Load Balance PCC + Failover

1# MikroTik Load Balancing Connection Classifier (LB PCC)
2# Generated by Mikrosetting.com
3# Date: 25/10/2026 17.13.29
4# RouterOS: (belum dipilih)
5# WAN ISPs: 2
6# Recursive Gateway: on
7# Bandwidth Ratio: off
8# PCC Type: both-addresses-and-ports
9# Local Target: IP Address List (RFC1918)
10 
11# Syarat: interface tiap ISP dan LAN sudah punya IP address. Backup dulu: /system backup save name=sebelum-loadbalance
12 
13/ip firewall address-list
14add address=192.168.0.0/16 list=LOCAL-IP comment="Local IPs or Private IPs (RFC1918) - By Mikrosetting"
15add address=172.16.0.0/12 list=LOCAL-IP
16add address=10.0.0.0/8 list=LOCAL-IP
17 
18/ip firewall nat
19add chain=srcnat out-interface=ether1 dst-address-list=!LOCAL-IP action=masquerade comment="Nat Masquerade to ISP 1 - By Mikrosetting"
20add chain=srcnat out-interface=ether2 dst-address-list=!LOCAL-IP action=masquerade comment="Nat Masquerade to ISP 2 - By Mikrosetting"
21 
22/ip route
23add dst-address=1.1.1.1 distance=1 gateway=192.168.1.1 target-scope=10 scope=10 comment="PCC Recursive Check ISP 1 - By Mikrosetting"
24add dst-address=1.1.1.2 distance=1 gateway=192.168.2.1 target-scope=10 scope=10 comment="PCC Recursive Check ISP 2 - By Mikrosetting"
25 
26add check-gateway=ping distance=1 gateway=1.1.1.1 routing-mark=to-ISP1 scope=30 target-scope=30 comment="PCC Routing Mark to ISP 1 - By Mikrosetting"
27add check-gateway=ping distance=1 gateway=1.1.1.2 routing-mark=to-ISP2 scope=30 target-scope=30 comment="PCC Routing Mark to ISP 2 - By Mikrosetting"
28add check-gateway=ping distance=1 gateway=1.1.1.1 scope=30 target-scope=30 comment="PCC Default Route to ISP 1 - By Mikrosetting"
29add check-gateway=ping distance=2 gateway=1.1.1.2 scope=30 target-scope=30 comment="PCC Default Route to ISP 2 - By Mikrosetting"
30 
31/ip firewall mangle
32add action=accept chain=prerouting hotspot=from-client,!auth disabled=yes comment="HOTSPOT LOGIN BYPASS - Enable this if this Router handles Hotspot Login."
33add action=accept chain=prerouting dst-address-list=LOCAL-IP src-address-list=LOCAL-IP comment="// LOCAL TRAFFIC BYPASS - By Mikrosetting"
34add action=accept chain=postrouting dst-address-list=LOCAL-IP src-address-list=LOCAL-IP
35add action=accept chain=forward dst-address-list=LOCAL-IP src-address-list=LOCAL-IP
36add action=accept chain=input dst-address-list=LOCAL-IP src-address-list=LOCAL-IP
37add action=accept chain=output dst-address-list=LOCAL-IP src-address-list=LOCAL-IP
38add action=mark-connection chain=input connection-mark=no-mark in-interface=ether1 new-connection-mark=ISP1-conn passthrough=yes comment="// PCC LOAD BALANCING - By Mikrosetting"
39add action=mark-connection chain=input connection-mark=no-mark in-interface=ether2 new-connection-mark=ISP2-conn passthrough=yes
40add action=mark-routing chain=output connection-mark=ISP1-conn new-routing-mark=to-ISP1 passthrough=no
41add action=mark-routing chain=output connection-mark=ISP2-conn new-routing-mark=to-ISP2 passthrough=no
42add action=mark-connection chain=prerouting connection-state=new connection-mark=no-mark new-connection-mark=ISP1-conn passthrough=yes per-connection-classifier=both-addresses-and-ports:2/0 dst-address-list=!LOCAL-IP src-address-list=LOCAL-IP dst-address-type=!local
43add action=mark-connection chain=prerouting connection-state=new connection-mark=no-mark new-connection-mark=ISP2-conn passthrough=yes per-connection-classifier=both-addresses-and-ports:2/1 dst-address-list=!LOCAL-IP src-address-list=LOCAL-IP dst-address-type=!local
44add action=mark-routing chain=prerouting connection-mark=ISP1-conn new-routing-mark=to-ISP1 passthrough=yes dst-address-list=!LOCAL-IP src-address-list=LOCAL-IP
45add action=mark-routing chain=prerouting connection-mark=ISP2-conn new-routing-mark=to-ISP2 passthrough=yes dst-address-list=!LOCAL-IP src-address-list=LOCAL-IP
46 
47# FastTrack bawaan melewati mangle, jadi dibatasi ke koneksi tanpa mark (koneksi PCC tidak di-fasttrack).
48/ip firewall filter
49set [find where action=fasttrack-connection] connection-mark=no-mark
50 
51# Cek hasil: /ip route print where dst-address="0.0.0.0/0"  |  /ip firewall mangle print stats
52# Jika Load Balance tidak berjalan, cek berurutan:
53# 1) Interface LAN harus ada di sumber trafik: address-list LOCAL-IP
54# 2) /ip firewall mangle print stats  -> counter rule PCC harus naik
55# 3) /ip route print where routing-mark~"to-"  -> rute tiap ISP harus aktif (huruf A)
56# 4) Rule FastTrack harus berisi connection-mark=no-mark: /ip firewall filter print where action=fasttrack-connection
57# 5) Tiap ISP harus punya IP + gateway benar dan bisa di-ping: /ping 1.1.1.1 interface=<ether-ISP>
58# Hapus semua settingan Load Balance: pakai tab "Hapus semua" di sebelah script ini.
59