Understanding Load Balance and Policy Route. andrew zheng! edcwifi co limited

Transcription

1 Understanding Load Balance and Policy Route 1 andrew zheng! edcwifi co limited

2 About Me Mikrotik Trainer No. 75! Certificate: MTCNA, MTCWE, MTCRE, MTCTCE, MTCUME, MTCINE, UBWA, UEWA 2

3 About EDCwifi Mikrotik Distributor with stock point at Hongkong, Shenzhen and Beijing.! Mikrotik Authorized Training partner.! Customizing partner for MfM (made for Mikrotik) product.! & 3

4 Made for Mikrotik Face off your device RB750series RB450series 4

5 SOHO customers mostly requires: Automatic Fail Over! Reliable Load Balance! Policy Route 5

6 Topology ether1! ISP Policy route to VPN VPN! Server! ISP LAN Router VPN! Server local IP ! remote IP ISP

7 Sample configuration Get IP address from ISP 7

8 Dial VPN connection (optional for policy route) 8

9 Mangle Rules! All packets with gateway router IP as destination should be accept Skipping PCC rules for packets with! router gateway IP as its destination! to their gateway router.! (for correcting DNS request and! other services)

10 Mangle Rules! Make sure all packets coming from WAN interface going out from the same WAN interface

11 Mangle Rules and Address list! VPN policy route Address list example 6 Add all IP addresses that! planned to go! through VPN connection mark connection of every packets with! IP destination address listed in! VPN address list 11

12 Mangle Rules! Connection Mark base on PCC

13 Mangle Rules! Route Mark for PCC

14 Mangle Rules! Route Mark for Output Chain

15 IP Route Rules! Add Default Gateway for our Routing Mark 15

16 IP Route Rules! Fail Over By adding default gateway! that not booked for routing mark! we already create fail over system.! Just adjust the distance for! priority purpose 16

17 NAT 17

18 Checking PCC Result 18

19 Checking Policy routes Result 19

20 Packet Flow with mangle chain simple explanation packet A, going into ether1 with src add: and dst add: packet A! src: ! dst: ! 1-route! in int: ether1 checking DST-NAT! rules packet A! src: ! dst: ! 1-route! in int: ether1 checking DST-IP! to local or forward-! output interface packet A! src: ! dst: ! 1-route! in int: ether1! out int: ISP1 checking mangle forward-! filter forward DST- NAT Routing Decision Mangle forward Filter! Forward packet A! src: ! dst: ! 1-route! in int: ether1! out int ISP1 add mangle and 1-route packet A! src: ! dst: ! in int: ether1! no mark Recording! conn track packet A! src: ! dst: ! in int: ether1! no mark Mangle prerouting connection tracking Input interface! eq: ether1, ether2,ether3, etc Mangle input Local Process connection tracking 20 Routing Adjustment Mangle output Mangle postrouting SRC- NAT Output interface! eq: ether1, ether2,ether3, etc packet A! src: ! dst: ! checking mangle! post routing packet A! src: ! dst: ! 1-route! out int ISP1 Change SRC IP packet A! src: ! dst: ! 1-route! out int ISP1

21 Packet Flow with mangle chain simple explanation replied packet A (A-1), going into ISP1 interface with src add: and dst add: packet A-1! src: ! dst: ! in int: ISP1 checking DST-NAT! rules packet A-1! src: ! dst: ! in int: ISP1 checking DST-IP! to local or forward-! output interface packet A-1! src: ! dst: ! in int: ISP1! goto Ether1 checking mangle forward-! filter forward Check mangle pre-routing,! adding mark! 1-conn packet A-1! src: ! dst: ! in int: ISP1! recognize this packet is one connection with A check and update! conn-track packet A-1! src: ! dst: ! in int: ISP1 Mangle prerouting DST- NAT connection tracking Input interface! eq: ether1, ether2,ether3, etc Routing Decision Mangle input Local Process connection tracking 21 Mangle forward Routing Adjustment Mangle output Filter! Forward Mangle postrouting SRC- NAT Output interface! eq: ether1, ether2,ether3, etc packet A-1! src: ! dst: ! packet A-1! src: ! dst: ! in int: ISP1! out int ether1 checking mangle! post routing packet A-1! src: ! dst: ! out int ether1 Change SRC IP packet A-1! src: ! dst: ! out int ether1

22 Any Question? Thank you! For Goods Inquiry: For Training Inquiry: See you again 22