Multiple packet marks / connections marks

RouterOS General
1

Hi Guys,

I may be going about this the wrong way, but i am trying to work out if a connection can have more than one mark

here is an example of what i want to be able to do:

I want to be able to first split national and international traffic then prioritize certain traffic types, to do this i find that i need to be able to mark traffic as being International and VOIP, smtp etc etc…

Is there anyway to mark a connection more than once?

2

chris021
Here is a link to the wiki for just such a case - there are two examples here and there are a few others for just routing regarding ‘local’ and international traffic…

http://wiki.mikrotik.com/wiki/Bandwidth_Managment_and_Queues


Basically what you are going to do is mark the connections initially with local or international, then send those connections down different chains, where you can further mark/mangle the traffic to your heart’s desire…

R/

3

Thanks i had found that and understand how to seperate out my national and international. is there an example of using multiple chains to further mark traffic that you could point me to?

Thanks!

4

chris021 -
Well I looked at the wiki and I did not see any further examples of using different chains the way you planned to use them - there are some there that do it differently that you can draw from to do your own…perhaps you lack the expertise with ROS to do this so I will show a partial example below… I am getting lazy these days so I won’t be writing out the entire rule set for you but will show how the rules are put together and you can figure out in winbox or the terminal how to put them in correctly… :slight_smile:

IP, firewall mangle (this is where we are starting)

0 chain=prerouting action=mark-connection new-connection-mark=LOCAL_traffic passthrough=yes dst-address-list=LOCAL in-interface=LAN

1 chain=prerouting action=mark-connection new-connection-mark=INTL_traffic passthrough=yes dst-address-list=INTL in-interface=LAN

Now - we have marked our ‘Local’ traffic and our ‘International’ traffic with appropriate connection marks in rules 0 & 1… We also further defined what connections we were going to mark with these rules - the connection must come in the LAN interface (as opposed to a WAN or Internet interface) .

2 chain=prerouting action=jump jump-target=LOCAL connection-mark=LOCAL_traffic

3 chain=prerouting action=jump jump-target=INTL connection-mark=INTL_traffic

In rules 3 & 4 we have told ROS to jump to a new chain IF the connection marks match. If the connections marks don’t match then the packet/connection will continue through the rules to what ever is next. We are going to assume here that the connection matches LOCAL as such are now jumping to chain ‘LOCAL’.

A chain=LOCAL action=mark-connection new-connection-mark=http_local passthrough=yes src-port=1024-65535 dst-port=80 protocol=tcp

B chain=LOCAL action=mark-packet new-packet-mark=http_local passthrough=no

I marked the rules with a letter purely so as not to confuse you as to where they may show up at but you needed to see the order in which they get excuted in…

Ok - as you can see we are now in chain=LOCAL, so we know that the connection came in on the LAN port, it’s destination IP address is in your ‘local’ country area IP range - this is all in rule ‘0’, we have now further defined that (in this case) that we are looking for connections to port 80 (http), we defined that the source port is 1024 - 65535 (as would normally be for a client to connect to a web server), that the protocol used for this connection is TCP also normal for an http connection - rule ‘A’, then we marked the packets traversing this chain with an appropriate packet mark to be used later in queuing - rule ‘B’. We let rule ‘A’ passthrough (passthrough=yes) so that the packet in this connection could be marked as well. In rule ‘B’ we said no to passthrough - as there is no further processing needed for this connection or packet.

At this point the chain is now ‘ended’ for this connection and packet. Further processing will now happen after rule 2 - why because that is where we ‘jumped’ from rule 2 to rule ‘A’. As in there is a rule 3, then this is where this chain will return to and continue processing Mangle rules. Now - if you do your rules correctly this connection / packet should not match any further rules in mangle.

So while the connection does not actually have ‘multiple’ connection or packet marks we were able to take a connection, ascertain where it came from, what’s it’s destination IP was, what protocol, and what the source/destination port was and mark it accordingly. In this example we were looking at http - destination port 80, a src-port of 1024 - 65535, with the destination IP being in the local country and the source interface for the request (made by a client) was our local LAN.

This example should give you sufficient information to build your own ‘tree’ of mangle chains and rules. With the outcome being that you can ‘filter’ connections to the point that it meets your every criteria so that ONLY the connections your specifiy will have the marks that you desire.

R/

5

Thanks!

That has sure given me an idea how to tackle things moving forward.

Once i have it up and running i will write a wiki article on how to do it.

Thanks for your time.

6

Hi Guys,

I know I am posting on a loooong gone thread, but this seems to have the answer that I am looking for.

I would just like to confirm

I want to do two things.

  1. Mark packets and allow them to split bandwidth between X amount of connected clients equally. 10Mbit line, 5 active clients, each gets allocated 2Mbit
  2. After that I would like to apply qos based on priority. Ensign services SSL, email etc / Gaming / Streaming / Downloads / P2P

Can mikrotik do both at the same time?



7

Decsus -
For part ‘one’ of your plan, take a look at how PCQ queues work in the manual/wiki. Essentially if you set a maximum bandwidth to a pcq queue then all connections through that queue will get equal portions of the available bandwidth, i.e. if you set the max at 15mbps and there are only 3 clients connected at that moment in time then each will get 5mbps (if they are trying to get data). Later let’s say you now have 5 clients using the connection, well they would get 3mbps each.

Or you could do it similarly as to how I described how to mark connections and packets above in my earlier post but instead of Local and Intl IPs you would mark by your client IP addresses and then break their traffic down in to http, ftp, SSL, etc and prioritize there.

Be sure to review packet flow in the ROS version you are using as packet flow has changed some over the years and versions.

Thom

8

Thanks a lot for the feedback.

I have been using PCQ as you described with great success, it really helps thanks.

I found the jump action you described very interesting so I will be looking more into that.

But it does seem like one or the other.

Currently I do QOS based on port numbers thus → Mark connection → mark packets based on ports ie (Ensign / Games / Downloads) and prioritize with queues.

But I reckon one does not really need both at the same time. PCQ on it’s own should do the trick.

Regards