I have two PPPoE exits from ISPs and one PPPoE server. I have done Wan load balancing at the two PPPoE exits to balance the traffic load from the intranet. When the intranet client is DHCP or static IP, Wan load balancing works normally, but when the intranet client is PPPoE client, Wan load balancing does not work.
This is my configuration
set interfaces bridge br0 description 'pppoe-lan'
set interfaces bridge br0 member interface eth2
set interfaces bridge br1 address '192.168.10.1/24'
set interfaces bridge br1 member interface eth3
set interfaces bridge br1 description 'dhcp-lan'
set interfaces ethernet eth2 description '>pppoe-lan'
set interfaces ethernet eth3 description '>dhcp-lan'
set interfaces pppoe pppoe0 authentication password 'test1'
set interfaces pppoe pppoe0 authentication user 'test1'
set interfaces pppoe pppoe0 description 'WAN1'
set interfaces pppoe pppoe0 remote-address '10.234.0.1'
set interfaces pppoe pppoe0 source-interface 'eth0'
set interfaces pppoe pppoe1 authentication password 'test2'
set interfaces pppoe pppoe1 authentication user 'test2'
set interfaces pppoe pppoe1 description 'WAN2'
set interfaces pppoe pppoe1 remote-address '10.235.0.1'
set interfaces pppoe pppoe1 source-interface 'eth1'
set load-balancing wan flush-connections
set load-balancing wan interface-health pppoe0 failure-count '3'
set load-balancing wan interface-health pppoe0 nexthop '10.234.0.1'
set load-balancing wan interface-health pppoe0 success-count '5'
set load-balancing wan interface-health pppoe0 test 0 resp-time '5'
set load-balancing wan interface-health pppoe0 test 0 target '223.5.5.5'
set load-balancing wan interface-health pppoe0 test 0 ttl-limit '1'
set load-balancing wan interface-health pppoe0 test 0 type 'ping'
set load-balancing wan interface-health pppoe1 failure-count '3'
set load-balancing wan interface-health pppoe1 nexthop '10.235.0.1'
set load-balancing wan interface-health pppoe1 success-count '5'
set load-balancing wan interface-health pppoe1 test 0 resp-time '5'
set load-balancing wan interface-health pppoe1 test 0 target '223.5.5.5'
set load-balancing wan interface-health pppoe1 test 0 ttl-limit '1'
set load-balancing wan interface-health pppoe1 test 0 type 'ping'
set load-balancing wan rule 1 inbound-interface 'br0'
set load-balancing wan rule 1 interface pppoe0 weight '1'
set load-balancing wan rule 1 interface pppoe1 weight '1'
set load-balancing wan rule 1 protocol 'all'
set load-balancing wan rule 2 inbound-interface 'br1'
set load-balancing wan rule 2 interface pppoe0 weight '1'
set load-balancing wan rule 2 interface pppoe1 weight '1'
set load-balancing wan rule 2 protocol 'all'
set load-balancing wan sticky-connections inbound
set nat source rule 1 outbound-interface 'pppoe0'
set nat source rule 1 translation address 'masquerade'
set nat source rule 2 outbound-interface 'pppoe1'
set nat source rule 2 translation address 'masquerade'
set protocols static route 0.0.0.0/0 next-hop 10.234.0.1 interface pppoe0
set protocols static route 0.0.0.0/0 next-hop 10.235.0.1 interface pppoe1
set service dhcp-server shared-network-name dhcp subnet 192.168.10.0/24 default-router '192.168.10.1'
set service dhcp-server shared-network-name dhcp subnet 192.168.10.0/24 dns-server '223.5.5.5'
set service dhcp-server shared-network-name dhcp subnet 192.168.10.0/24 lease '28800'
set service dhcp-server shared-network-name dhcp subnet 192.168.10.0/24 range 0 start '192.168.10.100'
set service dhcp-server shared-network-name dhcp subnet 192.168.10.0/24 range 0 stop '192.168.10.200'
set service pppoe-server access-concentrator 'pppoes'
set service pppoe-server authentication mode 'radius'
set service pppoe-server authentication radius dynamic-author key '408d7e79f84f'
set service pppoe-server authentication radius dynamic-author port '3799'
set service pppoe-server authentication radius dynamic-author server '172.27.0.11'
set service pppoe-server authentication radius nas-identifier 'vyos'
set service pppoe-server authentication radius rate-limit attribute 'Mikrotik-Rate-Limit'
set service pppoe-server authentication radius rate-limit enable
set service pppoe-server authentication radius rate-limit vendor 'Mikrotik'
set service pppoe-server authentication radius server 172.27.0.10 key '408d7e79f84f'
set service pppoe-server authentication radius server 172.27.0.10 port '1812'
set service pppoe-server client-ip-pool start '20.234.0.10'
set service pppoe-server client-ip-pool stop '20.234.255.254'
set service pppoe-server gateway-address '20.234.0.1'
set service pppoe-server interface br0
set service pppoe-server name-server '223.5.5.5'
This is the state of Wan load balancing
vyos@vyos# run show wan-load-balance
Interface: pppoe0
Status: active
Last Status Change: Sat Apr 16 07:02:12 2022
+Test: ping Target: 223.5.5.5
Last Interface Success: 0s
Last Interface Failure: 9m7s
# Interface Failure(s): 0
Interface: pppoe1
Status: active
Last Status Change: Sat Apr 16 07:02:12 2022
+Test: ping Target: 223.5.5.5
Last Interface Success: 0s
Last Interface Failure: 9m7s
# Interface Failure(s): 0
[edit]
vyos@vyos# run show wan-load-balance status
Chain WANLOADBALANCE_PRE (1 references)
pkts bytes target prot opt in out source destination
72 10386 ISP_pppoe0 all -- br0 * 0.0.0.0/0 0.0.0.0/0 state NEW statistic mode random probability 0.50000000000
71 8678 ISP_pppoe1 all -- br0 * 0.0.0.0/0 0.0.0.0/0 state NEW
0 0 CONNMARK all -- br0 * 0.0.0.0/0 0.0.0.0/0 CONNMARK restore
8487 1019K ISP_pppoe0 all -- br1 * 0.0.0.0/0 0.0.0.0/0 state NEW statistic mode random probability 0.50000000000
8480 1015K ISP_pppoe1 all -- br1 * 0.0.0.0/0 0.0.0.0/0 state NEW
83172 14M CONNMARK all -- br1 * 0.0.0.0/0 0.0.0.0/0 CONNMARK restore
[edit]
vyos@vyos#
To verify this, when I delete the default route, DHCP clients and static IP clients can still access the Internet through load balancing, while PPPoE clients cannot access the Internet.
vyos@vyos# show protocols static route | commands
set route 0.0.0.0/0 next-hop 10.234.0.1 interface 'pppoe0'
set route 0.0.0.0/0 next-hop 10.235.0.1 interface 'pppoe1'
[edit]
vyos@vyos# run show ip route
Codes: K - kernel route, C - connected, S - static, R - RIP,
O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP,
T - Table, v - VNC, V - VNC-Direct, A - Babel, F - PBR,
f - OpenFabric,
> - selected route, * - FIB route, q - queued, r - rejected, b - backup
t - trapped, o - offload failure
S>* 0.0.0.0/0 [1/0] via 10.234.0.1, pppoe0 onlink, weight 1, 00:11:16
* via 10.235.0.1, pppoe1 onlink, weight 1, 00:11:16
C>* 10.10.10.0/24 is directly connected, eth4, 00:12:18
C * 10.234.0.1/32 is directly connected, pppoe0, 00:11:17
C>* 10.235.0.1/32 is directly connected, pppoe1, 00:11:17
C>* 20.234.0.11/32 is directly connected, ppp2, 00:03:29
C>* 172.27.0.0/20 is directly connected, vtun10, 00:11:16
K>* 172.27.224.0/20 [0/101] via 172.27.0.1, vtun10, 00:11:10
C>* 192.168.10.0/24 is directly connected, br1, 00:12:19
[edit]
vyos@vyos#
[edit]
vyos@vyos# delete protocols static route
[edit]
vyos@vyos# commit
[edit]
vyos@vyos# run show ip route
Codes: K - kernel route, C - connected, S - static, R - RIP,
O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP,
T - Table, v - VNC, V - VNC-Direct, A - Babel, F - PBR,
f - OpenFabric,
> - selected route, * - FIB route, q - queued, r - rejected, b - backup
t - trapped, o - offload failure
C>* 10.10.10.0/24 is directly connected, eth4, 00:12:44
C * 10.234.0.1/32 is directly connected, pppoe0, 00:11:43
C>* 10.235.0.1/32 is directly connected, pppoe1, 00:11:43
C>* 20.234.0.11/32 is directly connected, ppp2, 00:03:55
C>* 172.27.0.0/20 is directly connected, vtun10, 00:11:42
K>* 172.27.224.0/20 [0/101] via 172.27.0.1, vtun10, 00:11:36
C>* 192.168.10.0/24 is directly connected, br1, 00:12:45
[edit]
vyos@vyos# ping 8.8.8.8
ping: connect: Network is unreachable
[edit]
vyos@vyos#
At this time, clients accessing the Internet through DHCP can still access the Internet, while clients accessing the Internet through PPPoE cannot connect to the Internet