You have two internet connections and want to use both at once, not just keep one as a cold backup. The naive approach — alternating individual packets between the two links — breaks things, because a single TCP session (a download, a video call) ends up split across two paths with different latency and can arrive out of order or just fail. Per Connection Classifier (PCC) solves this by balancing whole connections, not packets.
Mark connections for each ISP in the mangle table
In prerouting, classify each new connection from your LAN into one of two buckets using a hash of the address pair. The 2/0 and 2/1 mean "split into 2 groups, this is group 0 (or 1)":
/ip firewall mangle add chain=prerouting src-address=192.168.88.0/24 \
dst-address-type=!local per-connection-classifier=both-addresses:2/0 \
action=mark-connection new-connection-mark=isp1-conn
/ip firewall mangle add chain=prerouting src-address=192.168.88.0/24 \
dst-address-type=!local per-connection-classifier=both-addresses:2/1 \
action=mark-connection new-connection-mark=isp2-connMark the routing for each connection mark
Once a connection is marked, tag its packets with a routing mark so they follow the matching gateway:
/ip firewall mangle add chain=prerouting connection-mark=isp1-conn action=mark-routing new-routing-mark=to-isp1
/ip firewall mangle add chain=prerouting connection-mark=isp2-conn action=mark-routing new-routing-mark=to-isp2Add a default route per routing mark
Each routing mark needs its own default route pointing at the matching ISP gateway:
/ip route add gateway=1.1.1.1 routing-mark=to-isp1
/ip route add gateway=2.2.2.2 routing-mark=to-isp2
/ip route add gateway=1.1.1.1 distance=1
/ip route add gateway=2.2.2.2 distance=2The last two plain routes cover traffic that never got a connection mark (like traffic originated by the router itself), with the same distance-based failover pattern used for basic dual-WAN.
Confirm both links are carrying traffic
Generate traffic from a few different LAN clients and watch the interface counters on both WAN interfaces — with PCC's 2/0 and 2/1 split, you should see connections landing on both links roughly evenly across enough clients.
Why do it this way
PCC hashes on the connection's address/port tuple and keeps every packet of that same connection on the same link for its whole lifetime — that's the entire point of balancing by connection instead of by packet. A large file transfer or a video call stays coherent on one path from start to finish, while the next new connection might get hashed to the other link. Splitting individual packets between two links with different latency, on the other hand, routinely produces out-of-order delivery and broken TCP sessions — it looks like it should work and usually doesn't in practice.
How MoniTik helps
Running two WAN links only pays off if you actually know both are healthy — MoniTik shows both interfaces' status and throughput on a single dashboard, so a degraded or fully-down secondary link doesn't sit unnoticed for weeks while all your traffic quietly funnels onto the one that's still up.
Camila focuses on routing, VPNs, and hardening MikroTik deployments for small and mid-size networks.