VPN MikroTik - how to split traffic?

Question

Mikrotik

Good afternoon, comrades.
The point is this:
There is a main microtic with white static (more precisely, it is not there yet, I think which one will be better). And there are many branches - more than 30, each also has microtics like RB750. The subnets in each branch are different.
I would like to raise a VPN with the main Mikrotik as a server, the rest of the Mikrotiks as clients. But I want not all traffic to go through the tunnel, but only from certain ip-addresses of the client's local network. Those. the main traffic also went through the provider, but only some ip addresses through the VPN. There is also an idea to let all http traffic through a proxy to a proxy server raised on the same main Mikrotik.
I ask for help in setting up and advice on the model of the main mikrotik.

Answer 1

Colleague, in general, you can set up tunnels and raise routing without any problems. Use l2tp (if the client side is gray) or GRE (if the client side is white addresses), plus IPSec encryption in transport mode. You make routes either static (but at 30+ this is something else), or raise OSPF (in general, this is simple).
To route individual clients or a particular type of traffic - just use separate routing tables and traffic markings in the mangle. No proxy will be needed in this case.
In more detail, then:
1. The tunnels were raised, the routes were set up.
2. Created a separate routing table, where the default gateway will be the address from the central mikrotik tunnel
3. We created a mangle mark route rule where in the criteria you select the traffic you need (either all or specific from a specific client \ protocol \ port) and in action you specify the same routing table. This action will send the marked traffic to the center, from where it will go outside through the provider in the center.

Answer 2

I ask for help in setting up and advice on the model of the main mikrotik.

Get routerOS and install on x86.

Answer 3

in the general case, judging by your questions, this device will do: http://mikrotik.rf/katalog/oborudovanie_mikrotik/c...