Mikrotik

398 readers

1 users here now

A community-contributed sublemmy for all things Mikrotik. General ISP and network discussion also permitted. Please ensure if you're asking a question you have checked the Wiki First: https://help.mikrotik.com/

Mikrotik Rules: Don't post content that is incorrect or potentially harmful to a router/network.

This in itself is not a bannable offence but answers that are verifiably incorrect or will cause issues for other users will be edited or removed.

Examples: Factual errors - "EOIP is always unsecure" Configuration problems - Config that would disable all physical interfaces on a router Trolling - "Downgrade it to 5.26"

founded 2 years ago

MODERATORS

rayman30@lemmy.world

Persistent routing rule for specific IPv6 host? (startrek.website)

submitted 1 week ago by qjkxbmwvz@startrek.website to c/mikrotik@lemmy.world

1 comments fedilink hide all child comments

What I want: I want to be able to route specific clients through different interfaces (WireGuard tunnels), and I want this behavior to persist upon disconnect/reconnect. Clients can change which tunnel, with several VLANs being able to use the tunnels (so a client A on VLAN 124 and client B on VLAN 789 can both use VPN tunnel X or Y at their discretion).

What I have: IPv4 works fine (routing rule src address -> routing table). IPv6 works, but is not persistent, as clients change their IPv6 address. (I have a dinky script where I enter IPv4 address and country, and it will grab a VPN peer from a json file, set it up, and add the IPv4+current IPv6 address to the routing rules. This works well currently; I use Mullvad.)

Any recommendations? Ideas: use IPv6 mangle based on MAC address, but I have been having trouble getting this to work (extremely slow). Another idea is to have a script run and grab the IPv6 address of client (either by hostname or by DHCP lease+MAC info), but I'm not sure if it's possible to trigger a script upon IPv6 neighbor discovery.

Any help appreciated!

top 1 comments

sorted by: hot top controversial new old

[–] qjkxbmwvz@startrek.website 3 points 1 week ago* (last edited 1 week ago)

I managed to get it working with IPv6 mangle.

I seem to need 3x mangle rules, preroute mark connection, preroute mark routing, and forward mark routing. I also needed to disable fasttrack for marked connections.

The downside is that there seems to be a performance hit, as mangle is (I guess?) more resource intensive than simple routing rules.

ETA: It seems the mark routing preroute wants an interface (in my case, a VLAN), although my use case is a little funky as I am routing this traffic via WireGuard running on an AP, as the AP CPU is way beefier than my router.