My set of Feature Requests

Alright, i believe some of those requests, need more explanation. i apologize for any confusions that it might have caused. ill try to explain more:



what i mean, is to be able to create dynamic rules instead of static ones. so we could avoid unnecessary writes to the NAND disk. cause from what i understand, dynamic rules are created in memory, unlike static rules that are being written on disk. i have some scripts that check the users usage and add them to different address lists, so different shaping could apply to them. i would really like to be able to create dynamic entries in address list, so i don’t have to worry about adding and deleting hundreds of entries everyday from the NAND disk. and i’m pretty sure adding that ability to other places, also would become handy. i might need to create a new script to add different routing tables. and i would really love if i could create them as dynamics for the same reason.
and as otgooneo pointed out, ability to edit dynamic rules would be useful as well.
Also, on a side note, i would like to thank ‘mojiro’ to find a clever workaround to achieve adding dynamic address lists: http://forum.mikrotik.com/t/how-to-manually-create-dynamic-rules-address-list-entries/50480/1


It IS practical imo. hotspot marks all the packets that are going to and coming from interface. thats why ‘auth , from-client, to-client’ already exist as hotspot parameters in rules. they just need to add the usernames as well to the marked packets. but as normis,otgooneo here and Sergejs in email support pointed out, it could already be done by using “on login” and “on logout” scripts. if we could also add dynamic rules(for the reason that i mentioned above), this would be no issue any more.

when you are working with a lot of windows at the same time, it easily happens. and its not like adding that ability, could harm anyone. if you don’t like it, you could simply don’t use it.

Also Sergejs didn’t like this request so much. he rejected it on sight! . the main point of ROS is routing ofc. but one could argue why they’ve added SMB function then. not that i’m complaining, just saying it would be cool to have ftps as well. about the ROS cpu usage going up on write to disks, i really don’t have enough experience on that matter to comment. but if its the case, even SMB would become pretty useless.

there is a reason that its the last requested feature :wink: but it would be still handy.

it appears that you’ve misunderstood me there. hotspot counts every single packet that is being transferred between the user and the interface the hotspot server is running. when you specify limit-bytes-in and/or limit-bytes-out and/or limit-bytes-total or even when you are getting those traffic statics via radius, there are lots of times that you want to exclude some ips (like internal ones for example), to be counted for users. its not only MY request, it appears that quite a lot of people are looking for the same feature. these are just a few of them:

http://forum.mikrotik.com/t/how-to-bypass-hotspot-usage-counters-for-specific-subnets/49945/1
http://forum.mikrotik.com/t/hotspot-fetures-or-limitations/45613/1
http://forum.mikrotik.com/t/exclude-traffic-accounting-for-a-specific-ip/35291/1
http://forum.mikrotik.com/t/exclude-ip-address-from-accounting/48302/1
http://forum.mikrotik.com/t/hotspot-exclude-sites-from-radius-accounting/51029/1

there are more. just search the forum for yourself.

I also have one more feature request:

Add the option to invert ( ! ) limit and dst-limit . from what i understand, this is supported in linux iptables: http://www.zoominternet.net/~lazydog/iptables-tutorial.html#LIMITMATCH
quite frankly, most of the times, you need to use those ( specially dst-limit ), to lessen DOS effects. so you need to do some filtering when the packets BREAK the limit. i had to actually create 3 different firewall filter rules to reproduce the invert flag effect ( one rule to jump to a custom chain which itself includes 2 rules: first one with dst-limit specified and set the action to return. and the second one to drop the packets that passed the first one).
when it comes to DOS, every unnecessary rule counts. these 3 rules, could have been simply replaced by only one, if inverted flag was supported in dst-limit