Load Balancing con 3 WAN

[J3rry_OUT]

Ciao a tutti ,
ho provato a configurare, seguendo diverse guide nel web , un load balancing con 3 WAN (sempre stesso operatore, 30Mbit ognuna, 3 router diversi). Non ottengo il bilanciamento fra le 3 ma apparentemente solo fra le prime 2. La 3 Wan subentra se spengo le WAN1 e WAN2.

Allego la configurazione:

Codice: Seleziona tutto

/interface ethernet
set [ find default-name=ether1 ] comment="WAN1-RTR CED"
set [ find default-name=ether2 ] comment="WAN2-RTR Centralino"
set [ find default-name=ether3 ] comment="WAN3-RTR Segreteria"
set [ find default-name=ether5 ] comment=LAN

/ip address
add address=192.168.1.254/24 interface=ether1 network=192.168.1.0
add address=192.168.2.254/24 interface=ether2 network=192.168.2.0
add address=192.168.10.1/24 interface=ether5 network=192.168.10.0
add address=192.168.0.254/24 interface=ether3 network=192.168.0.0

/ip firewall mangle
add action=accept chain=prerouting dst-address=192.168.1.0/24 in-interface=ether5
add action=accept chain=prerouting dst-address=192.168.2.0/24 in-interface=ether5
add action=accept chain=prerouting dst-address=192.168.0.0/24 in-interface=ether5
add action=mark-connection chain=prerouting connection-mark=no-mark in-interface=ether1 new-connection-mark=WAN1-Ced
add action=mark-connection chain=prerouting connection-mark=no-mark in-interface=ether2 new-connection-mark=WAN2-Centralino
add action=mark-connection chain=prerouting connection-mark=no-mark in-interface=ether3 new-connection-mark=WAN3-Segreteria
add action=mark-connection chain=prerouting connection-mark=no-mark dst-address-type=!local in-interface=ether5 new-connection-mark=WAN1-Ced passthrough=yes per-connection-classifier=both-addresses:3/0
add action=mark-connection chain=prerouting connection-mark=no-mark dst-address-type=!local in-interface=ether5 new-connection-mark=WAN2-Centralino passthrough=yes per-connection-classifier=both-addresses:3/1
add action=mark-connection chain=prerouting connection-mark=no-mark dst-address-type=!local in-interface=ether5 new-connection-mark=WAN3-Segreteria passthrough=yes per-connection-classifier=both-addresses:3/0
add action=mark-routing chain=prerouting connection-mark=WAN1-Ced in-interface=ether5 new-routing-mark=to_WAN1-Ced passthrough=yes
add action=mark-routing chain=prerouting connection-mark=WAN2-Centralino in-interface=ether5 new-routing-mark=to_WAN2Centralino passthrough=yes
add action=mark-routing chain=prerouting connection-mark=WAN3-Segreteria in-interface=ether5 new-routing-mark=to_WAN3-Segr passthrough=yes
add action=mark-routing chain=output connection-mark=WAN1-Ced new-routing-mark=to_WAN1-Ced
add action=mark-routing chain=output connection-mark=WAN2-Centralino new-routing-mark=to_WAN2Centralino
add action=mark-routing chain=output connection-mark=WAN3-Segreteria new-routing-mark=to_WAN3-Segr passthrough=yes

/ip firewall nat
add action=masquerade chain=srcnat out-interface=ether1
add action=masquerade chain=srcnat out-interface=ether2
add action=masquerade chain=srcnat out-interface=ether3
add action=dst-nat chain=dstnat comment="Videoconferenza Aula 4.0" in-interface=ether2 to-addresses=192.168.5.254
add action=dst-nat chain=dstnat comment="Accesso VPN e altro" in-interface=ether1 to-addresses=192.168.10.254
add action=dst-nat chain=dstnat comment="regola per DMZ da WAN3" in-interface=ether3 to-addresses=192.168.10.254

/ip route
add check-gateway=ping distance=1 gateway=192.168.1.1 routing-mark=to_WAN1-Ced
add check-gateway=ping distance=1 gateway=192.168.2.1 routing-mark=to_WAN2Centralino
add check-gateway=ping distance=1 gateway=192.168.0.1 routing-mark=to_WAN3-Segr
add distance=1 gateway=192.168.1.1
add distance=2 gateway=192.168.2.1
add distance=3 gateway=192.168.0.1


Grazie in anticipo

[ppraz]

add action=mark-connection chain=prerouting connection-mark=no-mark dst-address-type=!local in-interface=ether5 new-connection-mark=WAN1-Ced passthrough=yes per-connection-classifier=both-addresses:3/0
add action=mark-connection chain=prerouting connection-mark=no-mark dst-address-type=!local in-interface=ether5 new-connection-mark=WAN2-Centralino passthrough=yes per-connection-classifier=both-addresses:3/1
add action=mark-connection chain=prerouting connection-mark=no-mark dst-address-type=!local in-interface=ether5 new-connection-mark=WAN3-Segreteria passthrough=yes per-connection-classifier=both-addresses:3/0

Ecco perché
3:0 ok
3:1 ok
3:0 errato, devi mettere 3:2

[J3rry_OUT]

Sì scusa, errrore subito corretto,
ma anche mettendo 3:2 il risultato non cambia vanno sempre e solo le prime 2 WAN, la terza subentra solo se spengo fisicamente le interfacce...
Mi aspetterei di vedere una suddivisione del carico tipo 33% / 33% / 33%
Invece vedo che Wan1 e Wan2 lavorano circa 50% e 50% WAN3 solo pochi bytes....

[J3rry_OUT]

Ora ho resettato i contatori del Mangle.
Posso usarli per verificare l'effettiva suddivisione del traffico?
Allego screenshot per chiarezza.
Effettivamente sembra funzionare al momento...
Grazie

[ppraz]

Secondo me ci sono troppe regole...
Se hai modo di fare una prova:
Rimuovi le prime 3 "accept"
Rimuovi tutte quelle che sono "mark connection"
Lascia solo 3 regole di mark routing nella chain pre-routing a cui però devi applicare il PCC 3:0,1,2
Rimuovi le mark routing nella chain di output

In pratica di queste 15 regole te ne dovrebbero rimanere solo 3, le 3 evidenziate, ma che includono il discriminante PCC al loro interno

[J3rry_OUT]

Grazie,
sono tornato oggi dalle ferie ;-)
Siccome non posso fare modifiche in quanto se mi va giù qualcosa non ho modo di accedere all'impianto, ho verificato solo i pacchetti del mangle e direi che sembra funzionare, WAN2 e WAN3 hanno fatto la stessa quantità di traffico e WAN1 ne ha fatto quasi il doppio ma ci può stare.
Resetto nuovamente i contatori e quando riapre l'istituto farò nuove verifiche e in caso disattiverò le regole "di troppo".
Grazie ancora.