|
|
我个人使用的方案是开启了FastTrack的，所以Mangle要求比不开的要高很多，但是目前是不会有漏包或者奇怪的现象，但是我不敢保证楼主这里的场景也能适用
我的方案是打两次标，首先给connection打标，然后再根据connection给routing打标，最后在静态路由里添加一条routing-mark=bypass的路由，甚至没有用复数路由表
我主要是用来给ICMP打标，但是我试过别的连接给connection打标一样是可以正常路由的
可以尝试改一改我这个方案试试看能不能成，按理说fasttrack都能用的话楼主这种也不会有太大问题
- /ip firewall mangle
- add action=accept chain=prerouting comment="if a mid-connection packet has no co\
- nnection mark, it needs the default handling" connection-mark=no-mark \
- connection-state=established,related
- add action=accept chain=prerouting comment=\
- "download packets MUST NOT be routing-marked" connection-state=\
- established,related in-interface-list=WAN
- add action=mark-routing chain=prerouting comment=\
- "Route bypass connection to bypass gateway IF it already has a connection mark" \
- connection-mark=bypass new-routing-mark=bypass passthrough=no
- add action=mark-connection chain=prerouting comment="Treat ICMP as bypass" \
- dst-address=!192.168.0.0/16 new-connection-mark=bypass passthrough=yes \
- protocol=icmp src-address=192.168.8.0/24
- add action=mark-routing chain=prerouting comment=\
- "Route bypass connection to bypass gateway" connection-mark=bypass new-routing-mark=bypass \
- passthrough=yes
|
|
楼主: guitengyue
310112100042806
发表于 2022-6-17 15:58
