network (for example 1.1.1.1) and two providers (for example 10.10.10.10 and 20.20.20)
There is a host in the local network for which you need to broadcast for nat 443 and 80 port. Everything would be fine, but port 443 is used for sstp.
Question. Is it possible to use the white address of the second provider for this purpose?
If yes, then tell me how?

Answer 1

Dear qq . It's not nice to say that, but please learn the swear part. And experiment not in your office, but in a test environment :)
Of course, I can be wrong, but, in fact, you did a round robin between 2 gateways. And in a very unfortunate way. Your packets will randomly run through different gateways without taking into account established connections. What happened next: initially, for example, a connection to google.com arrived from ip 10.10.10.10, and the next packet left from ip 20.20.20.20, which made Google a little crazy. Hence the lags of the Internet. Return as it was :)
On the topic of how to solve your question.
So that we can understand each other better.
1) Let the IP from the main provider that is used for SSTP 10.10.10.10
2) For port forwarding, we want to use the second provider: 20.20.20.20 3
) ip address of the piece of
hardware in the local area to which we want to forward ports : dst-nat chain=dstnat dst-address=20.20.20.20 dst-port=80 protocol=\ tcp to-addresses=1.1.1.2 to-ports=80 add action=dst-nat chain=dstnat dst-address=20.20.20.20 dst-port=443 protocol=\ tcp to-addresses=1.1.1.2 to-ports=443
But suddenly it doesn’t work :) Why, yes, because it turns out that the client sends a request to ip 20.20.20.20, and the response comes from ip 10.10.10.10 and the client simply discards it, because he didn’t ask anything from 10.10.10.10 . In other words, our task is to make sure that responses from the server also leave with ip 20.20.20.20, but here we are faced with the following problem, the default router does not look at the source address, when it decides to route the packet, it only looks at the destination address!. To solve this problem, such a thing as Policy Based Routing was invented. In Mikrotik, it can be implemented in a bunch of ways. Most flexible using Mangle. The simplest one is using routing rules.
First we need to create a 2nd routing table, let's call it ""2nd ISP" and in it the default route where the gateway 20.20.20.20 is the main one, this is done very simply:
/ip route add distance=1 gateway=20.20.20.20 routing-mark ="2nd ISP"
Now we need to explain to Mikrotik that we need to send traffic from the conditional web server exactly to this routing table. This is done using routing rules.
/ip route rule add dst-address=0.0.0.0/0 src-address =1.1.1.2/32 table="2nd ISP"
Now it should work fine outside. Separately, I draw your attention to the fact that I do not know your entire topology and the use of those scripts that I wrote may lead to the fact that something will fall off for you. For example, that 1.1.1.2 will not be available from the second office. I also advise you to pay attention to the article https://habr.com/post/313342/ there is a slightly different case, but the theoretical base is the same :)
PS If there are questions, I am ready to answer them in Telegram

Answer 2

/ip route
add distance=1 gateway=\
10.10.10.10,20.20.20.20
It seems to work. But there were problems with the Internet. Began to put it mildly.