Di seguito il mio firewall, al momento e settato per usare solo una wan e le altre come backup in caso di caduta
- Codice: Seleziona tutto
/ip firewall filter
add action=drop chain=forward comment=\
"Regola per evitare che accedano al gateway" dst-address=192.168.10.1 \
src-address=10.22.10.1-10.22.10.254
add action=drop chain=forward comment=\
"Regola per evitare che accedano al gateway" dst-address=192.168.20.1 \
src-address=10.22.10.1-10.22.10.254
add action=drop chain=forward comment=\
"Regola per evitare che accedano al gateway" dst-address=192.168.30.1 \
src-address=10.22.10.1-10.22.10.254
add action=drop chain=forward comment=\
"Regola per evitare che accedano al gateway" dst-address=192.168.40.1 \
src-address=10.22.10.1-10.22.10.254
/ip firewall mangle
add action=mark-connection chain=input comment=WAN1 in-interface=WAN1 \
new-connection-mark=WAN1_conn passthrough=yes
add action=mark-connection chain=input comment=WAN2 disabled=yes \
in-interface=WAN2 new-connection-mark=WAN2_conn passthrough=yes
add action=mark-connection chain=input comment=WAN3 disabled=yes \
in-interface=WAN3 new-connection-mark=WAN3_conn passthrough=yes
add action=mark-connection chain=input comment=WAN4 disabled=yes \
in-interface=WAN4 new-connection-mark=WAN4_conn passthrough=yes
add action=mark-routing chain=output comment=WAN1 connection-mark=WAN1_conn \
new-routing-mark=to_WAN1 passthrough=yes
add action=mark-routing chain=output comment=WAN2 connection-mark=WAN2_conn \
disabled=yes new-routing-mark=to_WAN2 passthrough=yes
add action=mark-routing chain=output comment=WAN3 connection-mark=WAN3_conn \
disabled=yes new-routing-mark=to_WAN3 passthrough=yes
add action=mark-routing chain=output comment=WAN4 connection-mark=WAN4_conn \
disabled=yes new-routing-mark=to_WAN4 passthrough=yes
add action=accept chain=prerouting comment=WAN1 dst-address=192.168.10.0/24
add action=accept chain=prerouting comment=WAN2 disabled=yes dst-address=\
192.168.20.0/24
add action=accept chain=prerouting comment=WAN3 disabled=yes dst-address=\
192.168.30.0/24
add action=accept chain=prerouting comment=WAN4 disabled=yes dst-address=\
192.168.40.0/24
add action=mark-connection chain=prerouting comment=WAN1 dst-address-type=\
!local new-connection-mark=WAN1_conn passthrough=yes \
per-connection-classifier=src-address-and-port:1/0 src-address=\
10.22.10.0/24
add action=mark-connection chain=prerouting comment=WAN2 disabled=yes \
dst-address-type=!local new-connection-mark=WAN2_conn passthrough=yes \
per-connection-classifier=src-address-and-port:2/0 src-address=\
10.22.10.0/24
add action=mark-connection chain=prerouting comment=WAN3 disabled=yes \
dst-address-type=!local new-connection-mark=WAN3_conn passthrough=yes \
per-connection-classifier=src-address-and-port:2/1 src-address=\
10.22.10.0/24
add action=mark-connection chain=prerouting comment=WAN4 disabled=yes \
dst-address-type=!local new-connection-mark=WAN4_conn passthrough=yes \
per-connection-classifier=src-address-and-port:1/2 src-address=\
10.22.10.0/24
add action=mark-routing chain=prerouting comment=WAN1 connection-mark=\
WAN1_conn new-routing-mark=to_WAN1 passthrough=yes
add action=mark-routing chain=prerouting comment=WAN2 connection-mark=\
WAN2_conn disabled=yes new-routing-mark=to_WAN2 passthrough=yes
add action=mark-routing chain=prerouting comment=WAN3 connection-mark=\
WAN3_conn disabled=yes new-routing-mark=to_WAN3 passthrough=yes
add action=mark-routing chain=prerouting comment=WAN4 connection-mark=\
WAN4_conn disabled=yes new-routing-mark=to_WAN4 passthrough=yes
/ip firewall nat
add action=masquerade chain=srcnat comment=WAN1 out-interface=WAN1 \
src-address=10.22.10.0/24
add action=masquerade chain=srcnat comment=WAN2 out-interface=WAN2 \
src-address=10.22.10.0/24
add action=masquerade chain=srcnat comment=WAN3 out-interface=WAN3 \
src-address=10.22.10.0/24
add action=masquerade chain=srcnat comment=WAN4 out-interface=WAN4 \
src-address=10.22.10.0/24
