Load Balance ECMP MikroTik

# =====================================================
# MikroTik Load Balance ECMP - Router-Utama
# WAN: 2 | LAN: 1
# Dibuat: 2026-09-02 14:36 UTC
# Tempel di New Terminal RouterOS (cek nama interface dulu)
# =====================================================

# --- 1. Interface list (grouping WAN & LAN) ---
/interface list
add name=WAN comment="Semua uplink ISP"
add name=LAN comment="Semua jaringan lokal"
/interface list member
add list=WAN interface=ether1-wan1 comment="ISP-1"
add list=WAN interface=ether2-wan2 comment="ISP-2"
add list=LAN interface=bridge-lan

# --- 2. Address list jaringan lokal (dikecualikan dari load balance) ---
/ip firewall address-list
add list=LOCAL-NET address=10.10.0.0/24 comment="LAN1"
add list=LOCAL-NET address=127.0.0.0/8
add list=LOCAL-NET address=224.0.0.0/4

# --- 3. Route ECMP (Equal/Weighted Cost Multi-Path) ---
/ip route
add dst-address=0.0.0.0/0 gateway=192.168.1.1,192.168.2.1 distance=1 check-gateway=ping comment="ECMP-LOADBALANCE"

# --- 4. Route failover per WAN (distance bertingkat) ---
/ip route
add dst-address=0.0.0.0/0 gateway=192.168.1.1 distance=10 check-gateway=ping comment="FAILOVER-ISP-1"
add dst-address=0.0.0.0/0 gateway=192.168.2.1 distance=11 check-gateway=ping comment="FAILOVER-ISP-2"

# --- 5. Mangle: connection marking agar sesi tidak pindah WAN ---
/ip firewall mangle
add chain=prerouting action=accept in-interface=bridge-lan dst-address-list=LOCAL-NET comment="LAN1 lokal bypass"
add chain=input action=mark-connection new-connection-mark=conn-wan01 in-interface=ether1-wan1 comment="in ISP-1"
add chain=output action=mark-routing new-routing-mark=to-wan01 connection-mark=conn-wan01 comment="reply via ISP-1"
add chain=input action=mark-connection new-connection-mark=conn-wan02 in-interface=ether2-wan2 comment="in ISP-2"
add chain=output action=mark-routing new-routing-mark=to-wan02 connection-mark=conn-wan02 comment="reply via ISP-2"

# --- 6. Routing mark per WAN (untuk trafik balasan router) ---
/ip route
add dst-address=0.0.0.0/0 gateway=192.168.1.1 routing-table=to-wan01 distance=1 comment="mark ISP-1"
add dst-address=0.0.0.0/0 gateway=192.168.2.1 routing-table=to-wan02 distance=1 comment="mark ISP-2"
/routing table
add name=to-wan01 fib
add name=to-wan02 fib

# --- 7. NAT masquerade tiap WAN ---
/ip firewall nat
add chain=srcnat action=masquerade out-interface=ether1-wan1 comment="NAT ISP-1"
add chain=srcnat action=masquerade out-interface=ether2-wan2 comment="NAT ISP-2"

# --- 8. DNS ---
/ip dns set servers=1.1.1.1,8.8.8.8 allow-remote-requests=yes cache-size=4096KiB

# --- 9. Firewall dasar ---
/ip firewall filter
add chain=input action=accept connection-state=established,related comment="Terima koneksi lanjutan"
add chain=input action=accept in-interface-list=LAN comment="Akses dari LAN"
add chain=input action=drop in-interface-list=WAN comment="Tolak akses dari WAN"

# --- Selesai. Cek: /ip route print detail where comment="ECMP-LOADBALANCE" ---