How to Configure MikroTik Dual-WAN Load Balancing with PTCL & StormFiber in Karachi
Step-by-step MikroTik RouterOS PCC (Per Connection Classifier) dual-WAN failover and load balancing setup for PTCL Flash Fiber (PPPoE) and StormFiber (Static/DHCP) in Karachi corporate offices.
⚡ Direct Answer & Quick Diagnostic Summary (AEO)
To configure highly resilient Dual-WAN load balancing on MikroTik RouterOS with PTCL Flash Fiber and StormFiber in Karachi: Deploy Per Connection Classifier (PCC) using the matcher "both-addresses-and-ports" in IP Firewall Mangle PREROUTING to distribute outbound office traffic equally while ensuring banking sessions and VoIP remain tied to a single public IP. Configure recursive routing via virtual distance metrics targeting reliable global Anycast IPs (8.8.8.8 and 1.1.1.1) with check-gateway=ping. This detects upstream fiber backhaul cuts even when the local GPON ONT optical modem remains powered on during load-shedding generator transitions. Set up bidirectional NAT Masquerade on both WAN interfaces and configure policy routing tables to route DNS requests through public resolvers rather than ISP-internal DNS pools.
Primary Root Causes
Can't resolve this issue or hardware failure halted your shift?
Our certified field hardware & network engineers are on standby for emergency on-site repair across Korangi, SITE, Clifton, DHA, Shahrah-e-Faisal, and all Karachi commercial areas.
Step-by-Step Diagnostic Checklist
Step 1: Physical Cable Interface & WAN Topology Setup
Connect PTCL Flash Fiber GPON router to ether1-WAN1 and StormFiber fiber ONT to ether2-WAN2. Connect your corporate LAN distribution switch to bridge1 (ether3–ether5). Configure WAN1 interface with PPPoE client credentials or Static IP (e.g., 192.168.10.2/24), and WAN2 with StormFiber assigned Static IP/Gateway. Ensure both interfaces have descriptive comments and appropriate MTU/MRU (1492 for PPPoE, 1500 for Ethernet).
Step 2: Configure IP Addresses & Separate Outbound NAT Masquerade
In IP -> Addresses, assign 192.168.88.1/24 to bridge1 (Office LAN). In IP -> Firewall -> NAT, create two masquerade rules: (1) chain=srcnat out-interface=ether1-WAN1 action=masquerade, and (2) chain=srcnat out-interface=ether2-WAN2 action=masquerade. This ensures outbound packets inherit the correct public IP of the egress interface.
Step 3: Configure Mangle Connection Marks & PCC Rules in PREROUTING
Under IP -> Firewall -> Mangle, bypass local traffic with: chain=prerouting dst-address=192.168.88.0/24 action=accept. Next, mark incoming WAN connections: chain=prerouting in-interface=ether1-WAN1 connection-mark=no-mark action=mark-connection new-connection-mark=WAN1_conn passthrough=yes (repeat for WAN2). Next, apply Per-Connection Classifier: chain=prerouting in-interface=bridge1 connection-mark=no-mark per-connection-classifier=both-addresses-and-ports:2/0 action=mark-connection new-connection-mark=WAN1_conn; and for 2/1 action=mark-connection new-connection-mark=WAN2_conn.
Step 4: Generate Routing Marks for PCC Connection Groups
In IP -> Firewall -> Mangle, create two routing mark rules: (1) chain=prerouting in-interface=bridge1 connection-mark=WAN1_conn action=mark-routing new-routing-mark=to_WAN1 passthrough=no; (2) chain=prerouting in-interface=bridge1 connection-mark=WAN2_conn action=mark-routing new-routing-mark=to_WAN2 passthrough=no. Also add output chain rules to ensure router-originated traffic responds via the same interface it entered.
Step 5: Implement Fail-Safe Recursive Distance Routing with Ping Checks
Standard gateway ping only checks the local ONU, which fails to detect upstream ISP blackholes. Under IP -> Routes, create host routes: dst-address=8.8.8.8/32 gateway=[WAN1-Gateway] scope=10; dst-address=1.1.1.1/32 gateway=[WAN2-Gateway] scope=10. Then add default routes: (1) dst-address=0.0.0.0/0 gateway=8.8.8.8 check-gateway=ping distance=1 target-scope=11 routing-mark=to_WAN1; (2) dst-address=0.0.0.0/0 gateway=1.1.1.1 check-gateway=ping distance=2 target-scope=11 routing-mark=to_WAN1 (failover). Repeat inversely for routing-mark=to_WAN2 and the main routing table.
Step 6: Harden Sticky Sessions for Online Banking & Corporate Portals
In IP -> Firewall -> Address-Lists, create a list named "Sticky_Services" and populate with CIDR ranges of sensitive services (M365, Banking, FBR e-Portal, Zoom). In Mangle PREROUTING, add an override rule placing all traffic destined for "Sticky_Services" onto a single designated primary WAN connection mark (WAN1_conn) with fallback only upon complete fiber failure.
Step 7: Configure Neutral Fast Anycast DNS & Drop Remote DNS Requests
In IP -> DNS, configure primary DNS servers to 1.1.1.1, 8.8.8.8, and 9.9.9.9. Uncheck "Allow Remote Requests" on WAN interfaces or add firewall filter rules blocking TCP/UDP port 53 on all WAN interfaces to prevent your MikroTik from being abused as a public DNS amplification relay in Karachi.
Frequently Asked Questions
Will dual-WAN load balancing double our download speed in Karachi on single downloads?
No. PCC load balancing operates per-connection, not per-packet. A single file download or speedtest stream will utilize either PTCL or StormFiber up to that single line’s max speed. However, aggregate office bandwidth across 20+ users downloading, streaming, and calling simultaneously will seamlessly utilize 100% of both fiber pipes.
Why do banking portals log employees out when load balancing is active?
Bank servers (HBL, Meezan, Alfalah) invalidate user sessions if sequential HTTPS requests originate from alternating public IP addresses. Using "both-addresses-and-ports" classifier or pinning port 443 banking CIDRs to a dedicated WAN via Sticky Mangle rules solves this issue completely.
How fast does MikroTik switch traffic when PTCL fiber cable is cut on the street in Karachi?
With recursive ping monitoring targeting 8.8.8.8, MikroTik sends ICMP echo probes every 10 seconds. When two consecutive probes time out (20 seconds), the route distance turns inactive and 100% of office traffic shifts to StormFiber in under 1 second without dropping active TCP connections.
Need Enterprise Deployment or Support for IT Support & IT Services?
If your team needs full hands-on setup, SLA monitoring, or emergency on-site assistance in Karachi, our certified engineers are ready.