Help with client QOS

p3rad0x · September 29, 2015, 10:16am

Good day,

First of all I’m not sure if this is the correct thread to post this in but here goes.

I am the network admin for a Wisp with about 2200 wireless clients.

We use simple pcq queues to limit the connection speed of the clients on the CPE, usually a RB Groove or SXT.

All clients are assigned unique ip’s on the wlan interface and we masquerade on the wlan interface.

Up until now the simple queues worked fine but more and more clients are starting to complain about slow speeds.

The cause of this is mostly android/apple devices uploading to iCloud or Google Drive.

When I queue 54.231.0.0/16 they begin to complain about iCloud not syncing ect.

I have tried different queue trees online but the are a hand full to make changes if the client upgrades their speed.

My question is,

Is it possible to use simple queues to limit the max upload and download while using a queue tree to prioritize certain types of data, like DNS and icmp?

Thank you in advance.

p3rad0x · October 12, 2015, 8:06am

Ok,

I was unable to find a 100% working solution yet but what I did with the complaining customers is to create a new simple queue on dst-address: 54.231.0.0/16 and give the queue 50% of the total bandwith.

Seems to solve the problem for now, until icloud starts using a different subnet.

chechito · October 12, 2015, 9:59am

with ros 6.x you can do queue tree then simple queue

i just do a queue tree in this way
queue.jpg

manuelm · October 13, 2015, 8:26pm

Hi Chechito,

Could you provide the export view of your queue tree.

Thanks!

Jose

chechito · October 14, 2015, 3:29am

its a router for a docsis connection 11mbps down 2.2mbps up

2 interfaces, lan its a bridge interface, not using firewall on bridge
ethernet 5 its wan

its tuned for navigation traffic, voip, torrent, ipsec site to site vpns and ipsec ipip vpns, and management protocolos

192.168.0.0/16 its a summary of remote networks on vpns to mark it as VPN connections and leave it out of queues as well as ipip protocol, because its better to queue ipsec traffic itself to take in count encapsulation overhead.

its based on this:
http://www.mikrotik-routeros.com/2014/05/the-mother-of-all-qos-trees-v6-0/

but with some changes for example from ros 6.28 connection rate is not working

with this implementation i can use VOIP, navigation, and torrent (500 connections) all the time without problem or congestion

/queue type
add kind=red name=red_TEST_download red-avg-packet=1500 red-limit=40 \
    red-max-threshold=40 red-min-threshold=20
add kind=red name=red_TEST_upload red-avg-packet=1500 red-burst=10 red-limit=\
    20 red-max-threshold=20
/queue simple
add dst=ether5 max-limit=1800k/8250k name=queue1 queue=\
    pcq-upload-default/pcq-download-default target=bridge1_lan total-queue=\
    default
/queue tree
add max-limit=1800k name=TOTAL_U parent=global queue=default
add max-limit=8250k name=TOTAL_D parent=global queue=default
add limit-at=1M max-limit=1800k name=1_ACK_U packet-mark=ACK_U parent=TOTAL_U \
    priority=1 queue=default
add limit-at=4M max-limit=8250k name=1_ACK_D packet-mark=ACK_D parent=TOTAL_D \
    priority=1 queue=default
add limit-at=1M max-limit=1800k name=1_DNS_U packet-mark=DNS_U parent=TOTAL_U \
    priority=1 queue=default
add limit-at=4M max-limit=8250k name=1_DNS_D packet-mark=DNS_D parent=TOTAL_D \
    priority=1 queue=default
add limit-at=100k max-limit=1800k name=4_DUDE_U packet-mark=DUDE_U parent=\
    TOTAL_U priority=4 queue=pcq-upload-default
add limit-at=250k max-limit=8250k name=4_DUDE_D packet-mark=DUDE_D parent=\
    TOTAL_D priority=4 queue=pcq-download-default
add limit-at=1M max-limit=1800k name=1_ICMP_U packet-mark=ICMP_U parent=\
    TOTAL_U priority=1 queue=default
add limit-at=4M max-limit=8250k name=1_ICMP_D packet-mark=ICMP_D parent=\
    TOTAL_D priority=1 queue=default
add limit-at=100k max-limit=1800k name=5_HTTP_U packet-mark=HTTP_U parent=\
    TOTAL_U priority=5 queue=pcq-upload-default
add limit-at=250k max-limit=8250k name=5_HTTP_D packet-mark=HTTP_D parent=\
    TOTAL_D priority=5 queue=pcq-download-default
add limit-at=100k max-limit=1800k name=6_HTTP_U_BIG packet-mark=HTTP_BIG_U \
    parent=TOTAL_U priority=6 queue=pcq-upload-default
add limit-at=250k max-limit=8250k name=6_HTTP_D_BIG packet-mark=HTTP_BIG_D \
    parent=TOTAL_D priority=6 queue=pcq-download-default
add limit-at=100k max-limit=1800k name=5_OTHER_U packet-mark=OTHER_U parent=\
    TOTAL_U priority=5 queue=pcq-upload-default
add limit-at=250k max-limit=8250k name=5_OTHER_D packet-mark=OTHER_D parent=\
    TOTAL_D priority=5 queue=pcq-download-default
add limit-at=4M max-limit=8250k name=4_IPSEC_D packet-mark=IPSEC_D parent=\
    TOTAL_D priority=4 queue=pcq-download-default
add limit-at=1M max-limit=1800k name=4_IPSEC_U packet-mark=IPSEC_U parent=\
    TOTAL_U priority=4 queue=pcq-upload-default
add limit-at=4M max-limit=8250k name=2_VOIP_D packet-mark=VOIP_D parent=\
    TOTAL_D priority=2 queue=default
add limit-at=1M max-limit=1800k name=2_VOIP_U packet-mark=VOIP_U parent=\
    TOTAL_U priority=2 queue=default
add limit-at=250k max-limit=8250k name=6_MAIL_D packet-mark=MAIL_D parent=\
    TOTAL_D priority=6 queue=pcq-download-default
add limit-at=100k max-limit=1800k name=6_MAIL_U packet-mark=MAIL_U parent=\
    TOTAL_U priority=6 queue=pcq-upload-default
add limit-at=100k max-limit=1800k name=7_OTHER_BIG_U packet-mark=OTHER_BIG_U \
    parent=TOTAL_U priority=7 queue=red_TEST_upload
add limit-at=250k max-limit=8250k name=7_OTHER_D_BIG packet-mark=OTHER_BIG_D \
    parent=TOTAL_D priority=7 queue=red_TEST_download
add limit-at=250k max-limit=8250k name=4_RDP_D packet-mark=RDP_D parent=\
    TOTAL_D priority=4 queue=pcq-download-default
add limit-at=100k max-limit=1800k name=4_RDP_U packet-mark=RDP_U parent=\
    TOTAL_U priority=4 queue=pcq-upload-default

/ip firewall mangle
add action=set-priority chain=postrouting comment="dscp 46" dscp=46 \
    new-priority=6
add action=set-priority chain=postrouting comment="dscp 48" dscp=48 \
    new-priority=6
add action=mark-connection chain=postrouting comment=TUNELS dst-address=\
    192.168.0.0/16 new-connection-mark=VPN out-interface=ether5 passthrough=\
    no
add action=mark-connection chain=postrouting dst-address=192.168.0.0/16 \
    new-connection-mark=VPN out-interface=ipip-tunnel-isescl58 passthrough=no
add action=mark-connection chain=forward dst-address=192.168.0.0/16 \
    new-connection-mark=VPN out-interface=ether5 passthrough=no
add action=mark-connection chain=forward dst-address=192.168.0.0/16 \
    new-connection-mark=VPN out-interface=ipip-tunnel-isescl58 passthrough=no
add action=mark-connection chain=output dst-address=192.168.0.0/16 \
    new-connection-mark=VPN out-interface=ether5 passthrough=no
add action=mark-connection chain=output dst-address=192.168.0.0/16 \
    new-connection-mark=VPN out-interface=ipip-tunnel-isescl58 passthrough=no
add action=mark-connection chain=postrouting new-connection-mark=VPN \
    out-interface=ether5 passthrough=no protocol=ipencap
add action=mark-connection chain=forward new-connection-mark=VPN \
    out-interface=ether5 passthrough=no protocol=ipencap
add action=mark-connection chain=output new-connection-mark=VPN \
    out-interface=ether5 passthrough=no protocol=ipencap
add action=mark-connection chain=prerouting in-interface=ether5 \
    new-connection-mark=VPN passthrough=no src-address=192.168.0.0/16
add action=mark-connection chain=prerouting in-interface=ipip-tunnel-isescl58 \
    new-connection-mark=VPN passthrough=no src-address=192.168.0.0/16
add action=mark-connection chain=forward in-interface=ether5 \
    new-connection-mark=VPN passthrough=no src-address=192.168.0.0/16
add action=mark-connection chain=forward in-interface=ipip-tunnel-isescl58 \
    new-connection-mark=VPN passthrough=no src-address=192.168.0.0/16
add action=mark-connection chain=input in-interface=ether5 \
    new-connection-mark=VPN passthrough=no src-address=192.168.0.0/16
add action=mark-connection chain=input in-interface=ipip-tunnel-isescl58 \
    new-connection-mark=VPN passthrough=no src-address=192.168.0.0/16
add action=mark-connection chain=forward in-interface=ether5 \
    new-connection-mark=VPN passthrough=no protocol=ipencap
add action=mark-connection chain=prerouting in-interface=ether5 \
    new-connection-mark=VPN passthrough=no protocol=ipencap
add action=mark-connection chain=input in-interface=ether5 \
    new-connection-mark=VPN passthrough=no protocol=ipencap
add action=mark-connection chain=output comment=DNS connection-mark=no-mark \
    connection-state=new new-connection-mark=DNS out-interface=ether5 \
    passthrough=no port=53 protocol=udp
add action=mark-connection chain=postrouting connection-mark=no-mark \
    connection-state=new new-connection-mark=DNS out-interface=ether5 \
    passthrough=no port=53 protocol=udp
add action=mark-connection chain=input connection-state=new in-interface=\
    ether5 new-connection-mark=DNS passthrough=no port=53 protocol=udp
add action=set-priority chain=postrouting connection-mark=DNS new-priority=6
add action=change-dscp chain=postrouting connection-mark=DNS new-dscp=48
add action=mark-packet chain=postrouting connection-mark=DNS new-packet-mark=\
    DNS_U out-interface=ether5 passthrough=no
add action=mark-packet chain=prerouting connection-mark=DNS in-interface=\
    ether5 new-packet-mark=DNS_D passthrough=no
add action=mark-connection chain=postrouting comment=ICMP connection-state=\
    new new-connection-mark=ICMP passthrough=no protocol=icmp
add action=mark-connection chain=prerouting connection-state=new \
    new-connection-mark=ICMP passthrough=no protocol=icmp
add action=change-dscp chain=postrouting connection-mark=ICMP new-dscp=48
add action=set-priority chain=postrouting connection-mark=ICMP new-priority=6
add action=change-dscp chain=output connection-mark=ICMP new-dscp=48
add action=set-priority chain=output connection-mark=ICMP new-priority=6
add action=mark-packet chain=postrouting connection-mark=ICMP \
    new-packet-mark=ICMP_U out-interface=ether5 passthrough=no
add action=mark-packet chain=forward connection-mark=ICMP new-packet-mark=\
    ICMP_U out-interface=ether5 passthrough=no
add action=mark-packet chain=output connection-mark=ICMP new-packet-mark=\
    ICMP_U out-interface=ether5 passthrough=no
add action=mark-packet chain=prerouting connection-mark=ICMP in-interface=\
    ether5 new-packet-mark=ICMP_D passthrough=no
add action=mark-packet chain=forward connection-mark=ICMP in-interface=ether5 \
    new-packet-mark=ICMP_D passthrough=no
add action=mark-packet chain=input connection-mark=ICMP in-interface=ether5 \
    new-packet-mark=ICMP_D passthrough=no
add action=change-dscp chain=postrouting comment=ACK new-dscp=48 packet-size=\
    0-123 protocol=tcp tcp-flags=ack
add action=set-priority chain=postrouting new-priority=6 packet-size=0-123 \
    protocol=tcp tcp-flags=ack
add action=mark-packet chain=postrouting new-packet-mark=ACK_U out-interface=\
    ether5 packet-size=0-123 passthrough=no protocol=tcp tcp-flags=ack
add action=mark-packet chain=forward new-packet-mark=ACK_U out-interface=\
    ether5 packet-size=0-123 passthrough=no protocol=tcp tcp-flags=ack
add action=mark-packet chain=output new-packet-mark=ACK_U out-interface=\
    ether5 packet-size=0-123 passthrough=no protocol=tcp tcp-flags=ack
add action=mark-packet chain=prerouting in-interface=ether5 new-packet-mark=\
    ACK_D packet-size=0-123 passthrough=no protocol=tcp tcp-flags=ack
add action=mark-packet chain=forward in-interface=ether5 new-packet-mark=\
    ACK_D packet-size=0-123 passthrough=no protocol=tcp tcp-flags=ack
add action=mark-packet chain=input in-interface=ether5 new-packet-mark=ACK_D \
    packet-size=0-123 passthrough=no protocol=tcp tcp-flags=ack
add action=mark-connection chain=prerouting comment=HTTP connection-mark=\
    !HTTP_BIG connection-state=new dst-port=80,443,8080,554,8000,81,444,8409 \
    new-connection-mark=HTTP protocol=tcp
add action=mark-connection chain=prerouting connection-mark=!HTTP_BIG \
    connection-state=new dst-port=80,443,8080,554,8000,81,444,8409 \
    new-connection-mark=HTTP protocol=udp
add action=mark-connection chain=prerouting connection-bytes=2000000-0 \
    connection-mark=HTTP new-connection-mark=HTTP_BIG passthrough=no \
    protocol=tcp
add action=mark-connection chain=postrouting connection-bytes=2000000-0 \
    connection-mark=HTTP new-connection-mark=HTTP_BIG passthrough=no \
    protocol=tcp
add action=mark-connection chain=prerouting connection-bytes=2000000-0 \
    connection-mark=HTTP new-connection-mark=HTTP_BIG passthrough=no \
    protocol=udp
add action=mark-connection chain=postrouting connection-bytes=2000000-0 \
    connection-mark=HTTP new-connection-mark=HTTP_BIG passthrough=no \
    protocol=udp
add action=mark-packet chain=postrouting connection-mark=HTTP_BIG \
    new-packet-mark=HTTP_BIG_U out-interface=ether5 passthrough=no
add action=mark-packet chain=forward connection-mark=HTTP_BIG \
    new-packet-mark=HTTP_BIG_U out-interface=ether5 passthrough=no
add action=mark-packet chain=output connection-mark=HTTP_BIG new-packet-mark=\
    HTTP_BIG_U out-interface=ether5 passthrough=no
add action=mark-packet chain=prerouting connection-mark=HTTP_BIG \
    in-interface=ether5 new-packet-mark=HTTP_BIG_D passthrough=no
add action=mark-packet chain=forward connection-mark=HTTP_BIG in-interface=\
    ether5 new-packet-mark=HTTP_BIG_D passthrough=no
add action=mark-packet chain=input connection-mark=HTTP_BIG in-interface=\
    ether5 new-packet-mark=HTTP_BIG_D passthrough=no
add action=mark-packet chain=postrouting connection-mark=HTTP \
    new-packet-mark=HTTP_U out-interface=ether5 passthrough=no
add action=mark-packet chain=forward connection-mark=HTTP new-packet-mark=\
    HTTP_U out-interface=ether5 passthrough=no
add action=mark-packet chain=output connection-mark=HTTP new-packet-mark=\
    HTTP_U out-interface=ether5 passthrough=no
add action=mark-packet chain=prerouting connection-mark=HTTP in-interface=\
    ether5 new-packet-mark=HTTP_D passthrough=no
add action=mark-packet chain=forward connection-mark=HTTP in-interface=ether5 \
    new-packet-mark=HTTP_D passthrough=no
add action=mark-packet chain=input connection-mark=HTTP in-interface=ether5 \
    new-packet-mark=HTTP_D passthrough=no
add action=mark-connection chain=prerouting comment=DUDE connection-state=new \
    dst-port=2210,8291,10008,22,23,222 new-connection-mark=DUDE passthrough=\
    no protocol=tcp
add action=mark-packet chain=postrouting connection-mark=DUDE \
    new-packet-mark=DUDE_U out-interface=ether5 passthrough=no
add action=mark-packet chain=forward connection-mark=DUDE new-packet-mark=\
    DUDE_U out-interface=ether5 passthrough=no
add action=mark-packet chain=output connection-mark=DUDE new-packet-mark=\
    DUDE_U out-interface=ether5 passthrough=no
add action=mark-packet chain=prerouting connection-mark=DUDE in-interface=\
    ether5 new-packet-mark=DUDE_D passthrough=no
add action=mark-packet chain=forward connection-mark=DUDE in-interface=ether5 \
    new-packet-mark=DUDE_D passthrough=no
add action=mark-packet chain=input connection-mark=DUDE in-interface=ether5 \
    new-packet-mark=DUDE_D passthrough=no
add action=mark-connection chain=prerouting comment=RDP connection-state=new \
    dst-port=3389 new-connection-mark=RDP passthrough=no protocol=tcp
add action=mark-packet chain=postrouting connection-mark=RDP new-packet-mark=\
    RDP_U out-interface=ether5 passthrough=no
add action=mark-packet chain=forward connection-mark=RDP new-packet-mark=\
    RDP_U out-interface=ether5 passthrough=no
add action=mark-packet chain=output connection-mark=RDP new-packet-mark=RDP_U \
    out-interface=ether5 passthrough=no
add action=mark-packet chain=prerouting connection-mark=RDP in-interface=\
    ether5 new-packet-mark=RDP_D passthrough=no
add action=mark-packet chain=forward connection-mark=RDP in-interface=ether5 \
    new-packet-mark=RDP_D passthrough=no
add action=mark-packet chain=input connection-mark=RDP in-interface=ether5 \
    new-packet-mark=RDP_D passthrough=no
add action=mark-connection chain=prerouting comment=MAIL connection-state=new \
    dst-port=25,110,143,465,585,993,995 new-connection-mark=MAIL passthrough=\
    no protocol=tcp
add action=mark-packet chain=postrouting connection-mark=MAIL \
    new-packet-mark=MAIL_U out-interface=ether5 passthrough=no
add action=mark-packet chain=forward connection-mark=MAIL new-packet-mark=\
    MAIL_U out-interface=ether5 passthrough=no
add action=mark-packet chain=output connection-mark=MAIL new-packet-mark=\
    MAIL_U out-interface=ether5 passthrough=no
add action=mark-packet chain=prerouting connection-mark=MAIL in-interface=\
    ether5 new-packet-mark=MAIL_D passthrough=no
add action=mark-packet chain=forward connection-mark=MAIL in-interface=ether5 \
    new-packet-mark=MAIL_D passthrough=no
add action=mark-packet chain=input connection-mark=MAIL in-interface=ether5 \
    new-packet-mark=MAIL_D passthrough=no
add action=mark-connection chain=prerouting comment=IPSEC connection-state=\
    new new-connection-mark=IPSEC passthrough=no protocol=ipsec-esp
add action=mark-connection chain=postrouting connection-state=new \
    new-connection-mark=IPSEC passthrough=no protocol=ipsec-esp
add action=mark-connection chain=forward connection-state=new \
    new-connection-mark=IPSEC passthrough=no protocol=ipsec-esp
add action=mark-connection chain=input connection-state=new \
    new-connection-mark=IPSEC passthrough=no protocol=ipsec-esp
add action=mark-connection chain=output connection-state=new \
    new-connection-mark=IPSEC passthrough=no protocol=ipsec-esp
add action=mark-connection chain=prerouting connection-state=new dst-port=\
    500,4500 new-connection-mark=IPSEC passthrough=no protocol=udp
add action=mark-connection chain=postrouting connection-state=new dst-port=\
    500,4500 new-connection-mark=IPSEC passthrough=no protocol=udp
add action=mark-connection chain=forward connection-state=new dst-port=\
    500,4500 new-connection-mark=IPSEC passthrough=no protocol=udp
add action=mark-connection chain=input connection-state=new dst-port=500,4500 \
    new-connection-mark=IPSEC passthrough=no protocol=udp
add action=mark-connection chain=output connection-state=new dst-port=\
    500,4500 new-connection-mark=IPSEC passthrough=no protocol=udp
add action=mark-packet chain=postrouting connection-mark=IPSEC \
    new-packet-mark=IPSEC_U out-interface=ether5 passthrough=no
add action=mark-packet chain=forward connection-mark=IPSEC new-packet-mark=\
    IPSEC_U out-interface=ether5 passthrough=no
add action=mark-packet chain=output connection-mark=IPSEC new-packet-mark=\
    IPSEC_U out-interface=ether5 passthrough=no
add action=mark-packet chain=prerouting connection-mark=IPSEC in-interface=\
    ether5 new-packet-mark=IPSEC_D passthrough=no
add action=mark-packet chain=forward connection-mark=IPSEC in-interface=\
    ether5 new-packet-mark=IPSEC_D passthrough=no
add action=mark-packet chain=input connection-mark=IPSEC in-interface=ether5 \
    new-packet-mark=IPSEC_D passthrough=no
add action=mark-connection chain=prerouting comment=VOIP connection-mark=\
    no-mark connection-rate=0-25k new-connection-mark=VOIP passthrough=no \
    protocol=udp
add action=mark-packet chain=postrouting connection-mark=VOIP \
    new-packet-mark=VOIP_U out-interface=ether5 packet-size=0-260
add action=mark-packet chain=forward connection-mark=VOIP new-packet-mark=\
    VOIP_U out-interface=ether5 packet-size=0-260 passthrough=no
add action=mark-packet chain=output connection-mark=VOIP new-packet-mark=\
    VOIP_U out-interface=ether5 packet-size=0-260 passthrough=no
add action=change-dscp chain=postrouting new-dscp=48 packet-mark=VOIP_U
add action=set-priority chain=postrouting new-priority=6 packet-mark=VOIP_U \
    passthrough=no
add action=mark-packet chain=prerouting connection-mark=VOIP in-interface=\
    ether5 new-packet-mark=VOIP_D packet-size=0-260 passthrough=no
add action=mark-packet chain=forward connection-mark=VOIP in-interface=ether5 \
    new-packet-mark=VOIP_D packet-size=0-260 passthrough=no
add action=mark-packet chain=input connection-mark=VOIP in-interface=ether5 \
    new-packet-mark=VOIP_D packet-size=0-260 passthrough=no
add action=change-dscp chain=postrouting new-dscp=48 packet-mark=VOIP_D
add action=set-priority chain=postrouting new-priority=6 packet-mark=VOIP_D \
    passthrough=no
add action=mark-packet chain=postrouting comment="NO VOIP" connection-mark=\
    VOIP new-packet-mark=OTHER_BIG_U out-interface=ether5 passthrough=no
add action=mark-packet chain=forward connection-mark=VOIP new-packet-mark=\
    OTHER_BIG_U out-interface=ether5 passthrough=no
add action=mark-packet chain=output connection-mark=VOIP new-packet-mark=\
    OTHER_BIG_U out-interface=ether5 passthrough=no
add action=mark-packet chain=prerouting connection-mark=VOIP in-interface=\
    ether5 new-packet-mark=OTHER_BIG_D passthrough=no
add action=mark-packet chain=forward connection-mark=VOIP in-interface=ether5 \
    new-packet-mark=OTHER_BIG_D passthrough=no
add action=mark-packet chain=input connection-mark=VOIP in-interface=ether5 \
    new-packet-mark=OTHER_BIG_D passthrough=no
add action=mark-connection chain=prerouting comment="OTHER TCP" \
    connection-mark=!OTHER_BIG connection-state=new dst-port=\
    !80,443,8080,554,8000,81,444,8409,10008 new-connection-mark=OTHER \
    protocol=tcp
add action=mark-connection chain=prerouting connection-bytes=1000000-0 \
    connection-mark=OTHER dst-port=!80,443,8080,554,8000,81,444,8409,10008 \
    new-connection-mark=OTHER_BIG passthrough=no protocol=tcp
add action=mark-packet chain=postrouting connection-mark=OTHER \
    new-packet-mark=OTHER_U out-interface=ether5 passthrough=no
add action=mark-packet chain=forward connection-mark=OTHER new-packet-mark=\
    OTHER_U out-interface=ether5 passthrough=no
add action=mark-packet chain=output connection-mark=OTHER new-packet-mark=\
    OTHER_U out-interface=ether5 passthrough=no
add action=mark-packet chain=prerouting connection-mark=OTHER in-interface=\
    ether5 new-packet-mark=OTHER_D passthrough=no
add action=mark-packet chain=forward connection-mark=OTHER in-interface=\
    ether5 new-packet-mark=OTHER_D passthrough=no
add action=mark-packet chain=input connection-mark=OTHER in-interface=ether5 \
    new-packet-mark=OTHER_D passthrough=no
add action=mark-packet chain=postrouting connection-mark=OTHER_BIG \
    new-packet-mark=OTHER_BIG_U out-interface=ether5 passthrough=no
add action=mark-packet chain=forward connection-mark=OTHER_BIG \
    new-packet-mark=OTHER_BIG_U out-interface=ether5 passthrough=no
add action=mark-packet chain=output connection-mark=OTHER_BIG \
    new-packet-mark=OTHER_BIG_U out-interface=ether5 passthrough=no
add action=mark-packet chain=prerouting connection-mark=OTHER_BIG \
    in-interface=ether5 new-packet-mark=OTHER_BIG_D passthrough=no
add action=mark-packet chain=forward connection-mark=OTHER_BIG in-interface=\
    ether5 new-packet-mark=OTHER_BIG_D passthrough=no
add action=mark-packet chain=input connection-mark=OTHER_BIG in-interface=\
    ether5 new-packet-mark=OTHER_BIG_D passthrough=no
add action=mark-packet chain=postrouting new-packet-mark=OTHER_BIG_U \
    out-interface=ether5 packet-mark=no-mark passthrough=no
add action=mark-packet chain=forward new-packet-mark=OTHER_BIG_U \
    out-interface=ether5 packet-mark=no-mark passthrough=no
add action=mark-packet chain=output new-packet-mark=OTHER_BIG_U \
    out-interface=ether5 packet-mark=no-mark passthrough=no
add action=mark-packet chain=postrouting new-packet-mark=OTHER_BIG_U \
    out-interface=ether5 passthrough=no
add action=mark-packet chain=prerouting in-interface=ether5 new-packet-mark=\
    OTHER_BIG_D packet-mark=no-mark passthrough=no
add action=mark-packet chain=forward in-interface=ether5 new-packet-mark=\
    OTHER_BIG_D packet-mark=no-mark passthrough=no
add action=mark-packet chain=input in-interface=ether5 new-packet-mark=\
    OTHER_BIG_D packet-mark=no-mark passthrough=no
add action=mark-packet chain=prerouting in-interface=ether5 new-packet-mark=\
    OTHER_BIG_D passthrough=no
add chain=postrouting disabled=yes

manuelm · October 15, 2015, 3:35am

Thank you Chechito!
I’ll check it out tomorrow.

manuelm · October 15, 2015, 4:46am

Could you explain your mangle rules. I’m looking at your VoIP rules and noticed that you are marking everywhere (input, prerouting, forward, posrouting, and output)
I’m fairly new to Mikrotik Queues and Mangling, but I’ve been doing a lot of reading and testing. Some people say to mark at forward on version 6, and create just one set of mangle rules (connection, and packet mark) then specify the interfaces under queue tree.
Please correct me if I’m wrong since I’m new to this. If you mark input or output that will mark the traffic to and from the router, maybe I’m not looking at the big picture here, but what VoIP packets are been send to and from the router?
Is there any advantages on marking everywhere?

chechito · October 15, 2015, 5:52am

im not sure why but in some situations only marking at all chains give me the results i want im only on mikrotik since routeros 6.12

my objective its to be sure of marking all the traffic i want and also be sure of not marking the traffic i dont want without leaks

im sure my mangle rules can be optimized

as soon as I have time available i will do it

take in count i call it voip rules but any traffic whit the parameters defined will match not only voip (online gaming for example, sometimes some snmp traffic)

look at statistics of my mangle
voip mangle.jpg
on voip

almost the same amount of traffic on output chain and in postrouting im not sure why

manuelm · October 15, 2015, 11:18pm

That’s really interesting, I will test it tonight to see how it works.

chechito · October 16, 2015, 4:18am

thx i think i need help to improve it