published: true
tags: mikrotik, networking, sysadmin, routeros
Managing multiple Internet Service Provider (ISP) connections is essential for high-availability enterprise networks. Relying on a single WAN connection creates a point of failure, whereas combining dual ISPs ensures both traffic distribution and network redundancy.
In this guide, we will set up Per Connection Classifier (PCC) Load Balancing alongside automated Failover on MikroTik RouterOS using two active WAN links.
Prerequisites & WAN Setup
For this demonstration, we assume two ISP connections connected to a MikroTik router:
-
ISP 1 (Primary / Dedicated): Ethernet port
ether1_ISP1 -
ISP 2 (Secondary / Backup): Ethernet port
ether2_ISP2 -
Local Network (LAN): Ethernet port
bridge_LAN(192.168.88.0/24)
Step 1: Interface IP Address Assignment
Assign static IP addresses provided by your ISPs and configure your local gateway IP:
routeros
/ip address
add address=192.168.88.1/24 interface=bridge_LAN network=192.168.88.0
add address=1.1.1.2/30 interface=ether1_ISP1 network=1.1.1.0
add address=2.2.2.2/30 interface=ether2_ISP2 network=2.2.2.0
Step 2: Configure Firewall NAT Rules
Configure Network Address Translation (NAT) masquerading for both WAN interfaces to grant internet access to internal clients:
/ip firewall nat
add chain=srcnat out-interface=ether1_ISP1 action=masquerade
add chain=srcnat out-interface=ether2_ISP2 action=masquerade
Step 3: Configure Mangle Rules for PCC Marking
We use Per Connection Classifier (PCC) to split traffic evenly across both ISP links based on source/destination address pairs.
1. Accept Connections to Internal Subnets
Prevent local network traffic from being load-balanced:
/ip firewall mangle
add chain=prerouting dst-address=192.168.88.0/24 action=accept in-interface=bridge_LAN
2. Mark Incoming Connections from ISPs
Ensure responses to inbound traffic leave through the exact same interface they entered:
/ip firewall mangle
add chain=prerouting in-interface=ether1_ISP1 connection-state=new action=mark-connection new-connection-mark=ISP1_conn passthrough=yes
add chain=prerouting in-interface=ether2_ISP2 connection-state=new action=mark-connection new-connection-mark=ISP2_conn passthrough=yes
3. Apply PCC Rules to LAN Traffic
Distribute outgoing connections equally between both links:
/ip firewall mangle
add chain=prerouting in-interface=bridge_LAN connection-state=new per-connection-classifier=both-addresses-and-ports:2/0 action=mark-connection new-connection-mark=ISP1_conn passthrough=yes
add chain=prerouting in-interface=bridge_LAN connection-state=new per-connection-classifier=both-addresses-and-ports:2/1 action=mark-connection new-connection-mark=ISP2_conn passthrough=yes
4. Assign Routing Marks
Translate connection marks into routing decisions:
/ip firewall mangle
add chain=prerouting in-interface=bridge_LAN connection-mark=ISP1_conn action=mark-routing new-routing-mark=to_ISP1 passthrough=no
add chain=prerouting in-interface=bridge_LAN connection-mark=ISP2_conn action=mark-routing new-routing-mark=to_ISP2 passthrough=no
Step 4: Configure Static Routes and Dynamic Failover
Configure default routes using check-gateway monitoring (ping) to automatically reroute traffic if an ISP connection fails.
# Routes for marked traffic
/ip route
add dst-address=0.0.0.0/0 gateway=1.1.1.1 distance=1 routing-table=to_ISP1 check-gateway=ping
add dst-address=0.0.0.0/0 gateway=2.2.2.1 distance=1 routing-table=to_ISP2 check-gateway=ping
# Fallback default routes for unmarked router traffic
add dst-address=0.0.0.0/0 gateway=1.1.1.1 distance=1 check-gateway=ping
add dst-address=0.0.0.0/0 gateway=2.2.2.1 distance=2 check-gateway=ping
Step 5: Verification & Testing
1. Check Firewall Connections
Navigate to IP > Firewall > Connections in WinBox or execute:
/ip firewall connection print
Verify that active connections display connection-mark=ISP1_conn and connection-mark=ISP2_conn evenly.
Unplug the network cable for ether1_ISP1. The router should detect link failure via the check-gateway=ping health check and automatically shift all active network flows through ether2_ISP2 within seconds.Conclusion
Combining PCC load balancing with check-gateway ping monitoring in RouterOS maximizes WAN utilization while building automatic network redundancy. This dynamic routing strategy ensures optimal network stability for bandwidth-intensive environments.
Top comments (0)