Форуми

Май ми се получиха нещата след модификация на мангъл правилото:   /ip firewall mangle add action=mark-routing chain=prerouting comment="for LAN address output from isp1 5.0" dst-address=!192.168.5.0/24 \ new-routing-mark=to_ISP1 passthrough=no src-address-list=stat-isp1 За сега изглежда работещо, ще тествам известно време и ще пиша дали е ок.

Разбрах къде бъркам с pcc и сега работи със скрипта от горния линк . Остава ми обаче как да накарам определен хост от частната мрежа да излиза само през етх1 ван порта,пробвах така: /ip firewall address-list add list=stat-isp1 address=192.168.5.34 /ip firewall mangle add action=mark-routing chain=prerouting comment="Mark STATIC route to ISP1" disabled=yes dst-address-list=!local \ dst-address-type=!local in-interface-list=LAN new-routing-mark=to_ISP1 passthrough=yes src-address-list=stat-isp1 Не сработва,правилото трупа пакети на броячите си но пак си ми излиза ту през единия ту през другия интерфейс.

С тази промяна всичко започна да излиза през етх2, точно обратното на това което беше. През етх1 не минава нищо. Сега е така:   4  As   dst-address=0.0.0.0/0 routing-table=isp2 gateway=1.1.1.1 immediate-gw=151.251.192.173%ether2 check-gateway=ping          distance=1 scope=30 target-scope=11 suppress-hw-offload=no  5   s   dst-address=0.0.0.0/0 routing-table=isp2 gateway=8.8.8.8 immediate-gw=91.139.192.1%ether1 check-gateway=ping distance=2          scope=30 target-scope=11 suppress-hw-offload=no     Tracing route to abv.bg [194.153.145.104] over a maximum of 30 hops:   1     1 ms     1 ms    <1 ms  192.168.5.1   2     2 ms     2 ms     1 ms  151.251.192.173   3     *        *        *     Request timed out.   4     *        *        *     Request timed out.   5   132 ms    39 ms    23 ms  178.132.83.22   6   109 ms   146 ms   159 ms  178.132.83.18   7   390 ms   151 ms   166 ms  178.132.80.65   8   152 ms   153 ms   167 ms  94.72.148.139   9   250 ms    25 ms    31 ms  194.153.145.104     Започнах да губя надежда с този начин. Ще се върна май на схемата по долу само да разбера защо ми спира достъпа това правило до мрежа 20.0:  

Смени дистънса на 4ти маршрут да е 1, а 5ти да е 2 сега е обратната: 4 s dst-address=0.0.0.0/0 routing-table=isp2 gateway=1.1.1.1 immediate-gw=151.251.192.173%ether2 check-gateway=ping distance=2 scope=30 target-scope=11 suppress-hw-offload=no 5 As dst-address=0.0.0.0/0 routing-table=isp2 gateway=8.8.8.8 immediate-gw=91.139.192.1%ether1 check-gateway=ping distance=1 scope=30 target-scope=11 suppress-hw-offload=no това ти е грешката!

Компа от който тествам е само на кабел, ето route:   ip/route/print detail Flags: D - dynamic; X - disabled, I - inactive, A - active; c - connect, s - static, r - rip, b - bgp, o - ospf, i - is-is, d - dhcp, v - vpn, m - modem, y - bgp-mpls-vpn; H - hw-offloaded; + - ecmp 0 As dst-address=0.0.0.0/0 routing-table=main gateway=8.8.8.8 immediate-gw=91.139.192.1%ether1 check-gateway=ping distance=1 scope=30 target-scope=11 suppress-hw-offload=no 1 s dst-address=0.0.0.0/0 routing-table=main gateway=1.1.1.1 immediate-gw=151.251.192.173%ether2 check-gateway=ping distance=2 scope=30 target-scope=11 suppress-hw-offload=no D d dst-address=0.0.0.0/0 routing-table=main gateway=151.251.192.173 immediate-gw=151.251.192.173%ether2 distance=4 scope=30 target-scope=10 vrf-interface=ether2 D d dst-address=0.0.0.0/0 routing-table=main gateway=91.139.192.1 immediate-gw=91.139.192.1%ether1 distance=3 scope=30 target-scope=10 vrf-interface=ether1 2 As ;;; isp2 dst-address=1.1.1.1/32 routing-table=main gateway=151.251.192.173 immediate-gw=151.251.192.173%ether2 distance=1 scope=10 target-scope=10 3 As ;;; isp1 dst-address=8.8.8.8/32 routing-table=main gateway=91.139.192.1 immediate-gw=91.139.192.1%ether1 distance=1 scope=10 target-scope=10 DAc dst-address=10.1.10.0/24 routing-table=main gateway=bridge-guest immediate-gw=bridge-guest distance=0 scope=10 target-scope=5 local-address=10.1.10.1%bridge-guest DAc dst-address=91.139.192.0/21 routing-table=main gateway=ether1 immediate-gw=ether1 distance=0 scope=10 target-scope=5 local-address=91.139.199.220%ether1 DAc dst-address=151.251.192.168/29 routing-table=main gateway=ether2 immediate-gw=ether2 distance=0 scope=10 target-scope=5 local-address=151.251.192.172%ether2 DAc dst-address=192.168.5.0/24 routing-table=main gateway=bridge-LAN immediate-gw=bridge-LAN distance=0 scope=10 target-scope=5 local-address=192.168.5.1%bridge-LAN DAc dst-address=192.168.6.0/24 routing-table=main gateway=wireguard-server1 immediate-gw=wireguard-server1 distance=0 scope=10 target-scope=5 local-address=192.168.6.1%wireguard-server1 DAc dst-address=192.168.10.0/24 routing-table=main gateway=bridge-vlan10 immediate-gw=bridge-vlan10 distance=0 scope=10 target-scope=5 local-address=192.168.10.1%bridge-vlan10 DAc dst-address=192.168.20.0/24 routing-table=main gateway=vlan20-HA immediate-gw=vlan20-HA distance=0 scope=10 target-scope=5 local-address=192.168.20.1%vlan20-HA 4 s dst-address=0.0.0.0/0 routing-table=isp2 gateway=1.1.1.1 immediate-gw=151.251.192.173%ether2 check-gateway=ping distance=2 scope=30 target-scope=11 suppress-hw-offload=no 5 As dst-address=0.0.0.0/0 routing-table=isp2 gateway=8.8.8.8 immediate-gw=91.139.192.1%ether1 check-gateway=ping distance=1 scope=30 target-scope=11 suppress-hw-offload=no 6 s ;;; isp2 dst-address=0.0.0.0/0 routing-table=isp2 gateway=151.251.192.173 immediate-gw=151.251.192.173%ether2 distance=3 scope=30 target-scope=10 7 s ;;; isp1 dst-address=0.0.0.0/0 routing-table=isp2 gateway=91.139.192.1 immediate-gw=91.139.192.1%ether1 distance=4 scope=30 target-scope=10 8 As ;;; isp1 dst-address=1.1.1.1/32 routing-table=isp2 gateway=91.139.192.1 immediate-gw=91.139.192.1%ether1 distance=1 scope=10 target-scope=10 suppress-hw-offload=no 9 As ;;; isp2 dst-address=8.8.8.8/32 routing-table=isp2 gateway=151.251.192.173 immediate-gw=151.251.192.173%ether2 distance=1 scope=10 target-scope=10 10 As dst-address=91.139.192.0/21 routing-table=isp2 gateway=ether1 immediate-gw=ether1 distance=1 scope=10 target-scope=10 11 As dst-address=151.251.192.168/29 routing-table=isp2 gateway=ether2 immediate-gw=ether2 distance=1 scope=10 target-scope=10 12 As dst-address=192.168.5.0/24 routing-table=isp2 gateway=bridge-LAN immediate-gw=bridge-LAN distance=1 scope=10 target-scope=10 13 As dst-address=192.168.10.0/24 routing-table=isp2 gateway=bridge-vlan10 immediate-gw=bridge-vlan10 distance=1 scope=10 target-scope=10 suppress-hw-offload=no 14 As dst-address=192.168.20.0/24 routing-table=isp2 gateway=vlan20-HA immediate-gw=vlan20-HA distance=1 scope=10 target-scope=10 suppress-hw-offload=no