Used when:
two small offices;
VPN is already up and running;
few networks;
no need for OSPF.
Configuration:
R1
/ip route add dst-address=192.168.20.0/24 gateway=10.0.12.2
R2
/ip route add dst-address=192.168.10.0/24 gateway=10.0.12.1
All traffic to corporate networks goes through HQ, and all other traffic goes directly to the Internet through the branch's provider.
HQ
192.168.1.0/24
R1
10.0.12.1 10.0.13.1 10.0.14.1
/ | \
/ | \
R2 R3 R4
10.0.12.2 10.0.13.2 10.0.14.2
Branch1 Branch2 Branch3
192.168.10.0 192.168.20.0 192.168.30.0
Pros
Simple setup
Everything is administered centrally
Cons
As you increase your branch network, static routes become a problem.
Configuration:
R1
/ip route
add dst-address=192.168.10.0/24 gateway=10.0.12.2 comment="Branch 1"
add dst-address=192.168.20.0/24 gateway=10.0.13.2 comment="Branch 2"
add dst-address=192.168.30.0/24 gateway=10.0.14.2 comment="Branch 3"
R2
/ip route
add dst-address=192.168.1.0/24 gateway=10.0.12.1 comment="HQ LAN"
add dst-address=192.168.20.0/24 gateway=10.0.12.1 comment="Branch 2 via HQ"
add dst-address=192.168.30.0/24 gateway=10.0.12.1 comment="Branch 3 via HQ"
R3
/ip route
add dst-address=192.168.1.0/24 gateway=10.0.13.1 comment="HQ LAN"
add dst-address=192.168.10.0/24 gateway=10.0.13.1 comment="Branch 1 via HQ"
add dst-address=192.168.30.0/24 gateway=10.0.13.1 comment="Branch 3 via HQ"
R4
/ip route
add dst-address=192.168.1.0/24 gateway=10.0.14.1 comment="HQ LAN"
add dst-address=192.168.10.0/24 gateway=10.0.14.1 comment="Branch 1 via HQ"
add dst-address=192.168.20.0/24 gateway=10.0.14.1 comment="Branch 2 via HQ"
Dual WAN Failover provides automatic Internet redundancy by using two Internet Service Providers (ISPs). The router sends all traffic through the primary ISP under normal conditions while continuously monitoring its availability. If the primary connection fails, traffic is automatically redirected to the backup ISP. Once the primary link is restored, the router switches back to it without requiring manual intervention, ensuring minimal network downtime.
Internet
/ \
/ \
ISP1 ISP2
GW 100.64.1.1 GW 100.64.2.1
| |
ether1 ether2
\ /
\ /
MikroTik
|
ether3
|
LAN 192.168.10.0/24
Used when:
Primary channel: 1 Gbps fiber
Backup channel: 300 Mbps other provider
Configuration:
/ip address
add address=100.64.1.2/24 interface=ether1 comment="ISP1"
add address=100.64.2.2/24 interface=ether2 comment="ISP2"
add address=192.168.10.1/24 interface=ether3 comment="LAN"
/ip route add dst-address=0.0.0.0/0 gateway=100.64.1.1 distance=1 check-gateway=ping comment="Primary ISP"
/ip route add dst-address=0.0.0.0/0 gateway=100.64.2.1 distance=2 comment="Backup ISP"
/ip firewall nat add chain=srcnat action=masquerade out-interface=ether1 comment="NAT ISP1"
/ip firewall nat add chain=srcnat action=masquerade out-interface=ether2 comment="NAT ISP2"
Recursive Routing improves Dual WAN Failover by monitoring real Internet connectivity instead of only checking the ISP gateway. The router sends traffic through the primary ISP while continuously verifying the reachability of a reliable public IP address (such as 1.1.1.1). If that destination becomes unreachable, the primary route is automatically disabled and traffic is switched to the backup ISP. Once Internet connectivity through the primary ISP is restored, the router automatically returns traffic to the preferred connection.
Internet
/ \
/ \
ISP1 ISP2
GW 100.64.1.1 GW 100.64.2.1
| |
ether1 ether2
\ /
\ /
MikroTik
|
ether3
|
LAN 192.168.10.0/24
Configuration:
/ip address add address=100.64.1.2/24 interface=ether1 comment="ISP1"
/ip address add address=100.64.2.2/24 interface=ether2 comment="ISP2"
/ip address add address=192.168.10.1/24 interface=ether3 comment="LAN"
/ip route add dst-address=1.1.1.1/32 gateway=100.64.1.1 scope=10 comment="ISP1 Check"
/ip route add dst-address=8.8.8.8/32 gateway=100.64.2.1 scope=10 comment="ISP2 Check"
/ip route add dst-address=0.0.0.0/0 gateway=1.1.1.1 distance=1 target-scope=11 check-gateway=ping comment="Primary ISP"
/ip route add dst-address=0.0.0.0/0 gateway=8.8.8.8 distance=2 target-scope=11 check-gateway=ping comment="Backup ISP"
/ip firewall nat add chain=srcnat action=masquerade out-interface=ether1 comment="ISP1 NAT"
/ip firewall nat add chain=srcnat action=masquerade out-interface=ether2 comment="ISP2 NAT"