Hello Chupaka. I tested that again and it was working fine (after an unexpected shutdown). at that situation, I solved this by copying everything field by field (even copying dhcp arps in disabled=yes mode was making error with DX flags) and then removing every dynamic arp and enabling disable arps ...

I can't make any of arp static due to "Couldn't add new ARP, Already have such ARP!" error.
It would be awesome if there was a command for that too. making static is only possible on gui (I know with some scripts it is possible. I mean something like "/ip arp set x static=yes")

You can consider for example, this simpler situation. for i from=0 to=100 do={ip firewall mangle add chain=forward dst-address=10.10.10.0/24 action=mark-packet new-packet-mark=$i;ip firewall mangle add chain=forward packet-mark=!$i action=accept} Even if we create all packet marks first, by this com...

Thanks for your editions, but non of these two approaches work. Main issue is that packet mark isn't created yet and mikrotik doesn't now that yet. these were not soloution to this problem. you can test it. It would be great if mikrotik could run this command.

Hello normis. I wanted to inform you of this bug in case of you didn't read that:
http://forum.mikrotik.com/viewtopic.php?f=1&t=94415
It's making me a lot of effort.

Hello Mikrotik. please fix this. I think this is a bug. in loops, packet-mark=!"something$i" doesn't work and I need to do it by hand. sometimes for large numbers (100 or 200). sample code: for i from=0 to=100 do={ip firewall mangle add chain=forward dst-address=10.10.10.0/24 action=mark-p...

Hello. I've seen hAP lite. Thats a good approach to see Mikrotik in more places. but have you ever considered making a Wireless router with ADSL 2+ input? That will target a wide range of customers having ADSL service. I have ADSL too. and I bridged my ADSL modem and made pppoe client in my router. ...

That's good. but not enough. still you can't allow a user reach firewall rules while he can't change ppp rules. or add routes.

Hello Mikrotik. I always wanted to have admins with special write permissions. for example user A, can just add mangle rules and user B, can just manage ppp. user C is responsible for backups and restore and etc. at first I searched too much for applying these in my radius server till I saw this use...

you should somehow reach your routers. if you haven't any public ip, then you should have public ip on where you want remote from. and then start a pptp or ip tunnel to that place. other ways exist. but not inside a router without a public ip.

you should just mark packets with destinations of 0.0.0.0/0 (with prerouting chain), then mark their connection, and then mark their routing. you can differ users route by their src-addresses, or destinations, or interfaces, or ... or you can route them from main ISP and set second route's distance ...

Sure. I consider that your router is configured with basic routes and dst/src nat rules. follower rules are based on what I think about your current config and maybe you need replace some current nat and mangle rules and routes with similar rules of mine (or you can send your current config so I wri...

You have mistakes in marking connections and recognizing wans to Mikrotik. also input chains are obviously wrong.

I don't know Tomato. but I do know Mikrotik. and it does absolutely EVERYTHING!! (Except doing dishes, Flying, Fishing, etc). and best part of it, is that you can configure your scenario in many many different ways. and sure it has advanced qos features. and in advanced works, its not a simple click...

Sure. you can mark their (web servers) connections and pass them through a queue of 10mbps. and pass rest of other bandwidth through another queue of 90mbps (there are many other ways based on your needs).
other questions are welcomed as well.
If answer was helpful, donate a karma

Can you send your config?

You can do this via L7 regex. or more simple, by "content". any questions are welcomed.

You can do this, via Src. Mac Address for download limit, and L7 regex or content, for upload limit, and alternatively for download limit (with connection and packet marking).

What device is your proxy server?