Difference between revisions of "Manual:PCC"

From MikroTik Wiki
Jump to: navigation, search
(Introduction)
(Policy routing)
Line 75: Line 75:
 
===Policy routing===
 
===Policy routing===
  
First it is necessary to take care of router's traffic - we need to make sure that traffic will leave via same interface it was coming from.
+
 
We will mark all incoming connections, to remember what was the interface.
 
 
<pre>
 
<pre>
 
/ ip firewall mangle
 
/ ip firewall mangle
Line 82: Line 81:
 
add chain=input in-interface=wlan2 action=mark-connection new-connection-mark=wlan2_conn
 
add chain=input in-interface=wlan2 action=mark-connection new-connection-mark=wlan2_conn
 
</pre>
 
</pre>
Then we will assign proper routing-mark to the packets leaving the router.  
+
First it is necessary to take care of router's traffic - we need to make sure that traffic will leave via same interface it was coming from.
 +
We will mark all incoming connections, to remember what was the interface.
 +
 
 
<pre>
 
<pre>
 
add chain=output connection-mark=wlan1_conn action=mark-routing new-routing-mark=to_wla1     
 
add chain=output connection-mark=wlan1_conn action=mark-routing new-routing-mark=to_wla1     
 
add chain=output connection-mark=wlan1_conn action=mark-routing new-routing-mark=to_wla2
 
add chain=output connection-mark=wlan1_conn action=mark-routing new-routing-mark=to_wla2
 
</pre>
 
</pre>
 
+
Then we will assign proper routing-mark to the packets leaving the router.  
Action mark-routing can be used only in mangle chain '''output''' and '''prerouting''', but mangle chain '''prerouting''' is capturing all traffic that is going to the router itself.
 
To avoid this we will use ''dst-address-type=!local''. And with the help of the new PCC we will devide traffic into two groups based on source and destination addressees.
 
  
 
<pre>     
 
<pre>     
Line 97: Line 96:
 
     action=mark-connection new-connection-mark=wlan2_conn passthrough=yes
 
     action=mark-connection new-connection-mark=wlan2_conn passthrough=yes
 
</pre>
 
</pre>
 
+
Action mark-routing can be used only in mangle chain '''output''' and '''prerouting''', but mangle chain '''prerouting''' is capturing all traffic that is going to the router itself.
Then we need to mark all packets from those connections with a proper mark. As policy routing is required ponly for traffic going to the Internet, do not forget to specify in-interface option.
+
To avoid this we will use ''dst-address-type=!local''. And with the help of the new PCC we will devide traffic into two groups based on source and destination addressees.
  
 
<pre>
 
<pre>
Line 105: Line 104:
 
</pre>
 
</pre>
  
Create a route for each routing-mark
+
Then we need to mark all packets from those connections with a proper mark. As policy routing is required ponly for traffic going to the Internet, do not forget to specify in-interface option.
 +
 
 
<pre>
 
<pre>
 
/ ip route
 
/ ip route
Line 112: Line 112:
 
</pre>
 
</pre>
  
To enable failover, it is necessary to have a routes that will jump in as soon as others will become inactive on gateway failure. (and that will happen only if check-gateway option is active)
+
Create a route for each routing-mark
 +
 
 
<pre>
 
<pre>
 
add dst-address=0.0.0.0/0 gateway=10.111.0.1 distance=1 check-gateway=ping
 
add dst-address=0.0.0.0/0 gateway=10.111.0.1 distance=1 check-gateway=ping
 
add dst-address=0.0.0.0/0 gateway=10.112.0.1 distance=2 check-gateway=ping
 
add dst-address=0.0.0.0/0 gateway=10.112.0.1 distance=2 check-gateway=ping
 
</pre>
 
</pre>
 +
To enable failover, it is necessary to have a routes that will jump in as soon as others will become inactive on gateway failure. (and that will happen only if check-gateway option is active)
  
 
===NAT===
 
===NAT===

Revision as of 12:51, 27 April 2009

Introduction

Starting from RouterOS version 3.24 there is a new option available in the firewall - PCC (Per Connection Classifier). This option was introduced to address the configuration issues with load balancing over multiple gateways with masquerade

Previous configurations:

PCC takes selected fields from IP header, and with the help of a hashing algorithm converts selected fields into 32-bit value. This value then is divided by a specified Denominator and the remainder then is compared to a specified Remainder, if equal then packet will be captured. You can choose from src-address, dst-address, src-port, dst-port from the header to use in this operation.

per-connection-classifier=
PerConnectionClassifier ::= [!]ValuesToHash:Denominator/Remainder
  Remainder ::= 0..4294967295    (integer number)
  Denominator ::= 1..4294967295    (integer number)
  ValuesToHash ::= src-address|dst-address|src-port|dst-port[,ValuesToHash*]

Example - this configuration will divide all connections into 3 groups based on source address and port

/ip firewall mangle add chain=prerouting action=mark-connection new-connection-mark=1st_conn per-connection-classifier=src-address,src-port:3/0
/ip firewall mangle add chain=prerouting action=mark-connection new-connection-mark=2nd_conn per-connection-classifier=src-address,src-port:3/1
/ip firewall mangle add chain=prerouting action=mark-connection new-connection-mark=3rd_conn per-connection-classifier=src-address,src-port:3/2

Consider the following network layout:

LoadBalancing.jpg

Quick Start for Impatient

Configuration export from the gateway router:

/ ip address
add address=192.168.0.1/24 network=192.168.0.0 broadcast=192.168.0.255 interface=Local 
add address=10.111.0.2/24 network=10.111.0.0 broadcast=10.111.0.255 interface=wlan2
add address=10.112.0.2/24 network=10.112.0.0 broadcast=10.112.0.255 interface=wlan1

/ ip firewall mangle
add chain=input in-interface=wlan1 action=mark-connection new-connection-mark=wlan1_conn
add chain=input in-interface=wlan2 action=mark-connection new-connection-mark=wlan2_conn
add chain=output connection-mark=wlan1_conn action=mark-routing new-routing-mark=to_wla1     
add chain=output connection-mark=wlan1_conn action=mark-routing new-routing-mark=to_wla2     
add chain=prerouting dst-address-type=!local in-interface=Local per-connection-classifier=src-address,dst-address:2/0 \
    action=mark-connection new-connection-mark=wlan1_conn passthrough=yes
add chain=prerouting dst-address-type=!local in-interface=Local per-connection-classifier=src-address,dst-address:2/1 \
    action=mark-connection new-connection-mark=wlan2_conn passthrough=yes
add chain=prerouting connection-mark=wlan1_conn in-interface=Local action=mark-routing new-routing-mark=to_wlan1
add chain=prerouting connection-mark=wlan2_conn in-interface=Local action=mark-routing new-routing-mark=to_wlan2

/ ip route
add dst-address=0.0.0.0/0 gateway=10.111.0.1 routing-mark=to_wla1 check-gateway=ping
add dst-address=0.0.0.0/0 gateway=10.112.0.1 routing-mark=to_wla2 check-gateway=ping
add dst-address=0.0.0.0/0 gateway=10.111.0.1 distance=1 check-gateway=ping
add dst-address=0.0.0.0/0 gateway=10.112.0.1 distance=2 check-gateway=ping

/ ip firewall nat 
add chain=srcnat out-interface=wlan1 action=masquerade
add chain=srcnat out-interface=wlan2 action=masquerade


Explanation

First we give a code snippet and then explain what it actually does.

IP Addresses

/ ip address 
add address=192.168.0.1/24 network=192.168.0.0 broadcast=192.168.0.255 interface=Local
add address=10.111.0.2/24 network=10.111.0.0 broadcast=10.111.0.255 interface=wlan2 
add address=10.112.0.2/24 network=10.112.0.0 broadcast=10.112.0.255 interface=wlan1 

The router has two upstream (WAN) interfaces with the addresses of 10.111.0.2/24 and 10.112.0.2/24. The LAN interface has the name "Local" and IP address of 192.168.0.1/24.

Policy routing

/ ip firewall mangle
add chain=input in-interface=wlan1 action=mark-connection new-connection-mark=wlan1_conn
add chain=input in-interface=wlan2 action=mark-connection new-connection-mark=wlan2_conn

First it is necessary to take care of router's traffic - we need to make sure that traffic will leave via same interface it was coming from. We will mark all incoming connections, to remember what was the interface.

add chain=output connection-mark=wlan1_conn action=mark-routing new-routing-mark=to_wla1     
add chain=output connection-mark=wlan1_conn action=mark-routing new-routing-mark=to_wla2

Then we will assign proper routing-mark to the packets leaving the router.

     
add chain=prerouting dst-address-type=!local in-interface=Local per-connection-classifier=src-address,dst-address:2/0 \
    action=mark-connection new-connection-mark=wlan1_conn passthrough=yes
add chain=prerouting dst-address-type=!local in-interface=Local per-connection-classifier=src-address,dst-address:2/1 \
    action=mark-connection new-connection-mark=wlan2_conn passthrough=yes

Action mark-routing can be used only in mangle chain output and prerouting, but mangle chain prerouting is capturing all traffic that is going to the router itself. To avoid this we will use dst-address-type=!local. And with the help of the new PCC we will devide traffic into two groups based on source and destination addressees.

add chain=prerouting connection-mark=wlan1_conn in-interface=Local action=mark-routing new-routing-mark=to_wlan1
add chain=prerouting connection-mark=wlan2_conn in-interface=Local action=mark-routing new-routing-mark=to_wlan2

Then we need to mark all packets from those connections with a proper mark. As policy routing is required ponly for traffic going to the Internet, do not forget to specify in-interface option.

/ ip route
add dst-address=0.0.0.0/0 gateway=10.111.0.1 routing-mark=to_wla1 check-gateway=ping
add dst-address=0.0.0.0/0 gateway=10.112.0.1 routing-mark=to_wla2 check-gateway=ping

Create a route for each routing-mark

add dst-address=0.0.0.0/0 gateway=10.111.0.1 distance=1 check-gateway=ping
add dst-address=0.0.0.0/0 gateway=10.112.0.1 distance=2 check-gateway=ping

To enable failover, it is necessary to have a routes that will jump in as soon as others will become inactive on gateway failure. (and that will happen only if check-gateway option is active)

NAT

As routing decision is already made we just need rules that will fix src-addresses for all outgoing packets. if this packet will leave via wlan1 it will be NATed to 10.112.0.2/24, if via wlan2 then NATed to 10.111.0.2/24

/ ip firewall nat 
add chain=srcnat out-interface=wlan1 action=masquerade
add chain=srcnat out-interface=wlan2 action=masquerade