MikroTik Dual WAN Failover with Load Balancing

Introduction

Dual WAN failover on MikroTik ensures your network stays connected when one ISP goes down. MikroTik supports two main approaches: recursive routing (the modern way) and mangle + routing tables (the classic way). This guide covers both methods.

Method 1: Recursive Routing (Recommended for ROS 7)

This method uses check-gateway to detect failures and automatically switches routes.

Step 1: Configure WAN Interfaces

BASH

/ip address
add address=203.0.113.2/30 interface=ether1-WAN1 comment="ISP1"
add address=198.51.100.2/30 interface=ether2-WAN2 comment="ISP2"

Step 2: Add Default Routes with Distance

BASH

/ip route
add dst-address=0.0.0.0/0 gateway=203.0.113.1 distance=1 check-gateway=ping comment="ISP1-Primary"
add dst-address=0.0.0.0/0 gateway=198.51.100.1 distance=2 check-gateway=ping comment="ISP2-Backup"

The distance=1 route is preferred. If check-gateway=ping fails (3 missed pings), the route is deactivated and ROS falls back to the distance=2 route.

Step 3: NAT for Both WANs

BASH

/ip firewall nat
add chain=srcnat out-interface=ether1-WAN1 action=masquerade comment="NAT-ISP1"
add chain=srcnat out-interface=ether2-WAN2 action=masquerade comment="NAT-ISP2"

Method 2: Mangle + Policy Routing (Load Balancing + Failover)

This method distributes traffic across both links AND provides failover.

Step 1: Mark incoming connections to remember which WAN they came from

BASH

/ip firewall mangle
# Mark new connections coming in from WAN1
add chain=input in-interface=ether1-WAN1 action=mark-connection new-connection-mark=ISP1 passthrough=yes
# Mark new connections coming in from WAN2
add chain=input in-interface=ether2-WAN2 action=mark-connection new-connection-mark=ISP2 passthrough=yes

Step 2: Route responses back through the correct WAN

BASH

/ip firewall mangle
add chain=output connection-mark=ISP1 action=mark-routing new-routing-mark=use-ISP1 passthrough=no
add chain=output connection-mark=ISP2 action=mark-routing new-routing-mark=use-ISP2 passthrough=no

Step 3: Load balance new connections using PCC (Per Connection Classifier)

BASH

/ip firewall mangle
add chain=prerouting in-interface=bridge-LAN   per-connection-classifier=both-addresses:2/0   action=mark-routing new-routing-mark=use-ISP1 passthrough=no
add chain=prerouting in-interface=bridge-LAN   per-connection-classifier=both-addresses:2/1   action=mark-routing new-routing-mark=use-ISP2 passthrough=no

Step 4: Create routing tables

BASH

/routing table
add name=use-ISP1 fib
add name=use-ISP2 fib

Step 5: Add routes for each table

BASH

/ip route
add dst-address=0.0.0.0/0 gateway=203.0.113.1 routing-table=use-ISP1 check-gateway=ping
add dst-address=0.0.0.0/0 gateway=198.51.100.1 routing-table=use-ISP2 check-gateway=ping
# Main route
add dst-address=0.0.0.0/0 gateway=203.0.113.1 distance=1 check-gateway=ping
add dst-address=0.0.0.0/0 gateway=198.51.100.1 distance=2 check-gateway=ping

Monitoring Failover

BASH

# Check which routes are active
/ip route print where active

# Monitor WAN uptime
/interface print stats where name~"WAN"

# Ping test through specific WAN
/ping 8.8.8.8 routing-table=use-ISP1 count=4
/ping 8.8.8.8 routing-table=use-ISP2 count=4

Failover Testing

BASH

# Simulate WAN1 failure by disabling interface
/interface disable ether1-WAN1

# Check that traffic switches to ISP2
/ip route print where active

# Re-enable
/interface enable ether1-WAN1

Common Issues

Issue: Both WANs stay up but check-gateway fails

Check that the gateway IP actually responds to ICMP
Some ISPs block ICMP — use check-gateway=arp instead

Issue: Traffic not load balancing

Verify PCC rules are in prerouting with correct in-interface
Check that routing marks match routing table names exactly