qjkxbmwvz

Hi,

I am considering upgrading my router (RB750Gr3). I am eyeing the CRS309-1G-8S+IN in the hopes that the fast ISP in town eventually expand to my street (10G fiber).

My question is about L3HW offloading, and how it plays with PBR. Currently, I have a number of rules (/routing/rule), some based on source IP and some on VLAN. The purpose is to route certain traffic through VPNs (WireGuard, but I run on a separate computer, not on the router itself). Example: VLAN10 routes all traffic through main routing table, VLAN20 routes local traffic through router but sends external traffic through VPN-1, and VLAN30 sends everything through VPN-2. I use a number of different VPNs, so it's not just a binary "main route or VPN."

I am unclear how this plays with L3HW offloading. This page ( https://help.mikrotik.com/docs/spaces/ROS/pages/62390319/L3+Hardware+Offloading#L3HardwareOffloading-Inter-VLANRoutingwithUpstreamPortBehindFirewall/NAT ) mentions pbr-cap/usage/lpm-bank but I am unclear if that's referring to what I'd be using. That page also says that only the main routing table is HW offloaded in the context of VRF, so I wasn't sure if that also applied to PBR.

The question then, is, does L3HW offloading 1) Just Work for PBR /routing/rule, 2) only work via Fasttrack (perhaps requiring some redirect-to-cpu switch rules), or 3) ain't gonna work?

To preempt a few questions: I know Fasttrack is a last resort. I am a single household, I don't have concerns about TCAM exhaustion. I am considering a CRS instead of a "true" router due to cost and reduced energy footprint. I also know that I don't "need" 10G; if it is ever offered on my street it'll be via an ISP with a "best effort" policy, i.e., they don't have throttled tiers, so 10G is their only offering (cheaper than we're paying now for asymmetric cable).

Thanks!

What I want: I want to be able to route specific clients through different interfaces (WireGuard tunnels), and I want this behavior to persist upon disconnect/reconnect. Clients can change which tunnel, with several VLANs being able to use the tunnels (so a client A on VLAN 124 and client B on VLAN 789 can both use VPN tunnel X or Y at their discretion).

What I have: IPv4 works fine (routing rule src address -> routing table). IPv6 works, but is not persistent, as clients change their IPv6 address. (I have a dinky script where I enter IPv4 address and country, and it will grab a VPN peer from a json file, set it up, and add the IPv4+current IPv6 address to the routing rules. This works well currently; I use Mullvad.)

Any recommendations? Ideas: use IPv6 mangle based on MAC address, but I have been having trouble getting this to work (extremely slow). Another idea is to have a script run and grab the IPv6 address of client (either by hostname or by DHCP lease+MAC info), but I'm not sure if it's possible to trigger a script upon IPv6 neighbor discovery.

Any help appreciated!