Is there a way that I can limit the broadband or traffic of a vlan that is inside a bridge without it having to be by IP?
I’m not sure if I understand your question right … but anyway: VLANs are below IP and switch (or bridge part of MT router which acts as a switch) can forward frames between different ports (depending on configuration of course) without having IP address in that VLAN.
To push bridged VLAN-tagged frames through the queues, you have to make sure that they pass through the CPU by setting hw=no in the respective rows of /interface bridge port, and you have to force them through the IP firewall using /interface bridge settings set use-ip-firewall=yes use-ip-firewall-for-vlan=yes. Then, you have to use /interface bridge filter rules to add the packet marks to be used to match the right the queue in the queue tree, as in the example below where VLAN 1234 is forwarded between ether1 and ether2 and you want to use different bandwidth limits (so a different queue) for each direction:
/interface bridge filter
add action=mark-packet chain=forward mac-protocol=vlan new-packet-mark=vlan1234-dl vlan-id=1234 in-interface=ether1
add action=mark-packet chain=forward mac-protocol=vlan new-packet-mark=vlan1234-ul vlan-id=1234 in-interface=ether2
If you want to do it in the switch (without passing through the CPU) then it depends on the Mikrotik device model (the switch chip built in)
https://wiki.mikrotik.com/wiki/Manual:Switch_Chip_Features
I did not understand their explanations well, I explain what I try to do to make it more understandable.
I have several nodes where I deliver service by old technology of telephone pair through DSLAM and the ports of this equipment are worked by VLAN together with the mikrotik of this town.
Many times I must leave the Mikrotik working as a SW since there is a main node router that is in charge of carrying out all the routing and delivery of public or private IPs.
I could well limit these IPs on the main router but I would not want to generate more load for this equipment, therefore I want to make speed limits within the local mikrotik.
PS: excuse me for not answering before, thank you very much for your help.
Now it’s me who doesn’t understand.
In the OP you’ve asked specifically how to classify the traffic for queueing based on VLAN ID rather than on IP address, so I’ve expected that you know the rest of the configuration necessary to implement traffic limits using queues, and I’ve only explained what is necessary to use VLAN ID as classifier. Now you wrote that you did not understand “their” explanations - did you mean those on Mikrotik manual pages, or the posts by forum users here?
What you wrote now just adds some lyrics regarding your network topology and motivation to use Mikrotik in particular as traffic shaper, but you didn’t explain what other information from us you still lack to be able to implement it.
To comment on your network-level intention - from the point of view of network design, it makes most sense to limit the traffic at the ingress edge of the network, i.e. to limit the traffic from the customers at the routers/switches which are closest to them, and to limit the traffic towards the customers at the central router where you receive that traffic from your upstream ISP. This way, the load on your interconnect links will be minimized, because you’ll limit also traffic which doesn’t adapt to bandwidth restrictions, so throttling it as late as at egress would not cause the source to slow down.
So an additional Mikrotik next to the central router would better fit the purpose of limiting the customer download without adding additional load to the central router than the Mikrotiks at the peripheral sites.
God I get excited when you tease out requirements from challenging OPs… ![]()
(Did I just call you the G word… well in MT terms probably pretty damn close LOL)