Connection marking in mangle

Hi. Trying to give higher priority to 1433 port connections. First i mark all traffic as class-d, then select 1433 port (actualy it can be any port) and mark as class-a. Next i suppose to mark packets of both connection marks and build a queue. But when i monitor IP-FIERWALL-CONNECTIONS with 1433 port filter, i see some connections as class-a and some as class-d. The same thing is on the other router. Why is that so?

add action=mark-connection chain=forward comment=ALLTRAFFIC disabled=no new-connection-mark=CLASS-D passthrough=yes
add action=mark-connection chain=forward comment=SQL disabled=no dst-port=1433 new-connection-mark=CLASS-A passthrough=yes protocol=tcp

When you are using passthrough if your connection would match another connection lower down it will get remarked. It can’t have multiple connection marks.

Exactly, class-d mark is higher in the list than class-a, so all traffic first gets class-d mark and when a connection matches another condition (1433 port) it should change its mark to class-a. Most of the cnnections do this but some stay as class-d. What am i doing wrong?

It might be in the wrong chain. Check the packet flow to see what chain you should be in.

http://wiki.mikrotik.com/wiki/Manual:Packet_Flow

Mark using the prerouting chain?

I have SRC_NAT enabled so i guess i need to use postrouting chain but it changes nothing. I tried all chains for both types of traffic.

all the traffic is already marked with no-mark packet/connection mark, so you are just wasting a lot of resources on something you do not have to do at all.

are those in the beginning all the mangle rules there is?

all the traffic is already marked with no-mark packet/connection mark

Ok, i thouhgt about this but anyway when i’m disabling “alltraffic” marker and having more different classes (class-b, class-c connections) some connetcions to the port 1433 become class-c and class-b as you can see on the screenshot.

I never thought about this… :open_mouth:

So if you have a ‘base’ priority you don’t really need a rule, you just need a queue that grabs no_mark. :sunglasses: