a bit strange

RouterOS General
1

A bit strange, at least to me.
I have setup some mangle rules to use them then with queues
These are for SMTP-in, SMTP-out, POP3 etc.

In mangle, first I mark the connection, and then based on this mark
I mark the packet which can be used by queue, like this:

2 ;;; SMTP-IN
chain=forward in-interface=Wan1 dst-address=192.168.xxx.xxx protocol=tcp
dst-port=25 action=mark-connection new-connection-mark=SMTP-in
passthrough=yes

3 ;;;
chain=forward protocol=tcp connection-mark=SMTP-in action=mark-packet
new-packet-mark=SMTP-in passthrough=no

The strange thing to me is that when you look at the statistics, I noticed that
there are more Mib and more Packets mangled by the Packet rule than that
of the Connection rule. Since the Packet rule depends totally on the Connection
Rule, how come it has more Packets? The difference is sth. like 77 000 packets
for the Packet rule and 44 000 packets for the connection rule.

Thank you, Toni

2

nothing strange. you mark connection when packet is sent to 192.168.xxx.xxx, port 25. this packet is accounted by packet mark rule too

but packets from 192.168.xxx.xxx, port 25 do not satisfy mark connection rule, although they satisfy packet mark rule: your connection is market in both sides =)

3

How come that packets from 192.168.xxx.xxx get marked by mark-packet rule when on its side this rule depends totally on the mark connection rule?
You see, in the mark-packet rule I have defined that only those with mark-connection specified pass through this rule, right?

4

Once a connection is established the connection tracking tracks the connection and any packet that gets transmitted through that connection automatically gets marked with the appropriate marking without having to go through the mangle.

5

..which is whole purpose of having connection mark rule :slight_smile:

6

that’s what I guessed, thank you guys.

may I put another related issue, :slight_smile:?
After the packets are marked, I created a simple queue rule with the purpose to assign a priority.
So the situation is like this:

/ip firewall mangle
chain=forward in-interface=WAN1 dst-address=192.168.x.x dst-port=25 action mark-connection new-connection-mark=SMTP-in passthrough=yes
chain=forward connection-mark=SMTP-in action=mark-packet new-packet-mark=SMTP-in passthrough=no

/queue simple
dst-address=0.0.0.0/0 interface=all packet-marks=SMTP-in direction=both priority=5 … and so on

First on the queue rule at the interface I established interface=WAN1, but with this configuration I noticed that while the mangle rule was recording a traffic at 40kbps the queue rule was recording at 1600bps.
So i changed that, I put interface=all, after that the queue was recording at the same rate as the mangle rule

This sounds strange to me again, since the mangle is marking packets that come from WAN1 to LAN, why shouldn’t the queue detect those packets. Is it maybe the queue comes before the forward chain of the mangle? Hmm, still don’t get it