How to configure load balancing on Mikrotik routers using Per Connection Classifier (PCC)

PCC is a feature in Mikrotik routerOS that allows traffics to be divided into equal streams of packets, giving administrators the ability to identify and keep specific traffics restricted to a predefined connection. It can be used to accomplish load-balancing with the option of automatic fail-over in a dual ISP connection.
In this post, I will share with us on how to configure load balancing on a Mikrotik router, using PCC. We can instruct connections that come in via an ISP to go out via the same ISP’s connection. The configuration below ensures it is achieved. First, address the interfaces.
Mikrotik load balancing
Image showing dual-ISP connections to a router


Assign IP addresses

/ ip address

add address= network= broadcast=

add address= network= broadcast=

add address= network= broadcast=

Set default gateways for unmarked connections

/ip route

add dst-address= check-gateway=ping gateway=,

Nat rules for traffics out both ISPs connections

/ip firewall nat

add action=masquerade chain=srcnat comment=”ISP1″ out-interface=ether1

add action=masquerade chain=srcnat comment=”ISP2″ out-interface=ether2


Because we want to make sure that connections coming in through one ISP, leaves via the same ISP, we must identify and keep these connections separate. We will use connection mark the connections as they coming via the ISPs and use route mark them as they leave. See below.

Mark inbound connections

/ip firewall mangle

add action=mark-connection chain=input comment=”ISP1_Inbound” in-interface=ether1 new-connection-mark=”ISP1_Inbound”


add action=mark-connection chain=input comment=”ISP2_Inbound” in-interface=ether2 new-connection-mark=”ISP2_Inbound”


Use Route Mark for outbound connections

add action=mark-routing chain=output comment=”ISP1­_Outbound” connection-mark=”ISP1_Inbound” new-routing-mark=”ISP1_Outbound”


add action=mark-routing chain=output comment=”ISP2_Outbound” connection-mark=”ISP1_Inbound” new-routing-mark=”ISP2_Outbound”


Using the route marks created above, we need to set route-marks that will identify various connections. Connections with destination addresses that are NOT from the LAN addresses will be identified and based on the route-mark, used to classify the ratio at which connections should be established out both ISP links. See below:

Setting route marks for LAN connections

/Ip firewall mangle

add action=mark-routing chain=prerouting comment=”LAN load balancing 2-0″ \

dst-address-type=!local in-interface=ether3 new-routing-mark=\

“ISP1_Outbound” passthrough=yes per-connection-classifier=\


add action=mark-routing chain=prerouting comment=”LAN load balancing 2-1″ \

dst-address-type=!local in-interface=ether3 new-routing-mark=\

“ISP2_Outbound” passthrough=yes per-connection-classifier=\


Finally, we create default routes to make use of the route-marks above to load-balance across both ISP. These default routes will ensure that traffics coming in via an ISP to leave via the same. See below:

Setting default routes

/ip route

add distance=1 gateway= routing-mark=”ISP1_Outbound”

add distance=1 gateway= routing-mark=”ISP2_Outbound”

The configuration above will ensure that traffics are load-balanced across both ISP connections by making sure that connection that are initiated via an ISP remains with that ISP except the link fails, in which case the connection will be re-established using the alternate link. Connections that are not marked, will make use of the first configured default route which makes ISP1 the preferred connection while ISP2 is the backup route.

Spread the love

Leave a Comment