routeros多线路后无法从外网访问

btgs0g

routeros 7.15版本，原来单线路固定ip，能正常上网，可以从外网通过固定ip管理routeros，后来增加两条拔号线路，配置成pcc多线路叠加，配置完成后三条线路流量正常，但是无法从外网的固定ip登录routeros了，后来换成ecmp方式，三条链路也正常，但仍无法从外网登录routeros，请哪个大神指导一下怎么回事?

/routing table
add disabled=no fib name=rtab-1
add disabled=no fib name=rtab-2
add disabled=no fib name=rtab-3
/ip address
add address=202.102.224.68/24 interface=ether1 network=202.102.224.0
add address=192.168.3.2/24 interface=ether2 network=192.168.3.0
add address=30.30.30.2/24 interface=ether3 network=30.30.30.0
add address=100.100.100.1/24 interface=ether4 network=100.100.100.0
/ip dns
set allow-remote-requests=yes servers=114.114.114.114
/ip firewall address-list
add address=172.16.0.0/16 list=1
add address=172.168.66.0/24 list=1
add address=172.168.88.0/24 list=1
add address=192.168.101.0/24 list=1
add address=192.168.2.200/30 list=1
add address=192.168.201.5/32 list=1
add address=100.100.100.0/24 list=1
/ip firewall mangle
add action=mark-connection chain=prerouting connection-mark=no-mark dst-address-type=!local new-connection-mark=PCC1 per-connection-classifier=both-addresses:3/0 src-address-list=1
add action=mark-connection chain=prerouting connection-mark=no-mark dst-address-type=!local new-connection-mark=PCC2 per-connection-classifier=both-addresses:3/1 src-address-list=1
add action=mark-connection chain=prerouting connection-mark=no-mark dst-address-type=!local new-connection-mark=PCC3 per-connection-classifier=both-addresses:3/2 src-address-list=1
add action=mark-routing chain=prerouting connection-mark=PCC1 new-routing-mark=rtab-1 src-address-list=1
add action=mark-routing chain=prerouting connection-mark=PCC2 new-routing-mark=rtab-2 src-address-list=1
add action=mark-routing chain=prerouting connection-mark=PCC3 new-routing-mark=rtab-3 src-address-list=1
add action=mark-connection chain=prerouting connection-mark=no-mark in-interface=ether1 new-connection-mark=PCC1
add action=mark-connection chain=prerouting connection-mark=no-mark in-interface=ether2 new-connection-mark=PCC2
add action=mark-connection chain=prerouting connection-mark=no-mark in-interface=ether3 new-connection-mark=PCC3
add action=mark-routing chain=output connection-mark=PCC1 new-routing-mark=rtab-1
add action=mark-routing chain=output connection-mark=PCC2 new-routing-mark=rtab-2
add action=mark-routing chain=output connection-mark=PCC3 new-routing-mark=rtab-3
/ip firewall nat
add action=masquerade chain=srcnat

/ip route
add check-gateway=ping disabled=no distance=1 dst-address=0.0.0.0/0 gateway=202.102.224.1 routing-table=rtab-1 scope=30 target-scope=10
add check-gateway=ping disabled=no distance=2 dst-address=0.0.0.0/0 gateway=192.168.1.1 routing-table=rtab-2 scope=30 target-scope=10
add check-gateway=ping disabled=no distance=3 dst-address=0.0.0.0/0 gateway=70.70.70.1 routing-table=rtab-3 scope=30 target-scope=10
add disabled=no dst-address=172.16.0.0/16 gateway=100.100.100.2 routing-table=main
add disabled=no dst-address=172.168.66.0/24 gateway=100.100.100.2 routing-table=main
add disabled=no dst-address=172.168.88.0/24 gateway=100.100.100.2 routing-table=main
add disabled=no dst-address=192.168.101.0/24 gateway=100.100.100.2 routing-table=main
add disabled=no dst-address=192.168.2.200/32 gateway=100.100.100.2 routing-table=main
add disabled=no dst-address=192.168.201.5/32 gateway=100.100.100.2 routing-table=main

mantouboji

你要是不愿意贴出来配置的话，自己去检查 /ip/firewall/filter 里面每一条规则呗，看看漏了那一条INPUT

ca972008

可以在下级接个小软路由，弄个虚拟局域网，然后从lan区域访问，

btgs0g

mantouboji 发表于 2026-1-27 16:07
你要是不愿意贴出来配置的话，自己去检查 /ip/firewall/filter 里面每一条规则呗，看看漏了那一条INPUT  ...

/routing table
add disabled=no fib name=rtab-1
add disabled=no fib name=rtab-2
add disabled=no fib name=rtab-3
/ip address
add address=202.102.224.68/24 interface=ether1 network=202.102.224.0
add address=192.168.3.2/24 interface=ether2 network=192.168.3.0
add address=30.30.30.2/24 interface=ether3 network=30.30.30.0
add address=100.100.100.1/24 interface=ether4 network=100.100.100.0
/ip dns
set allow-remote-requests=yes servers=114.114.114.114
/ip firewall address-list
add address=172.16.0.0/16 list=1
add address=172.168.66.0/24 list=1
add address=172.168.88.0/24 list=1
add address=192.168.101.0/24 list=1
add address=192.168.2.200/30 list=1
add address=192.168.201.5/32 list=1
add address=100.100.100.0/24 list=1
/ip firewall mangle
add action=mark-connection chain=prerouting connection-mark=no-mark dst-address-type=!local new-connection-mark=PCC1 per-connection-classifier=both-addresses:3/0 src-address-list=1
add action=mark-connection chain=prerouting connection-mark=no-mark dst-address-type=!local new-connection-mark=PCC2 per-connection-classifier=both-addresses:3/1 src-address-list=1
add action=mark-connection chain=prerouting connection-mark=no-mark dst-address-type=!local new-connection-mark=PCC3 per-connection-classifier=both-addresses:3/2 src-address-list=1
add action=mark-routing chain=prerouting connection-mark=PCC1 new-routing-mark=rtab-1 src-address-list=1
add action=mark-routing chain=prerouting connection-mark=PCC2 new-routing-mark=rtab-2 src-address-list=1
add action=mark-routing chain=prerouting connection-mark=PCC3 new-routing-mark=rtab-3 src-address-list=1
add action=mark-connection chain=prerouting connection-mark=no-mark in-interface=ether1 new-connection-mark=PCC1
add action=mark-connection chain=prerouting connection-mark=no-mark in-interface=ether2 new-connection-mark=PCC2
add action=mark-connection chain=prerouting connection-mark=no-mark in-interface=ether3 new-connection-mark=PCC3
add action=mark-routing chain=output connection-mark=PCC1 new-routing-mark=rtab-1
add action=mark-routing chain=output connection-mark=PCC2 new-routing-mark=rtab-2
add action=mark-routing chain=output connection-mark=PCC3 new-routing-mark=rtab-3
/ip firewall nat
add action=masquerade chain=srcnat

/ip route
add check-gateway=ping disabled=no distance=1 dst-address=0.0.0.0/0 gateway=202.102.224.1 routing-table=rtab-1 scope=30 target-scope=10
add check-gateway=ping disabled=no distance=2 dst-address=0.0.0.0/0 gateway=192.168.1.1 routing-table=rtab-2 scope=30 target-scope=10
add check-gateway=ping disabled=no distance=3 dst-address=0.0.0.0/0 gateway=70.70.70.1 routing-table=rtab-3 scope=30 target-scope=10
add disabled=no dst-address=172.16.0.0/16 gateway=100.100.100.2 routing-table=main
add disabled=no dst-address=172.168.66.0/24 gateway=100.100.100.2 routing-table=main
add disabled=no dst-address=172.168.88.0/24 gateway=100.100.100.2 routing-table=main
add disabled=no dst-address=192.168.101.0/24 gateway=100.100.100.2 routing-table=main
add disabled=no dst-address=192.168.2.200/32 gateway=100.100.100.2 routing-table=main
add disabled=no dst-address=192.168.201.5/32 gateway=100.100.100.2 routing-table=main

btgs0g

btgs0g 发表于 2026-1-27 16:48
/routing table
add disabled=no fib name=rtab-1
add disabled=no fib name=rtab-2

不好意思，配置忘记贴了

mantouboji

没看到 /ip firewall filter 啊

btgs0g

mantouboji 发表于 2026-1-28 09:33
没看到 /ip firewall filter 啊

这个是照着模板配置的，不知道flter怎么配置？

zsecsqawdx

在mangle里做一下标记回流，你试试。
/ip firewall mangle
add action=mark-connection chain=input dst-port=8291 in-interface=pppoe-out1 \
    new-connection-mark=conn_pppoe1 passthrough=yes protocol=tcp
add action=mark-connection chain=input in-interface=pppoe-out1 \
    new-connection-mark=conn_pppoe1 passthrough=yes protocol=icmp
add action=mark-routing chain=output connection-mark=conn_pppoe1 \
    new-routing-mark=pppoe1_routing passthrough=yes
add action=mark-connection chain=input dst-port=8291 in-interface=pppoe-out2 \
    new-connection-mark=conn_pppoe2 passthrough=yes protocol=tcp
add action=mark-connection chain=input in-interface=pppoe-out2 \
    new-connection-mark=conn_pppoe2 passthrough=yes protocol=icmp
add action=mark-routing chain=output connection-mark=conn_pppoe2 \
    new-routing-mark=pppoe2_routing passthrough=yes
这个是winbox和ping的标记回流，照你的改一下 置顶。new-routing-mark调用你现成的也行。端口映射的话input和output改成prerouting

btgs0g

zsecsqawdx 发表于 2026-1-28 14:35
在mangle里做一下标记回流，你试试。
/ip firewall mangle
add action=mark-connection chain=input dst-po ...

这个测试了一下，可以在input规则里面看到有数据包，但是仍然无法访问，output里面没有数据包

zsecsqawdx

btgs0g 发表于 2026-2-2 11:56
这个测试了一下，可以在input规则里面看到有数据包，但是仍然无法访问，output里面没有数据包 ...

input Action 到 new-connection-mark，然后output调用这个connection-mark Action 到 new-routing-mark，防火墙没封的话，output必定有数据包。