Load balansing PCC problem

August 15, 2010

Мъча се да направя лоад балансинг с 2 ADSL-a

прочетох всичко исписано във wiki.mikrotik.com и като че ли този пример най ми най хареса http://wiki.mikrotik.com/wiki/Manual:PCC , но срещам малко проблем и доста неизвестни

Версията на Микротика е 3.30 lvl 4

/ip firewal mangle

add action=mark-connection chain=input comment=LoadBalansing_PCC disabled=no in-interface=WAN1 \

    new-connection-mark=WAN1_conn passthrough=yes

add action=mark-connection chain=input comment="" disabled=no in-interface=WAN2 new-connection-mark=\

    WAN2_conn passthrough=yes

add action=mark-routing chain=output comment="" connection-mark=WAN1_conn disabled=no \

    new-routing-mark=to_WAN1 passthrough=yes

add action=mark-routing chain=output comment="" connection-mark=WAN2_conn disabled=no \

    new-routing-mark=to_WAN2 passthrough=yes

add action=accept chain=prerouting comment="" disabled=no dst-address=192.168.2.0/24 in-interface=\

    bridge1

add action=accept chain=prerouting comment="" disabled=no dst-address=192.168.1.0/24 in-interface=\

    bridge1

add action=mark-connection chain=prerouting comment="" disabled=no dst-address-type=!local \

    in-interface=bridge1 new-connection-mark=WAN1_conn passthrough=yes per-connection-classifier=\

    both-addresses:2/0

add action=mark-connection chain=prerouting comment="" disabled=no dst-address-type=!local \

    in-interface=bridge1 new-connection-mark=WAN2_conn passthrough=yes per-connection-classifier=\

    both-addresses:2/1

add action=mark-routing chain=prerouting comment="" connection-mark=WAN1_conn disabled=no \

    in-interface=bridge1 new-routing-mark=to_WAN1 passthrough=yes

add action=mark-routing chain=prerouting comment="" connection-mark=WAN2_conn disabled=no \

    in-interface=bridge1 new-routing-mark=to_WAN2 passthrough=yes



add action=mark-connection chain=prerouting comment="" disabled=no new-connection-mark=1st_conn \

    passthrough=yes per-connection-classifier=src-address-and-port:3/0

add action=mark-connection chain=prerouting comment="" disabled=no new-connection-mark=2nd_conn \

    passthrough=yes per-connection-classifier=src-address-and-port:3/1

add action=mark-connection chain=prerouting comment="" disabled=no new-connection-mark=3rd_conn \

    passthrough=yes per-connection-classifier=src-address-and-port:3/2

/ip route

add check-gateway=ping comment=LoadBalansing_PCC disabled=no distance=1 dst-address=0.0.0.0/0 gateway=\

    192.168.1.1 routing-mark=to_WAN2 scope=30 target-scope=10

add check-gateway=ping comment=LoadBalansing_PCC disabled=no distance=1 dst-address=0.0.0.0/0 gateway=\

    192.168.2.1 routing-mark=to_WAN1 scope=30 target-scope=10

add check-gateway=ping comment=¨¨ disabled=no distance=1 dst-address=0.0.0.0/0 \

    gateway=192.168.2.1,192.168.1.1 scope=30 target-scope=10

/ip firewall nat

add action=masquerade chain=srcnat comment="masquerade WAN1 network" disabled=no out-interface=WAN1

add action=masquerade chain=srcnat comment="masquerade WAN2 network" disabled=no out-interface=WAN2

/ip address

add address=10.10.10.1/24 broadcast=10.10.10.255 comment="hotspot network" disabled=no interface=\

    bridge1 network=10.10.10.0

add address=192.168.1.40/24 broadcast=192.168.1.255 comment="" disabled=no interface=WAN2 network=\

    192.168.1.0

add address=192.168.2.40/24 broadcast=192.168.2.255 comment="" disabled=no interface=WAN1 network=\

    192.168.2.0

Като цяло това нещо работи , но не съм много сигурен до колко добре ....

може ли някой занимамавал се е с това да каже дали всичко е наред , понеже виждам доста неща които не мога да си ги обесня за мен ,

например Първият проблем е , в ip firewal mangle последните 3 правила тези 1st_conn ,2st_conn и 3st_conn не виждам да се ползват за нещо , а ако преместиа правилата на горна позициа и дори и да ги деактивирам и нета спира

после , незнам има ли начин един от АДСЛ ите да е с малко по голиам преоритет , понеже на единия нета е по слаб от дръгия,

и още един въпрос , понеже имам намерение да взема още един АДСЛ какво ше трябва да добавя за да го натикам в бозата

И изобщо това ли е най добрия вариянт за load balans в моя случай

August 16, 2010

този мануал има грешен подход

целта е не всяка следваща конекция да излиза на поредния външен линк

а конекциите от един потребител да са на една външна връзка

August 16, 2010

този мануал има грешен подход

целта е не всяка следваща конекция да излиза на поредния външен линк

а конекциите от един потребител да са на една външна връзка

ще те помоля ако имаш направено решение на това ,ако може да експортнеш ще съм благодарен

August 16, 2010

като за начало ги бриджни и и вкарай директно ррроа интерфейсите в микротика

за да може при отпадане на връзката да не се налага да правиш скриптови опражнения за проверка на "еди кой си хоп в посока интернет"



/ppp profile

add change-tcp-mss=yes comment="" name=default-compression-MSS only-one= default use-compression=yes use-encryption=no use-vj-compression=yes


/interface pppoe-client

add ac-name="" add-default-route=no allow=pap,chap,mschap1,mschap2 comment=""  dial-on-demand=no disabled=no interface=WAN2 name=vc1 password=xxxxxxxxxxxxxxxx  profile=default-compression-MSS service-name="" use-peer-dns=no user=yyyyyyyyyyyyyyyy

add ac-name="" add-default-route=no allow=pap,chap,mschap1,mschap2 comment=""  dial-on-demand=no disabled=no interface=WAN name=vc2 password=xxxxxxxxxxxxxxxx profile= default-compression-MSS service-name="" use-peer-dns=no user=yyyyyyyyyyyyyyyy


/ip firewall mangle

add action=mark-connection chain=input comment="Routing fixation"  connection-state=new disabled=no in-interface=vc1  new-connection-mark=Out_vc1 passthrough=yes

add action=mark-routing chain=output comment="" connection-mark=Out_vc1  disabled=no new-routing-mark=TO_vc1 passthrough=yes

add action=mark-connection chain=input comment="" connection-state=new  disabled=no in-interface=vc2 new-connection-mark=Out_vc2 passthrough= yes

add action=mark-routing chain=output comment="" connection-mark=Out_vc2  disabled=no new-routing-mark=TO_vc2 passthrough=yes

add action=mark-connection chain=postrouting comment="" connection-state=new  disabled=no new-connection-mark=Out_vc1 out-interface=vc1  passthrough=yes

add action=mark-routing chain=output comment="" connection-mark=Out_vc1  disabled=no new-routing-mark=TO_vc1 passthrough=yes

add action=mark-routing chain=prerouting comment="" connection-mark= Out_vc1 disabled=no in-interface=!vc1 new-routing-mark=TO_vc1  passthrough=yes

add action=mark-connection chain=postrouting comment="" connection-state=new  disabled=no new-connection-mark=Out_vc2 out-interface=vc2 passthrough= yes

add action=mark-routing chain=output comment="" connection-mark=Out_vc2  disabled=no new-routing-mark=TO_vc2 passthrough=yes

add action=mark-routing chain=prerouting comment="" connection-mark=Out_vc2  disabled=no in-interface=!vc2 new-routing-mark=TO_vc2 passthrough=yes

add action=mark-routing chain=output comment="" disabled=no new-routing-mark= TO_vc1 passthrough=yes protocol=gre


/ip route

add comment="Route only..." disabled=no distance=1 dst-address=0.0.0.0/0  gateway=vc2 routing-mark=TO_vc2

add check-gateway=arp comment= "Everything: ECMP Route - provides load balancing+failover" disabled=no  distance=20 dst-address=0.0.0.0/0 gateway=vc1,vc2

add comment="Route only packets with routing mark To_vc1" disabled=no  distance=1 dst-address=0.0.0.0/0 gateway=vc1 routing-mark=TO_vc1

add comment="Route only packets with routing mark To_vc2" disabled=no  distance=1 dst-address=0.0.0.0/0 gateway=vc2 routing-mark=TO_vc2


/ip firewall nat

add action=masquerade chain=srcnat comment="masquerade" disabled=no

[/code]

August 16, 2010

Ето в тази тема има описани доста начини http://mikrotik-bg.net/index.php?topic=1335.msg12045#msg12045

това долу работи при мен / с помощ на NetworkPro /

 


/ip firewall mangle

add action=mark-connection chain=input comment="Mark Incoming (to router itsel\

f) connections so their reply packets get routed to the interface the conn\

ections came in" connection-state=new disabled=no in-interface=ADSL \

new-connection-mark=Public_conn passthrough=yes

add action=mark-connection chain=input comment="" connection-state=new \

disabled=no in-interface=Public2 new-connection-mark=Public2_conn \

passthrough=yes

add action=mark-connection chain=output comment=\

"Mark Some Connection to INTERBILD and ADSL" connection-state=new \

disabled=no dst-address-list=To-Interbild new-connection-mark=\

Public2_conn passthrough=yes

add action=mark-connection chain=output comment="" connection-state=new \

disabled=no dst-address-list=To-ADSL new-connection-mark=Public_conn \

passthrough=yes

add action=accept chain=output comment="Prevent Outgoing connections to client\

s' IP addresses from being mangled and routed by PCC" disabled=no \

dst-address-list=clients

add action=mark-routing chain=output comment="" connection-mark=Public_conn \

disabled=no new-routing-mark=to_Public passthrough=yes

add action=mark-routing chain=output comment="" connection-mark=Public2_conn \

disabled=no new-routing-mark=to_Public2 passthrough=yes

add action=accept chain=prerouting comment="Accept rules - Prevent local conne\

ctions from being marked and sent to the Internet gateways where they woul\

d be dropped since the addresses wont match" disabled=no dst-address=\

83.228.60.254 src-address-list=clients

add action=accept chain=prerouting comment="" disabled=no dst-address=\

10.81.0.0/16 src-address-list=clients

add action=accept chain=prerouting comment="" disabled=no dst-address-list=\

clients src-address-list=clients

add action=mark-connection chain=prerouting comment=\

"Mark P2P Layer7 from clients as Public Connection" connection-state=new \

disabled=yes layer7-protocol=bittorrent new-connection-mark=Public_conn \

passthrough=yes

add action=mark-connection chain=prerouting comment="Mark connections from cli\

ents ip addresses w PCC balance before they get routed so they can be assi\

gned routing rules later and get routed" connection-state=new disabled=no \

dst-address-type=!local new-connection-mark=Public_conn passthrough=yes \

per-connection-classifier=both-addresses:2/0 src-address-list=clients

add action=mark-connection chain=prerouting comment="" connection-state=new \

disabled=no dst-address-type=!local new-connection-mark=Public2_conn \

passthrough=yes per-connection-classifier=both-addresses:2/1 \

src-address-list=clients

add action=mark-connection chain=prerouting comment=\

"Mark Some Connection to INTERBILD and ADSL" connection-state=new \

disabled=no dst-address-list=To-Interbild new-connection-mark=\

Public2_conn passthrough=yes src-address-list=clients

add action=mark-connection chain=prerouting comment="" connection-state=new \

disabled=no dst-address-list=To-ADSL new-connection-mark=Public_conn \

passthrough=yes src-address-list=clients

add action=mark-routing chain=prerouting comment="" connection-mark=\

Public_conn disabled=no new-routing-mark=to_Public passthrough=yes \

src-address-list=clients

add action=mark-routing chain=prerouting comment="" connection-mark=\

Public2_conn disabled=no new-routing-mark=to_Public2 passthrough=yes \

src-address-list=clients

 


/ip route

add check-gateway=ping comment="" disabled=no distance=1 dst-address=\

0.0.0.0/0 gateway=ADSL routing-mark=to_Public scope=255 target-scope=10

add check-gateway=ping comment="" disabled=no distance=1 dst-address=\

0.0.0.0/0 gateway=10.81.0.1 routing-mark=to_Public2 scope=30 \

target-scope=10

add check-gateway=ping comment="" disabled=no distance=2 dst-address=\

0.0.0.0/0 gateway=10.81.0.1 scope=30 target-scope=10

add check-gateway=ping comment="PCC Routes" disabled=no distance=3 \

dst-address=0.0.0.0/0 gateway=ADSL scope=255 target-scope=10

August 17, 2010

е то разлика няма

проблема е когато модем не е бриджнат и след него няма връзка

тогава имаш интерфейс на линия и липса на интернет

мой личен избор е делене 50/50 на клиентите на двете линии

и когато падне едната всички да отиват едната

а и задължително маркиране на портове от рода на :80 :443 да излизат задълже през единия интерфеис защото става мазало с доста сайтове и пощи

August 17, 2010

Благодаря много

October 16, 2010

е то разлика няма

проблема е когато модем не е бриджнат и след него няма връзка

тогава имаш интерфейс на линия и липса на интернет

мой личен избор е делене 50/50 на клиентите на двете линии

и когато падне едната всички да отиват едната

а и задължително маркиране на портове от рода на :80 :443 да излизат задълже през единия интерфеис защото става мазало с доста сайтове и пощи

Внимателно как се изказвате за моя конфигурация моята е по-добра и проблеми със сайтове няма. Не е нужно да се барат 80 и 443. Предвидено е в PCC-то.

August 3, 2013

като за начало ги бриджни и и вкарай директно ррроа интерфейсите в микротика

за да може при отпадане на връзката да не се налага да правиш скриптови опражнения за проверка на "еди кой си хоп в посока интернет"

/ppp profile
add change-tcp-mss=yes comment="" name=default-compression-MSS only-one= default use-compression=yes use-encryption=no use-vj-compression=yes

/interface pppoe-client
add ac-name="" add-default-route=no allow=pap,chap,mschap1,mschap2 comment=""  dial-on-demand=no disabled=no interface=WAN2 name=vc1 password=xxxxxxxxxxxxxxxx  profile=default-compression-MSS service-name="" use-peer-dns=no user=yyyyyyyyyyyyyyyy
add ac-name="" add-default-route=no allow=pap,chap,mschap1,mschap2 comment=""  dial-on-demand=no disabled=no interface=WAN name=vc2 password=xxxxxxxxxxxxxxxx profile= default-compression-MSS service-name="" use-peer-dns=no user=yyyyyyyyyyyyyyyy

/ip firewall mangle
add action=mark-connection chain=input comment="Routing fixation"  connection-state=new disabled=no in-interface=vc1  new-connection-mark=Out_vc1 passthrough=yes
add action=mark-routing chain=output comment="" connection-mark=Out_vc1  disabled=no new-routing-mark=TO_vc1 passthrough=yes
add action=mark-connection chain=input comment="" connection-state=new  disabled=no in-interface=vc2 new-connection-mark=Out_vc2 passthrough= yes
add action=mark-routing chain=output comment="" connection-mark=Out_vc2  disabled=no new-routing-mark=TO_vc2 passthrough=yes
add action=mark-connection chain=postrouting comment="" connection-state=new  disabled=no new-connection-mark=Out_vc1 out-interface=vc1  passthrough=yes
add action=mark-routing chain=output comment="" connection-mark=Out_vc1  disabled=no new-routing-mark=TO_vc1 passthrough=yes
add action=mark-routing chain=prerouting comment="" connection-mark= Out_vc1 disabled=no in-interface=!vc1 new-routing-mark=TO_vc1  passthrough=yes
add action=mark-connection chain=postrouting comment="" connection-state=new  disabled=no new-connection-mark=Out_vc2 out-interface=vc2 passthrough= yes
add action=mark-routing chain=output comment="" connection-mark=Out_vc2  disabled=no new-routing-mark=TO_vc2 passthrough=yes
add action=mark-routing chain=prerouting comment="" connection-mark=Out_vc2  disabled=no in-interface=!vc2 new-routing-mark=TO_vc2 passthrough=yes
add action=mark-routing chain=output comment="" disabled=no new-routing-mark= TO_vc1 passthrough=yes protocol=gre

/ip route
add comment="Route only..." disabled=no distance=1 dst-address=0.0.0.0/0  gateway=vc2 routing-mark=TO_vc2
add check-gateway=arp comment= "Everything: ECMP Route - provides load balancing+failover" disabled=no  distance=20 dst-address=0.0.0.0/0 gateway=vc1,vc2
add comment="Route only packets with routing mark To_vc1" disabled=no  distance=1 dst-address=0.0.0.0/0 gateway=vc1 routing-mark=TO_vc1
add comment="Route only packets with routing mark To_vc2" disabled=no  distance=1 dst-address=0.0.0.0/0 gateway=vc2 routing-mark=TO_vc2

/ip firewall nat
add action=masquerade chain=srcnat comment="masquerade" disabled=no

А как мога да задам настройка ако линковете не са еквивалентни... тоест единият е 50 мегабита а другия е 25 :?

Edited August 3, 2013 by AJO

August 3, 2013

правиш като за 3 линка само че двата ги прекарваш през единия .

August 3, 2013

Двата WAN са PPPoE и са директно в РБ-то

Единия линк е към Близоо другия е Към Асист (не че има значение)

тоест трябва да изглежда така :

/ip firewall mangle
add chain=input in-interface=blizoo action=mark-connection new-connection-mark=WAN1_conn
add chain=input in-interface=asyst action=mark-connection new-connection-mark=WAN2_conn
 
add chain=output connection-mark=WAN1_conn action=mark-routing new-routing-mark=to_WAN1
add chain=output connection-mark=WAN2_conn action=mark-routing new-routing-mark=to_WAN2
 
add chain=prerouting dst-address-type=!local in-interface=Local per-connection-classifier=both-addresses-and-ports:2/0 action=mark-connection new-connection-mark=WAN1_conn passthrough=yes
add chain=prerouting dst-address-type=!local in-interface=Local per-connection-classifier=both-addresses-and-ports:2/1 action=mark-connection new-connection-mark=WAN2_conn passthrough=yes
add chain=prerouting dst-address-type=!local in-interface=Local per-connection-classifier=both-addresses-and-ports:2/2 action=mark-connection new-connection-mark=WAN2_conn passthrough=yes
 
add chain=prerouting connection-mark=WAN1_conn in-interface=Local action=mark-routing new-routing-mark=to_WAN1
add chain=prerouting connection-mark=WAN2_conn in-interface=Local action=mark-routing new-routing-mark=to_WAN2
 
/ip route
add dst-address=0.0.0.0/0 gateway=blizoo routing-mark=to_WAN1 check-gateway=ping
add dst-address=0.0.0.0/0 gateway=asyst routing-mark=to_WAN2 check-gateway=ping
 
add dst-address=0.0.0.0/0 gateway=blizoo distance=1 check-gateway=ping
add dst-address=0.0.0.0/0 gateway=asyst distance=2 check-gateway=ping
 
/ip firewall nat
add chain=srcnat out-interface=blizoo action=masquerade
add chain=srcnat out-interface=asyst action=masquerade

или бъркам някъде

Edited August 3, 2013 by AJO

August 3, 2013

точно така е

August 4, 2013

Малко глупаво .. но нормално ли е ..

add chain=prerouting dst-address-type=!local in-interface=Local per-connection-classifier=both-addresses-and-ports:2/2 action=mark-connection new-connection-mark=WAN2_conn passthrough=yes

Да показва 0 Bytes Packets .

August 4, 2013

Да, след като имаш 3 линии трябва да е:

3/0, 3/1, 3/2

August 6, 2013

Всичко е супер с последната поправка, ако оставим Близоо.. Не че се изненадвам но напоследък все по често почнаха да стават проблемни..

Има моменти в който нета не пада към тях и пинга си минава но реално няма нет към тях ... тогава става голяма мазило ... според микротика всичко е ок но реално на тази линия няма нет . Така линията си остава активна ... но е неизползваема.

Ще трябва да мисля вариант да пингва нещо друго за да разбере че дадена линия не е активна

Според wiki-то решението трябва да е така :

/ip firewall mangle
add chain=input in-interface=blizoo action=mark-connection new-connection-mark=WAN1_conn
add chain=input in-interface=asyst action=mark-connection new-connection-mark=WAN2_conn
 
add chain=output connection-mark=WAN1_conn action=mark-routing new-routing-mark=to_WAN1
add chain=output connection-mark=WAN2_conn action=mark-routing new-routing-mark=to_WAN2
 
add chain=prerouting dst-address-type=!local in-interface=Local per-connection-classifier=both-addresses-and-ports:3/0 action=mark-connection new-connection-mark=WAN1_conn passthrough=yes
add chain=prerouting dst-address-type=!local in-interface=Local per-connection-classifier=both-addresses-and-ports:3/1 action=mark-connection new-connection-mark=WAN2_conn passthrough=yes
add chain=prerouting dst-address-type=!local in-interface=Local per-connection-classifier=both-addresses-and-ports:3/2 action=mark-connection new-connection-mark=WAN2_conn passthrough=yes
 
add chain=prerouting connection-mark=WAN1_conn in-interface=Local action=mark-routing new-routing-mark=to_WAN1
add chain=prerouting connection-mark=WAN2_conn in-interface=Local action=mark-routing new-routing-mark=to_WAN2
 
/ip route
/ip route
add dst-address=8.8.8.8 gateway=asyst scope=10
add dst-address=8.8.4.4 gateway=asyst scope=10
add dst-address=194.145.63.12 gateway=blizoo scope=10
add dst-address=85.14.24.214 gateway=blizoo scope=10

/ip route
add dst-address=10.1.1.1 gateway=8.8.8.8 scope=10 target-scope=10 check-gateway=ping
add dst-address=10.1.1.1 gateway=8.8.4.4 scope=10 target-scope=10 check-gateway=ping
add dst-address=10.2.2.2 gateway=194.145.63.12 scope=10 target-scope=10 check-gateway=ping
add dst-address=10.2.2.2 gateway=85.14.24.214 scope=10 target-scope=10 check-gateway=ping

/ip route
add distance=1 gateway=10.1.1.1 routing-mark=to_WAN1
add distance=2 gateway=10.2.2.2 routing-mark=to_WAN1
add distance=1 gateway=10.2.2.2 routing-mark=to_WAN2
add distance=2 gateway=10.1.1.1 routing-mark=to_WAN2
 
/ip firewall nat
add chain=srcnat out-interface=blizoo action=masquerade
add chain=srcnat out-interface=asyst action=masquerade

Мнение? помощ?

Edited August 6, 2013 by AJO

August 6, 2013

пингвай през рутинг марк и дропвай конекцията

Sign In

Load balansing PCC problem

Question

stanioomega

19 answers to this question

Recommended Posts

111111

stanioomega

111111

Mupo neTkoB

111111

stanioomega

Guest

AJO

Tsunami

AJO

Mupo neTkoB

AJO

Mupo neTkoB

AJO

111111

Create an account or sign in to comment

Create an account

Sign in

Recently Browsing 0 members

Browse

Activity

Important Information