How To Limit P2P Using Simple Queue And Layer 7 ?

RouterOS General
1

Hey guys , I’m a beginner in Mikrotik …
I use RouterOS v5.26
I’m using rules in mangle to mark packets from Layer 7 where I put about 20 extensions like .avi .rar . iso … to be limited in download , while browsing is in full speed for any client .
It works fine and any simple queue I create for any specific IP , It can browse with full speed and download - the extensions I specified in Layer 7 - with the speed in the queue …
Now the problem is P2P
I CAN’T MANAGE IT"S SPEED :frowning:
Is there any way to create a simple queue for P2P where I can manage the speed of it ?
I tried this code

/ip firewall layer7-protocol
add name=p2p_www regexp="^.*(get|GET).+(torrent|thepiratebay|isohunt|entertane\
    |demonoid|btjunkie|mininova|flixflux|vertor|h33t|zoozle|bitnova|bitsoup|me\
    ganova|fulldls|btbot|fenopy|gpirate|commonbits).*\$"
add name=p2p_dns regexp="^.+(torrent|thepiratebay|isohunt|entertane|demonoid|b\
    tjunkie|mininova|flixflux|vertor|h33t|zoozle|bitnova|bitsoup|meganova|full\
    dls|btbot|fenopy|gpirate|commonbits).*\$"

/ip firewall mangle
add action=mark-packet chain=postrouting comment="p2p download" disabled=no \
    layer7-protocol=p2p_www new-packet-mark="p2p download" passthrough=no
add action=mark-packet chain=postrouting disabled=no layer7-protocol=p2p_dns \
    new-packet-mark="p2p download" passthrough=no

/queue simple
add burst-limit=0/0 burst-threshold=0/0 burst-time=0s/0s direction=both \
    disabled=no interface=all limit-at=0/0 max-limit=1k/1k name=\
    "p2p download" packet-marks="p2p download" parent=none priority=8 queue=\
    default-small/default-small target-addresses="" total-queue=default-small

It works fine , The issue was that when any hotspot user login and Hotspot/Radius creates Dynamic Queues, and it override simple queue by moving itself above the static queue !!
how to prevent this automatic creating of simple queues ?
and the code I posted , will it block any P2P traffic ?
Thanks in advance for your help …

2

No, the code will not block any P2P, but it will block those that it can match. You will not be able to match and block the encrypted streams. As far as the dynamic hotspot queues, you are going to have to go into the user profiles and change the settings in there. That will allow you to get that traffic into your static queues.

3

Hmmm If I understand your query correctly, then let me give you an workaround. I used it at few networks and it worked like a charm. Maybe someone else have better solution.

The workaround for this issue is to create a script that moves this static queue name “p2p download” to 0 (top number) whenever any HS user login. The scripts can be added in HOTSPOT > USERS PROFILES > SCRIPTS. This way whenever any hotspot user login, this script will run, and it will move the p2p download to 0 number (Top)

Add a script that will do actually move thep2p download queue to top.


/system script
add name=movestatic0 policy=\
ftp,reboot,read,write,policy,test,winbox,password,sniff,sensitive,api \
source="/queue simple move [find name=\"p2p download\"] 0"

↓

Now we have to add this script in the HOTSPOT user profiles (in this example I have only one default profile, if you have multiple user profiles, you have to add this in all profiles either via CLI, or preferably via GUI )

/ip hotspot user profile
set [ find default=yes ] idle-timeout=none keepalive-timeout=2m name=default \
on-login="/system script run movestatic0" shared-users=1 \
status-autorefresh=1m transparent-proxy=no

↓
Now whenever any hotspot user will login , the hotspot profile will execute the script “p2p download]″ that we created earlier, and it will move the p2p download queue to TOP.

Some examples are given here…
http://aacable.wordpress.com/2013/11/25/mikrotik-hotspot-workaround-for-dynamic-queue-always-remain-above-static-queue/

4

Thank you for posting that :smiley:

5

not worked
i need way to block download OR limit download and upload speed