mikrotik router two wan load-balancing.pdf
- 1. Bandwidth-based load-balancing with failover. The easy way. We need more bandwidth.
- 2. Presenter information Tomas Kirnak Network design Security, wireless Servers, Virtualization Mikrotik Certified Trainer Atris, Slovakia Established 1991 Complete IT solutions Networking, servers Virtualization IP security systems
- 3. Load-balancing, why? • Distributing workload to multiple network links to maximize throughput and minimize latency. • Using multiple network links, when properly configured, will also provide redundancy.
- 4. Load balancing types • Bonding • Policy routing • PCC • Bandwidth based
- 5. Load balancing types Bonding - 802.3ad LACP
- 6. Bonding + Easy to implement Automatic redundancy with fail-over - You need to control of both ends of the link
- 7. Load balancing types Policy routing
- 8. Policy routing + Easy to implement You have exact control of traffic - Not dynamic Scalability problems
- 9. Load balancing types PCC per connection classifier
- 10. PCC + Easy to configure Good scalability - Not aware of link state (bandwidth wise) Not so great with very un-similiar links (4:1)
- 11. Load balancing types For presentations on these load-balancing methods, please see www.tiktube.com – PL 2010 and PL 2012
- 12. Load balancing types Bandwidth based If interface ISP1 is over 10 mbit/s; use ISP2
- 13. Why use bandwidth-based LB + Easily scalable + Takes link status into consideration + You have control over the connections + You decide when the switch to second link happends (on 10mbit link, switch after 50% util.) - Comes with its own problems
- 14. Implementation considerations • There are multiple ways to do bandwidth based load balancing, neither is so easy. • MPLS TE • Mangle + bit of scripting <-- this presentation www.tiktube.com – PL 2010 and PL 2012
- 16. Connections and tracking them
- 17. What is a connection • We can define a connection as a packet flow with the same pair of source and destination IP addresses and ports. • In case of UDP, this is would be an UDP stream. • 192.168.2.10:49481 <-> 8.8.8.8:53
- 18. Mangle • Mangle is a facility in ROS which allows us to “mark” packets or connections, and later use that mark for our purposes. • Mangle marks do NOT leave the router.
- 19. Mangle – where to /ip firewall mangle
- 20. Routing tables • A routing table tells the router which next hop to forward packets to, depending on the packets destination IP. • 0.0.0.0/0 -> 77.21.34.12
- 21. Routing tables – part 2 • By default all packets are put into the “main” routing table • We can create our own routing tables, and force packets to use them.
- 22. Topology
- 23. Required steps • Create routing tables • Setup address-lists • Setup mangle • Configure Traffic Monitor
- 24. Basic configuration /interface ethernet set 0 name=LAN set 3 name=ISP_1 set 4 name=ISP_2 /ip address add address=192.168.22.1/24 interface=LAN add address=1.1.1.32/24 interface=ISP_1 add address=2.2.2.65/24 interface=ISP_2 /ip firewall nat add action=masquerade chain=srcnat out-interface=ISP_1 add action=masquerade chain=srcnat out-interface=ISP_2
- 25. Routing tables /ip route add gateway=1.1.1.1 distance=1 add gateway=2.2.2.1 distance=2 add gateway=1.1.1.1 routing-mark=ISP1_Route distance=1 add gateway=2.2.2.1 routing-mark=ISP2_Route distance=1
- 26. Routing tables - GUI
- 27. Traffic to connected networks • Connected networks are only in the “main” routing table • We need to make sure that traffic to these networks stays in the main routing table.
- 28. Connected networks – part 2 /ip firewall address-list add address=1.1.1.0/24 list=Connected add address=2.2.2.0/24 list=Connected add address=192.168.22.0/24 list=Connected add address=192.168.22.0/24 list=LAN /ip firewall mangle add chain=prerouting src-address-list=Connected dst-address-list=Connected action=accept
- 29. Topology – take 2 • In this topology, there are 4 possible traffic flows • WAN -> Router • Router -> WAN • WAN -> LAN • LAN -> WAN
- 30. Taking care of incoming connections • When a connection is initiated from the internet through one of the ISPs we need to ensure that this connections is replied through the same ISP (from the same public IP) • We need to mark these connections, and then put them in the proper routing table.
- 31. Router marking – WAN -> Router • Catch the connection from internet to the router, and mark them. /ip firewall mangle add chain=input connection-mark=no-mark in-interface=ISP_1 action=mark-connection new-connection-mark=WAN1->ROS add chain=input connection-mark=no-mark in-interface=ISP_2 action=mark-connection new-connection-mark=WAN2->ROS
- 32. Router marking – WAN -> Router • Then put these connections into the proper routing tables. add chain=output connection-mark=WAN1->ROS action=mark-routing new-routing-mark=ISP1_Route add chain=output connection-mark=WAN2->ROS action=mark-routing new-routing-mark=ISP2_Route
- 33. Taking care of the LAN • Same principle applies to the LAN. • Connections initiated from the internet through one ISP, should be replied to through the same ISP.
- 34. LAN marking /ip firewall mangle add chain=forward connection-mark=no-mark in-interface=ISP_1 action=mark-connection new-connection-mark=WAN1->LANs add chain=forward connection-mark=no-mark in-interface=ISP_2 action=mark-connection new-connection-mark=WAN2->LANs add chain=prerouting connection-mark=WAN1->LANs src-address-list=LAN action=mark-routing new-routing-mark=ISP1_Route add chain=prerouting connection-mark=WAN2->LANs src-address-list=LAN action=mark-routing new-routing-mark=ISP2_Route
- 35. Incoming connections - done • We have ensured that when a connection from the internet to our router, or services inside of our network is established, it works.
- 36. LAN – partially done • Connections from the internet to our LAN will now work through both ISPs • So what about connections outgoing from our LAN to the internet? • These we actually want to load-balance.
- 37. A sticky connection • A sticky connection is a connection, that once established through one interface, will always go out that exact interface. • This is required, because when we switch to a second link, we only need to switch new connections. • In PCC, this is done automatically. Using our approach however, this has to be done manually.
- 38. LAN -> WAN mangle /ip firewall mangle add chain=prerouting connection-mark=no-mark src-address-list=LAN dst-address- list=!Connected dst-address-type=!local action=mark-connection new-connection-mark=LAN->WAN add chain=prerouting connection-mark=LAN->WAN src-address-list=LAN action=mark-routing new-routing-mark=ISP1_Route comment="Load-Balancing here" • Configuring this, we can now manually influence which routing table will our connection from LAN to the internet take.
- 39. Sticky connections add chain=prerouting connection-mark=LAN->WAN routing-mark=ISP1_Route action=mark-connection new-connection-mark=Sticky_ISP1 add chain=prerouting connection-mark=LAN->WAN routing-mark=ISP2_Route action=mark-connection new-connection-mark=Sticky_ISP2 add chain=prerouting connection-mark=Sticky_ISP1 src-address-list=LAN action=mark-routing new-routing-mark=ISP1_Route add chain=prerouting connection-mark=Sticky_ISP2 src-address-list=LAN action=mark-routing new-routing-mark=ISP2_Route • This will assure that once a connection is routed through one ISP, it will stay there no matter what.
- 40. Mangle in GUI
- 41. What’s the final result? • We can load balancing manually • Connections go out ISP1, then we can switch the mangle rule to ISP2, but connections already using ISP1 will stay there.
- 42. Automating based on bandwidth
- 43. Switching back
- 44. Final result • Connections routed through ISP1, until its link is at 5mbit/s. • After this limit all new connections will go through ISP2 until the ISP1 link is under its limit. • Automated, bandwidth-based load balancing.
- 45. Easy Failover • If the gateway can’t be pinged, all routes using this gateway will become invalid.
- 46. A different approach • This approach will not work if the link failure happens after the gateway. • Recursive route lookup, netwatch etc. • http://wiki.mikrotik.com/wiki/Failover_Scripting
- 47. Thanks for listening Tomas Kirnak t.kirnak@atris.sk
- 48. Find me after the presentation for any questions.