Hello guys, facing this little issue, i have 3 wan interfaces, each on a proper vlan, the big difference is that i have to asign a firewall zone for every wan interface,since i need it in order to get WIFI only use wan2.
I have set (i think properly) every firewall zone for each wan, also set lan zone to forward dest those 3 wan zones, wifi is properly working only on wan2, LAN zone should be able to use or connect with the 3 wans.
Problem is now mwan3 is not properly loading balance, every time i try to download something (ubuntu iso for this download test), its now only using wan1 in the download.
If i disable the wan1 interface, it goes directly to wan2 without any problem, but when boths active, my download is only using wan1.
My configs files:
Mwan3
config globals 'globals'
option mmx_mask '0x3F00'
option local_source 'lan'
config interface 'wan'
option enabled '1'
list track_ip '8.8.4.4'
list track_ip '8.8.8.8'
list track_ip '208.67.222.222'
list track_ip '208.67.220.220'
option family 'ipv4'
option reliability '2'
option count '1'
option timeout '2'
option failure_latency '1000'
option recovery_latency '500'
option failure_loss '20'
option recovery_loss '5'
option interval '5'
option down '3'
option up '8'
config interface 'wanb'
list track_ip '8.8.8.8'
list track_ip '208.67.220.220'
option family 'ipv4'
option reliability '1'
option count '1'
option timeout '2'
option interval '5'
option down '3'
option up '8'
option enabled '1'
option initial_state 'online'
option track_method 'ping'
option size '56'
option check_quality '0'
option failure_interval '5'
option recovery_interval '5'
option flush_conntrack 'never'
config interface 'wanc'
list track_ip '8.8.8.8'
list track_ip '208.67.220.220'
option family 'ipv4'
option reliability '1'
option count '1'
option timeout '2'
option interval '5'
option down '3'
option up '8'
option initial_state 'online'
option track_method 'ping'
option size '56'
option check_quality '0'
option failure_interval '5'
option recovery_interval '5'
option flush_conntrack 'never'
option enabled '1'
config member 'wan_m1_w2'
option interface 'wan'
option metric '1'
option weight '2'
config member 'wan_m1_w3'
option interface 'wan'
option metric '1'
option weight '3'
config member 'wan_m1_w4'
option interface 'wan'
option metric '1'
option weight '4'
config member 'wan_m2_w1'
option interface 'wan'
option metric '2'
option weight '1'
config member 'wanb_m1_w2'
option interface 'wanb'
option metric '1'
option weight '2'
config member 'wanb_m1_w3'
option interface 'wanb'
option metric '1'
option weight '3'
config member 'wanb_m1_w4'
option interface 'wanb'
option metric '1'
option weight '4'
config member 'wanb_m2_w1'
option interface 'wanb'
option metric '2'
option weight '1'
config member 'wanc_m1_w2'
option interface 'wanc'
option metric '1'
option weight '2'
config member 'wanc_m1_w3'
option interface 'wanc'
option metric '1'
option weight '3'
config member 'wanc_m1_w4'
option interface 'wanc'
option metric '1'
option weight '4'
config member 'wanc_m2_w1'
option interface 'wanc'
option metric '2'
option weight '1'
config policy 'wan_only'
list use_member 'wan_m2_w1'
config policy 'wanb_only'
list use_member 'wanb_m2_w1'
config policy 'wanc_only'
list use_member 'wanc_m2_w1'
config policy 'then_1_2'
list use_member 'wan_m1_w2'
list use_member 'wanb_m2_w1'
config policy 'then_2_1'
list use_member 'wanb_m1_w2'
list use_member 'wan_m2_w1'
config policy 'more_12'
list use_member 'wan_m1_w4'
list use_member 'wanb_m1_w3'
config policy 'more_321'
list use_member 'wanc_m1_w4'
list use_member 'wanb_m1_w3'
list use_member 'wan_m1_w2'
config policy 'more_123'
list use_member 'wan_m1_w4'
list use_member 'wanb_m1_w3'
list use_member 'wanc_m1_w2'
config rule 'guest_wanb'
option sticky '1'
option src_ip '10.0.30.0/24'
option proto 'all'
option use_policy 'wanb_only'
config rule 'https'
option sticky '1'
option dest_port '443'
option proto 'tcp'
option use_policy 'more_123'
config rule 'default_rule'
option dest_ip '0.0.0.0/0'
option use_policy 'more_123'
Network
config interface 'loopback'
option ifname 'lo'
option proto 'static'
option ipaddr '127.0.0.1'
option netmask '255.0.0.0'
config globals 'globals'
option ula_prefix 'fd18:1e70:b8d4::/48'
config interface 'lan'
option type 'bridge'
option ifname 'eth0.1'
option proto 'static'
option netmask '255.255.255.0'
option ip6assign '60'
option ipaddr '10.0.10.1'
option delegate '0'
config interface 'wan'
option ifname 'eth1.2'
option proto 'dhcp'
option metric '10'
option delegate '0'
config switch
option name 'switch0'
option reset '1'
option enable_vlan '1'
config switch_vlan
option device 'switch0'
option vlan '1'
option vid '1'
option ports '0 1 5t'
config switch_vlan
option device 'switch0'
option vlan '2'
option ports '4 6t'
option vid '2'
config switch_vlan
option device 'switch0'
option vlan '3'
option vid '3'
option ports '3 6t'
config interface 'wanb'
option proto 'dhcp'
option delegate '0'
option metric '20'
option ifname 'eth1.3'
config switch_vlan
option device 'switch0'
option vlan '4'
option vid '4'
option ports '2 6t'
config interface 'guest'
option proto 'static'
option ipaddr '10.0.30.1'
option netmask '255.255.255.0'
option dns '208.67.220.123 208.67.222.123'
config interface 'wanc'
option proto 'dhcp'
option ifname 'eth1.4'
option delegate '0'
option metric '30'
Firewall
config zone
option name 'lan'
option input 'ACCEPT'
option output 'ACCEPT'
option forward 'ACCEPT'
option network 'lan'
option family 'ipv4'
config zone
option name 'wan'
option input 'REJECT'
option output 'ACCEPT'
option forward 'REJECT'
option masq '1'
option mtu_fix '1'
option network 'wan wan6'
config zone
option name 'wanb'
option forward 'REJECT'
option output 'ACCEPT'
option network 'wanb'
option input 'REJECT'
option masq '1'
option mtu_fix '1'
config zone
option name 'wanc'
option forward 'REJECT'
option output 'ACCEPT'
option network 'wanc'
option input 'REJECT'
option masq '1'
option mtu_fix '1'
config zone
option name 'guest'
option output 'ACCEPT'
option network 'guest'
option input 'REJECT'
option forward 'REJECT'
config rule
option name 'SSH/LUCI-Only-Device'
option src 'lan'
option family 'ipv4'
option proto 'tcp'
option dest_port '22 80'
option target 'ACCEPT'
option src_ip '10.0.10.171 10.0.10.243 10.0.10.232 10.0.10.156'
option enabled '0'
config rule
option name 'SSH/LUCI-REJECT-LAN'
option src 'lan'
option proto 'tcp'
option dest_port '22 80'
option target 'REJECT'
option enabled '0'
config rule
option name 'Allow-DHCP-Renew'
option src 'wan'
option proto 'udp'
option dest_port '68'
option target 'ACCEPT'
option family 'ipv4'
config rule
option name 'Allow-Ping'
option src 'wan'
option proto 'icmp'
option icmp_type 'echo-request'
option family 'ipv4'
option target 'ACCEPT'
config rule
option name 'Allow-IGMP'
option src 'wan'
option proto 'igmp'
option family 'ipv4'
option target 'ACCEPT'
config rule
option name 'Allow-DHCP-Renew-Wanb'
option src 'wanb'
option proto 'udp'
option dest_port '68'
option target 'ACCEPT'
option family 'ipv4'
config rule
option name 'Allow-Ping-Wanb'
option src 'wanb'
option proto 'icmp'
option icmp_type 'echo-request'
option family 'ipv4'
option target 'ACCEPT'
config rule
option name 'Allow-IGMP-Wanb'
option src 'wanb'
option proto 'igmp'
option family 'ipv4'
option target 'ACCEPT'
config rule
option name 'Allow-DHCP-Renew-Wanc'
option src 'wanc'
option proto 'udp'
option dest_port '68'
option target 'ACCEPT'
option family 'ipv4'
config rule
option name 'Allow-Ping-Wanc'
option src 'wanc'
option proto 'icmp'
option icmp_type 'echo-request'
option family 'ipv4'
option target 'ACCEPT'
config rule
option name 'Allow-IGMP-Wanc'
option src 'wanc'
option proto 'igmp'
option family 'ipv4'
option target 'ACCEPT'
config rule
option name 'Allow-DHCPv6'
option src 'wan'
option proto 'udp'
option src_ip 'fc00::/6'
option dest_ip 'fc00::/6'
option dest_port '546'
option family 'ipv6'
option target 'ACCEPT'
config rule
option name 'Allow-MLD'
option src 'wan'
option proto 'icmp'
option src_ip 'fe80::/10'
list icmp_type '130/0'
list icmp_type '131/0'
list icmp_type '132/0'
list icmp_type '143/0'
option family 'ipv6'
option target 'ACCEPT'
config rule
option name 'Allow-ICMPv6-Input'
option src 'wan'
option proto 'icmp'
list icmp_type 'echo-request'
list icmp_type 'echo-reply'
list icmp_type 'destination-unreachable'
list icmp_type 'packet-too-big'
list icmp_type 'time-exceeded'
list icmp_type 'bad-header'
list icmp_type 'unknown-header-type'
list icmp_type 'router-solicitation'
list icmp_type 'neighbour-solicitation'
list icmp_type 'router-advertisement'
list icmp_type 'neighbour-advertisement'
option limit '1000/sec'
option family 'ipv6'
option target 'ACCEPT'
config rule
option name 'Allow-ICMPv6-Forward'
option src 'wan'
option dest '*'
option proto 'icmp'
list icmp_type 'echo-request'
list icmp_type 'echo-reply'
list icmp_type 'destination-unreachable'
list icmp_type 'packet-too-big'
list icmp_type 'time-exceeded'
list icmp_type 'bad-header'
list icmp_type 'unknown-header-type'
option limit '1000/sec'
option family 'ipv6'
option target 'ACCEPT'
config rule
option name 'Allow-IPSec-ESP'
option src 'wan'
option dest 'lan'
option proto 'esp'
option target 'ACCEPT'
config rule
option target 'ACCEPT'
option proto 'tcp udp'
option dest_port '53'
option name 'Guest DNS'
option src 'guest'
option start_time '05:00:00'
option stop_time '00:00:00'
config rule
option target 'ACCEPT'
option dest_port '67-68'
option name 'Guest DHCP'
option src 'guest'
option proto 'udp'
option start_time '05:00:00'
option stop_time '00:00:00'
config forwarding
option dest 'wanb'
option src 'guest'
config defaults
option syn_flood '1'
option input 'ACCEPT'
option output 'ACCEPT'
option forward 'REJECT'
config include
option path '/etc/firewall.user'
config include 'miniupnpd'
option type 'script'
option path '/usr/share/miniupnpd/firewall.include'
option family 'any'
option reload '1'
config include 'bcp38'
option type 'script'
option path '/usr/lib/bcp38/run.sh'
option family 'IPv4'
option reload '1'
config forwarding
option dest 'wan'
option src 'lan'
config forwarding
option dest 'wanb'
option src 'lan'
config forwarding
option dest 'wanc'
option src 'lan'
Let me know if u guys need anything else, or if im missing something in my configs files.
Thanks guys.
PD: wanc or wan3 will not be used yet, still the port must be configured since i will use a LTE modem on that port soon. (mostly has a failover interface)
At least i would like to have my 2 first wan interfaces properly balanced on mwan3 and only LAN would be able to use 3 wans, wifi (guest) is properly using wan2 only.