Networking – Cannot Ping Other Subnet in Network

networkingrouterrouting

Well this is my network daigram

enter image description here

I have some wifi devices that connect to my wifi access point, I ran a DHCP server on ether4 and so all of wifi devices are in subnet 192.168.4.0/24

My PC is connected to router ether3 port by a LAN cable

I have two modem routers that they are DHCP servers themselve, modem router 1 is connected to mikrotik router by ether1 and mikrotik get IP from that and modem router 2 is connected to mirkotik by ether2 and mikrotik get IP from that.

I want to my PC and some wifi devices access to internet by modem router 1 and any other device access to internet by modem router 2

I did that through policy based routing and it is working, but the problem is that I can not ping from ether3 device to ether4 devices and vice versa

This is my tracert output in my PC for one of arbitrary wifi devices:
Tracing route to 192.168.4.254 over a maximum of 30 hops

  1    <1 ms    <1 ms    <1 ms  192.168.3.1
  2     1 ms     1 ms    <1 ms  192.168.2.1
  3     *        *        *     Request timed out.
  4    32 ms    21 ms    31 ms  10.196.23.193

as you see the router route it to the modem 2 not ether4!

And this is my ip route configuration:

/ip pool
add name=dhcp_pool0 ranges=192.168.3.2-192.168.3.254
add name=dhcp_pool1 ranges=192.168.4.2-192.168.4.254
/ip dhcp-server
add address-pool=dhcp_pool0 disabled=no interface=ether3 name=dhcp1
add address-pool=dhcp_pool1 disabled=no interface=ether4 name=dhcp2
/ip address
add address=192.168.3.1/24 interface=ether3 network=192.168.3.0
add address=192.168.4.1/24 interface=ether4 network=192.168.4.0
/ip dhcp-client
add disabled=no interface=ether1 use-peer-dns=no use-peer-ntp=no
add disabled=no interface=ether2 use-peer-dns=no use-peer-ntp=no
/ip dhcp-server network
add address=192.168.3.0/24 dns-server=1.1.1.1 gateway=192.168.3.1
add address=192.168.4.0/24 dns-server=1.1.1.1 gateway=192.168.4.1
/ip dns
set servers=1.1.1.1
/ip firewall address-list
add address=192.168.3.0/24 list=Irancell-Users
add address=192.168.4.0/24 list=Sabanet-Users
/ip firewall mangle
add action=mark-routing chain=prerouting new-routing-mark=User-Irancell \
    passthrough=no src-address-list=Irancell-Users
add action=mark-routing chain=prerouting new-routing-mark=User-Sabanet \
    passthrough=no src-address-list=Sabanet-Users
/ip firewall nat
add action=masquerade chain=srcnat src-address=192.168.4.0/24
add action=masquerade chain=srcnat src-address=192.168.3.0/24
/ip route
add distance=5 gateway=192.168.2.1 routing-mark=User-Irancell
add distance=10 gateway=192.168.1.1 routing-mark=User-Sabanet

Best Answer

Your "routing mark" configuration does this. When your mangle rules set the routing mark User-Irancell on the packets (by matching their source address), this has priority over local subnet routes that are in the main table (and this is generally the whole point of routing marks).

Make those rules immediately accept packets without marking if their dst-address is internal, either by using dst-address=!192.168.0.0/16 in both, or by adding a whole new rule:

/ip firewall mangle {
  add place-before=1 chain=prerouting dst-address=192.168.0.0/16 action=accept
}
Related Question