RouterOS SD-WAN 跨境网络优化实战：MikroTik 多链路智能调度配置指南

# === RouterOS CLI 配置：连接标记与路由标记 ===

# 1. 定义 WAN 接口变量（根据实际接口名修改）
:global wan1 "ether1-cn2"
:global wan2 "ether2-cu"
:global wan3 "ether3-aws"

# 2. 创建 Mangle 规则 — 标记入站连接
/ip firewall mangle
add chain=prerouting in-interface=$wan1 connection-mark=no-mark \
    action=mark-connection new-connection-mark=conn-cn2
add chain=prerouting in-interface=$wan2 connection-mark=no-mark \
    action=mark-connection new-connection-mark=conn-cu
add chain=prerouting in-interface=$wan3 connection-mark=no-mark \
    action=mark-connection new-connection-mark=conn-aws

# 3. 创建 Mangle 规则 — 标记出站路由
/ip firewall mangle
add chain=prerouting connection-mark=conn-cn2 \
    action=mark-routing new-routing-mark=route-cn2
add chain=prerouting connection-mark=conn-cu \
    action=mark-routing new-routing-mark=route-cu
add chain=prerouting connection-mark=conn-aws \
    action=mark-routing new-routing-mark=route-aws

# 4. 确保默认路由表包含所有 WAN 网关
/ip route
add dst-address=0.0.0.0/0 gateway=<CN2-GATEWAY> routing-mark=route-cn2 distance=1
add dst-address=0.0.0.0/0 gateway=<CU-GATEWAY> routing-mark=route-cu distance=1
add dst-address=0.0.0.0/0 gateway=<AWS-GATEWAY> routing-mark=route-aws distance=2

# === Netwatch 探测配置 ===

# 为每条链路创建 Netwatch 探测（指向对端公网 IP）
/tool netwatch
add host=<CN2-REMOTE-IP> interval=5s timeout=3s \
    up-script="/system script run sdwan-cn2-up" \
    down-script="/system script run sdwan-cn2-down"
add host=<CU-REMOTE-IP> interval=5s timeout=3s \
    up-script="/system script run sdwan-cu-up" \
    down-script="/system script run sdwan-cu-down"

# 链路恢复脚本示例（CN2 恢复时）
/system script
add name=sdwan-cn2-up owner=admin policy=read,write,test source={
    :log info "SD-WAN: CN2 link restored, re-enabling route"
    /ip route enable [find routing-mark=route-cn2]
}

# 链路故障脚本示例（CN2 故障时）
/system script
add name=sdwan-cn2-down owner=admin policy=read,write,test source={
    :log warning "SD-WAN: CN2 link down, failing over to backup"
    /ip route disable [find routing-mark=route-cn2]
}

# === 策略路由配置 ===

# 将 VoIP 流量（UDP/5060, UDP/10000-20000）固定走低延迟链路
/ip firewall mangle
add chain=prerouting protocol=udp dst-port=5060 \
    action=mark-routing new-routing-mark=route-cn2
add chain=prerouting protocol=udp dst-port=10000-20000 \
    action=mark-routing new-routing-mark=route-cn2

# HTTP/HTTPS 流量优先走带宽最大的联通链路
/ip firewall mangle
add chain=prerouting protocol=tcp dst-port=80,443 \
    action=mark-routing new-routing-mark=route-cu

# QoS 队列树 — 保证 VoIP 最低带宽
/queue tree
add name=qos-voip parent=global packet-mark=voip-pkt \
    limit-at=10M max-limit=50M priority=1
add name=qos-http parent=global packet-mark=http-pkt \
    limit-at=30M max-limit=100M priority=3

# 启用 SD-WAN 相关日志记录
/system logging
add topics=netwatch,script,info action=memory prefix="SD-WAN"
add topics=netwatch,script,warning action=disk prefix="SD-WAN-CRIT" \
    file-name=sdwan-critical

# 查看最近切换记录
/log print where message~"SD-WAN"