Load Balancing PCC (Per Connection Classifier)

1. Prinsip Kerja Load Balancing PCC

PCC (Per Connection Classifier) mengelompokkan lalu lintas data ke dalam beberapa jalur (stream) yang seimbang berdasarkan nilai hash dari kombinasi Source IP, Destination IP, Source Port, dan Destination Port. Dengan memilih mode both-addresses-and-ports, koneksi per user akan selalu konsisten melewati ISP yang sama selama sesi berlangsung (aman untuk login perbankan HTTPS).

2. Skrip Lengkap LB PCC 2 Line ISP (RouterOS v7)

# ================= 1. TABEL ROUTING V7 =================
/routing table add name=to-ISP1 fib
/routing table add name=to-ISP2 fib

# ================= 2. FIREWALL MANGLE PCC =================
/ip firewall mangle
add chain=prerouting dst-address=192.168.1.0/24 in-interface=ether3-LAN action=accept comment="Bypass Local ISP1"
add chain=prerouting dst-address=192.168.2.0/24 in-interface=ether3-LAN action=accept comment="Bypass Local ISP2"

# Tangkap Koneksi Masuk dari Masing-Masing WAN
add chain=prerouting in-interface=ether1-WAN1 connection-state=no-mark action=mark-connection new-connection-mark=conn-WAN1 passthrough=yes
add chain=prerouting in-interface=ether2-WAN2 connection-state=no-mark action=mark-connection new-connection-mark=conn-WAN2 passthrough=yes

# Bagi Koneksi Klien LAN Menggunakan PCC 2/0 dan 2/1
add chain=prerouting in-interface=ether3-LAN connection-state=no-mark dst-address-type=!local per-connection-classifier=both-addresses-and-ports:2/0 action=mark-connection new-connection-mark=conn-WAN1 passthrough=yes
add chain=prerouting in-interface=ether3-LAN connection-state=no-mark dst-address-type=!local per-connection-classifier=both-addresses-and-ports:2/1 action=mark-connection new-connection-mark=conn-WAN2 passthrough=yes

# Beri Routing Mark Berdasarkan Connection Mark
add chain=prerouting in-interface=ether3-LAN connection-mark=conn-WAN1 action=mark-routing new-routing-mark=to-ISP1 passthrough=yes
add chain=prerouting in-interface=ether3-LAN connection-mark=conn-WAN2 action=mark-routing new-routing-mark=to-ISP2 passthrough=yes

# ================= 3. IP ROUTE & FAILOVER =================
/ip route
add dst-address=0.0.0.0/0 gateway=192.168.1.1 routing-table=to-ISP1 check-gateway=ping
add dst-address=0.0.0.0/0 gateway=192.168.2.1 routing-table=to-ISP2 check-gateway=ping
add dst-address=0.0.0.0/0 gateway=192.168.1.1 distance=1 check-gateway=ping comment="Main Route"
add dst-address=0.0.0.0/0 gateway=192.168.2.1 distance=2 check-gateway=ping comment="Backup Route"

# ================= 4. NAT MASQUERADE =================
/ip firewall nat
add chain=srcnat out-interface=ether1-WAN1 action=masquerade
add chain=srcnat out-interface=ether2-WAN2 action=masquerade