3 A S 0.0.0.0/0 r 10.5.8.1 Public
[admin@MikroTik] ip route>
Policy Rules
Home menu level: /ip route rule
Property Description
action ( drop | unreachable | lookup ; default: unreachable ) - action to be processed on packets
matched by this rule:
• drop - silently drop packet
• unreachable - reply that destination host is unreachable
• lookup - lookup route in given routing table
dst-address ( IP address/mask ) - destination IP address/mask
interface ( name ; default: "" ) - interface through which the gateway can be reached
routing-mark ( name ; default: "" ) - mark of the packet to be mached by this rule. To add a
routing mark, use '/ip firewall mangle' commands
src-address ( IP address/mask ) - source IP address/mask
table ( name ; default: "" ) - routing table, created by user
Notes
You can use policy routing even if you use masquerading on your private networks. The source
address will be the same as it is in the local network. In previous versions of RouterOS the source
address changed to 0.0.0.0
It is impossible to recognize peer-to-peer traffic from the first packet. Only already established
connections can be matched. That also means that in case source NAT is treating Peer-to-Peer
traffic differently from the regular traffic, Peer-to-Peer programs will not work (general application
is policy-routing redirecting regular traffic through one interface and Peer-to-Peer traffic - through
another). A known workaround for this problem is to solve it from the other side: making not
Peer-to-Peer traffic to go through another gateway, but all other useful traffic go through another
gateway. In other words, to specify what protocols (HTTP, DNS, POP3, etc.) will go through the
gateway A, leaving all the rest (so Peer-to-Peer traffic also) to use the gateway B (it is not
important, which gateway is which; it is only important to keep Peer-to-Peer together with all traffic
except the specified protocols)
Example
To add the rule specifying that all the packets from the 10.0.0.144 host should lookup the mt
routing table:
[admin@MikroTik] ip firewall mangle add action=mark-routing new-routing-mark=mt \
\... chain=prerouting
[admin@MikroTik] ip route> add gateway=10.0.0.254 routing-mark=mt
[admin@MikroTik] ip route rule> add src-address=10.0.0.144/32 \
\... table=mt action=lookup
[admin@MikroTik] ip route rule> print
Flags: X - disabled, I - invalid
Page 133 of 695
Copyright 1999-2007, MikroTik. All rights reserved. Mikrotik, RouterOS and RouterBOARD are trademarks of Mikrotikls SIA.
Other trademarks and registred trademarks mentioned herein are properties of their respective owners.
To Next Page
Loading...
General