MikroTik Multi-WAN PCC Load Balance Calculator

Multi-WAN (2–5 ISP) proportional PCC load balancing and recursive failover configuration script generator for RouterOS v7.

Input Parameters

Try Example:

Calculation Results

ispCount: 2
mode: pcc
classifier: both-addresses-and-ports
lanIface: bridge-lan
lanCidr: 192.168.88.0/24
totalBandwidthMbps: 150
ratioString: 2 : 1
totalPccStreams: 3
isps: [{"index":1,"name":"ISP1","iface":"ether1-ISP1","gw":"192.168.1.1","bw":100,"check":"1.1.1.1","weight":2,"connMark":"ISP1_conn","routeTable":"to-ISP1"},{"index":2,"name":"ISP2","iface":"ether2-ISP2","gw":"192.168.2.1","bw":50,"check":"8.8.8.8","weight":1,"connMark":"ISP2_conn","routeTable":"to-ISP2"}]

RouterOS Script

# =====================================================================
# InfraCalc.id - MikroTik RouterOS v7 Multi-WAN (2 ISP) PCC + Recursive Failover
# Rasio Beban Otomatis: ISP1 (100M) : ISP2 (50M) = 2 : 1 (3 PCC Streams)
# Classifier: both-addresses-and-ports | LAN Interface: bridge-lan (192.168.88.0/24)
# =====================================================================

/routing table
add disabled=no fib name=to-ISP1
add disabled=no fib name=to-ISP2

/ip firewall address-list
add address=192.168.0.0/16 list=RFC1918-LOCAL comment="Bypass Private LAN Traffic"
add address=10.0.0.0/8 list=RFC1918-LOCAL
add address=172.16.0.0/12 list=RFC1918-LOCAL

/ip firewall mangle
add action=accept chain=prerouting dst-address-list=RFC1918-LOCAL in-interface=bridge-lan comment="Bypass Local-to-Local / Inter-VLAN dari PCC"
add action=mark-connection chain=prerouting connection-mark=no-mark in-interface=ether1-ISP1 new-connection-mark=ISP1_conn passthrough=yes comment="Mark Inbound ISP1"
add action=mark-connection chain=prerouting connection-mark=no-mark in-interface=ether2-ISP2 new-connection-mark=ISP2_conn passthrough=yes comment="Mark Inbound ISP2"
add action=mark-connection chain=prerouting connection-mark=no-mark dst-address-type=!local in-interface=bridge-lan new-connection-mark=ISP1_conn passthrough=yes per-connection-classifier=both-addresses-and-ports:3/0 comment="PCC Stream 1/3 -> ISP1 (100M)"
add action=mark-connection chain=prerouting connection-mark=no-mark dst-address-type=!local in-interface=bridge-lan new-connection-mark=ISP1_conn passthrough=yes per-connection-classifier=both-addresses-and-ports:3/1 comment="PCC Stream 2/3 -> ISP1 (100M)"
add action=mark-connection chain=prerouting connection-mark=no-mark dst-address-type=!local in-interface=bridge-lan new-connection-mark=ISP2_conn passthrough=yes per-connection-classifier=both-addresses-and-ports:3/2 comment="PCC Stream 3/3 -> ISP2 (50M)"
add action=mark-routing chain=prerouting connection-mark=ISP1_conn in-interface=bridge-lan new-routing-mark=to-ISP1 passthrough=no comment="Route LAN ke ISP1"
add action=mark-routing chain=prerouting connection-mark=ISP2_conn in-interface=bridge-lan new-routing-mark=to-ISP2 passthrough=no comment="Route LAN ke ISP2"
add action=mark-routing chain=output connection-mark=ISP1_conn new-routing-mark=to-ISP1 passthrough=no comment="Route Output Router ke ISP1"
add action=mark-routing chain=output connection-mark=ISP2_conn new-routing-mark=to-ISP2 passthrough=no comment="Route Output Router ke ISP2"

/ip firewall nat
add action=masquerade chain=srcnat out-interface=ether1-ISP1 comment="NAT Masquerade ISP1 (100 Mbps)"
add action=masquerade chain=srcnat out-interface=ether2-ISP2 comment="NAT Masquerade ISP2 (50 Mbps)"

# Recursive Routing Failover (Mendeteksi Putus di Tengah Jaringan ISP / FO Cut)
/ip route
add dst-address=1.1.1.1/32 gateway=192.168.1.1 scope=10 target-scope=10 comment="Monitor Host ISP1 via ether1-ISP1"
add dst-address=8.8.8.8/32 gateway=192.168.2.1 scope=10 target-scope=10 comment="Monitor Host ISP2 via ether2-ISP2"

# Routing Table per ISP + Cascading Backup Otomatis
add check-gateway=ping distance=1 dst-address=0.0.0.0/0 gateway=1.1.1.1 routing-table=to-ISP1 scope=30 target-scope=11 comment="Primary Route Table ISP1"
add check-gateway=ping distance=2 dst-address=0.0.0.0/0 gateway=8.8.8.8 routing-table=to-ISP1 scope=30 target-scope=11 comment="Failover Table ISP1 -> Backup ISP2"
add check-gateway=ping distance=1 dst-address=0.0.0.0/0 gateway=8.8.8.8 routing-table=to-ISP2 scope=30 target-scope=11 comment="Primary Route Table ISP2"
add check-gateway=ping distance=2 dst-address=0.0.0.0/0 gateway=1.1.1.1 routing-table=to-ISP2 scope=30 target-scope=11 comment="Failover Table ISP2 -> Backup ISP1"

# Default Route pada Main Routing Table
add check-gateway=ping distance=1 dst-address=0.0.0.0/0 gateway=1.1.1.1 routing-table=main scope=30 target-scope=11 comment="Default Route Main ISP1 (Distance 1)"
add check-gateway=ping distance=2 dst-address=0.0.0.0/0 gateway=8.8.8.8 routing-table=main scope=30 target-scope=11 comment="Default Route Main ISP2 (Distance 2)"

How to Use This Tool

Select your number of ISP links (2 to 5) and choose the operational mode: PCC Load Balancing + Failover or pure Active-Backup Failover.
Enter your local LAN bridge name, each ISP's WAN interface, modem gateway IP, measured bandwidth in Mbps, and recursive ping monitor IP (such as 1.1.1.1 or 8.8.8.8).
Review the computed load ratio and total PCC stream count, then copy the complete RouterOS v7 script—including RFC 1918 LAN bypass rules—directly into your router terminal.

Worked Example: Dual-WAN 100M + 50M (2:1 Ratio)

Computed example: Combining 2 ISPs (ISP1 at 100M and ISP2 at 50M) produces a proportional load ratio of 2 : 1 across 3 PCC streams on bridge-lan (150 Mbps aggregate capacity).

Example Input

{
  "ispCount": 2,
  "mode": "pcc",
  "classifier": "both-addresses-and-ports",
  "lanIface": "bridge-lan",
  "lanCidr": "192.168.88.0/24",
  "isp1Bw": 100,
  "isp1Gw": "192.168.1.1",
  "isp1Iface": "ether1-ISP1",
  "isp2Bw": 50,
  "isp2Gw": "192.168.2.1",
  "isp2Iface": "ether2-ISP2"
}

Calculated Output

ispCount:: 2
mode:: pcc
classifier:: both-addresses-and-ports
lanIface:: bridge-lan
lanCidr:: 192.168.88.0/24
totalBandwidthMbps:: 150
ratioString:: 2 : 1
totalPccStreams:: 3
isps:: [{"index":1,"name":"ISP1","iface":"ether1-ISP1","gw":"192.168.1.1","bw":100,"check":"1.1.1.1","weight":2,"connMark":"ISP1_conn","routeTable":"to-ISP1"},{"index":2,"name":"ISP2","iface":"ether2-ISP2","gw":"192.168.2.1","bw":50,"check":"8.8.8.8","weight":1,"connMark":"ISP2_conn","routeTable":"to-ISP2"}]

Core Concept & Engineering Notes

Per Connection Classifier (PCC) is an advanced multi-WAN traffic distribution mechanism in MikroTik RouterOS that hashes packet headers—such as source address, destination address, and port numbers—into discrete integer streams to distribute traffic across multiple ISP links. Unlike round-robin per-packet balancing, which frequently breaks HTTPS sessions and online banking by transmitting interleaved packets across different public source IPs, PCC ensures that all packets belonging to an active TCP connection or UDP exchange persist through the same WAN provider. This calculator computes proportional load-balancing streams using greatest common divisor (GCD) arithmetic on each ISP's provisioned bandwidth. For instance, pairing a 100 Mbps primary ISP with a 50 Mbps secondary line produces a 2:1 ratio spanning 3 total PCC streams, automatically distributing two-thirds of outbound connections to the primary provider and one-third to the secondary provider. The total number of generated streams is capped at 15 to keep firewall mangle rule evaluation fast and preserve router CPU capacity. Alongside traffic balancing, the generator configures RouterOS v7 Recursive Routing Failover. Traditional gateway ping checks only verify the local Ethernet connection between the router and the ISP fiber modem. By establishing recursive routes targeting external DNS resolvers (such as Cloudflare 1.1.1.1 or Google 8.8.8.8) using scope and target-scope metrics, the router actively monitors true end-to-end internet transit. If a backhaul fiber cut occurs upstream while the local modem stays powered, the router automatically fails over traffic within seconds and seamlessly restores primary routing once the link recovers.

How It Was Calculated (Formulas & Steps)

Mathematical Formulas

Initial ISP Weight = max(1, round(Bandwidth ÷ 10))
GCD = gcd(Weight ISP1, Weight ISP2, ..., Weight ISPN)
Reduced Ratio = Initial Weight ÷ GCD
Total PCC Streams = Σ(Reduced Ratio) (scaled if > 15 for CPU efficiency)
Recursive Route: Gateway host check via modem gateway with scope=10 and target-scope=11

Step-by-Step Calculation

Configured 2 WAN links with total aggregated capacity of 150 Mbps
Calculated bandwidth weights via GCD reduction: ISP1 (100 Mbps) : ISP2 (50 Mbps) → Ratio 2 : 1 (3 PCC streams total)
Generated RouterOS v7 routing tables, RFC 1918 bypass mangle rules, and recursive host monitoring for ISP1 via 1.1.1.1, ISP2 via 8.8.8.8

Frequently Asked Questions (FAQ)

Why is the 'both-addresses-and-ports' classifier recommended for most setups?

This classifier hashes source IP, destination IP, and transport ports together. It yields the most even traffic distribution across multi-user networks without breaking HTTPS sessions, since any individual transport session remains locked to one WAN link.

What is the purpose of the RFC 1918 bypass rule in the PCC mangle table?

An early accept rule targeting private IP ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) ensures that local inter-VLAN routing, printer access, and modem management traffic are not inadvertently marked and routed out to the internet.

How does Recursive Routing Failover function in RouterOS v7?

The router defines a static host route to a public IP (e.g. 1.1.1.1) with scope=10 via the modem gateway. The default route (0.0.0.0/0) then uses 1.1.1.1 as its gateway with check-gateway=ping and target-scope=11. If pings to 1.1.1.1 fail, the default route becomes inactive.

Can PCC combine the download speed of a single-connection download?

No. A single TCP connection is routed through exactly one ISP. Aggregate throughput (e.g. 100 + 50 = 150 Mbps) is realized across concurrent multi-connection activities such as multi-threaded download managers or multiple concurrent users.

MikroTik Bandwidth Calculator (Simple Queue, Burst, PCQ, FQ-CoDel)

Calculate Limit-At (CIR), Max-Limit (MIR), Burst, PCQ, and FQ-CoDel for RouterOS v7 with automated configuration script generation.

MikroTik Port Forwarding (DST-NAT) and Hairpin NAT Generator

Expose internal server/NVR ports to the public internet (DST-NAT) and eliminate local loopback timeouts using Hairpin NAT.

IPv4 Subnet and CIDR Calculator

Calculate IPv4 network address, broadcast, usable host range, netmask, wildcard, binary mask, and RFC address type (RFC 1918, /31, CGNAT).

References & Notes

Last updated: 2026-11-06Content Status: Draft (Pending Editorial Review)

Note: Results above are mathematical estimates based on standard formulas. Always verify against official vendor documentation and site conditions before production deployment.