Hi,
thanks for taking the time to answer.
I’m using the rules below, they were posted somewhere in this forum and they are just adopted for my needs.
The RB951 is being used as a router and AP, it is going to serve small hotels, apartments, studios and coffee shops. It is expected to host a maximum load of 40-50 wireless devices. The basic need is to prohibit bad users to abuse the connection.
Any comments-ideas are very welcome.
# jul/05/2014 11:36:49 by RouterOS 6.15
# 951
#
/ip firewall mangle
add action=mark-packet chain=prerouting comment=VPN in-interface=\
ether1-gateway new-packet-mark=QoS_2_In passthrough=no protocol=gre
add action=mark-packet chain=postrouting new-packet-mark=QoS_2_Out \
out-interface=ether1-gateway passthrough=no protocol=gre
add action=mark-packet chain=prerouting in-interface=ether1-gateway \
new-packet-mark=QoS_8_In p2p=all-p2p passthrough=no
add action=mark-packet chain=postrouting new-packet-mark=QoS_8_Out \
out-interface=ether1-gateway p2p=all-p2p passthrough=no
add action=mark-packet chain=prerouting comment=\
"------------QoS_1 [Steam]------------" in-interface=ether1-gateway \
new-packet-mark=QoS_1_In passthrough=no protocol=tcp src-port=27014-27050
add action=mark-packet chain=postrouting dst-port=27014-27050 \
new-packet-mark=QoS_1_Out out-interface=ether1-gateway passthrough=no \
protocol=tcp
add action=mark-packet chain=prerouting in-interface=ether1-gateway \
new-packet-mark=QoS_1_In passthrough=no protocol=udp src-port=\
3478,4379,4380,28960,27000-27030
add action=mark-packet chain=postrouting dst-port=\
3478,4379,4380,28960,27000-27030 new-packet-mark=QoS_1_Out out-interface=\
ether1-gateway passthrough=no protocol=udp
add action=mark-packet chain=prerouting comment=\
"------------QoS_2 [DNS+NTP_PPTP_Services]------------" in-interface=\
ether1-gateway new-packet-mark=QoS_2_In passthrough=no protocol=udp \
src-port=53,123,1723
add action=mark-packet chain=postrouting dst-port=53,123,1723 \
new-packet-mark=QoS_2_Out out-interface=ether1-gateway passthrough=no \
protocol=udp
add action=mark-packet chain=prerouting connection-state=new in-interface=\
ether1-gateway new-packet-mark=QoS_2_In passthrough=no protocol=tcp \
src-port=52,123,1723
add action=mark-packet chain=postrouting dst-port=52,123,1723 \
new-packet-mark=QoS_2_Out out-interface=ether1-gateway passthrough=no \
protocol=tcp
add action=mark-packet chain=prerouting comment=\
"------------QoS_3 [WWW_Services]------------" connection-bytes=0-1500000 \
in-interface=ether1-gateway new-packet-mark=QoS_3_In passthrough=no \
protocol=tcp src-port=80,443
add action=mark-packet chain=postrouting connection-bytes=0-1500000 dst-port=\
80,443 new-packet-mark=QoS_3_Out out-interface=ether1-gateway \
passthrough=no protocol=tcp
add action=mark-packet chain=prerouting comment=\
"------------QoS_3 [General_Services]------------" in-interface=\
ether1-gateway new-packet-mark=QoS_3_In passthrough=no protocol=tcp \
src-port=20,21,22,23,25,110,143,465,587,993,995,2525,3535
add action=mark-packet chain=postrouting dst-port=\
20,21,22,23,25,110,143,465,587,993,995,2525,3535 new-packet-mark=\
QoS_3_Out out-interface=ether1-gateway passthrough=no protocol=tcp
add action=mark-packet chain=prerouting comment=\
"------------QoS_5 [WWW_Services_Heavy]------------" connection-bytes=\
1500000-0 in-interface=ether1-gateway new-packet-mark=QoS_5_In \
passthrough=no protocol=tcp src-port=80,443
add action=mark-packet chain=postrouting connection-bytes=1500000-0 dst-port=\
80,443 new-packet-mark=QoS_5_Out out-interface=ether1-gateway \
passthrough=no protocol=tcp
add action=mark-packet chain=prerouting comment=\
"------------QoS_8 [Other_Services]------------" in-interface=\
ether1-gateway new-packet-mark=QoS_8_In passthrough=no protocol=tcp
add action=mark-packet chain=postrouting new-packet-mark=QoS_8_Out \
out-interface=ether1-gateway passthrough=no protocol=tcp
add action=mark-packet chain=prerouting in-interface=ether1-gateway \
new-packet-mark=QoS_8_In passthrough=no protocol=udp
add action=mark-packet chain=postrouting new-packet-mark=QoS_8_Out \
out-interface=ether1-gateway passthrough=no protocol=udp
add action=mark-packet chain=prerouting in-interface=ether1-gateway \
new-packet-mark=QoS_8_In passthrough=no
add action=mark-packet chain=postrouting new-packet-mark=QoS_8_Out \
out-interface=ether1-gateway passthrough=no
# jul/05/2014 11:38:10 by RouterOS 6.15
# 951
#
/queue tree
add max-limit=900k name=QoS_Global_Upload parent=global queue=default
add burst-limit=850k burst-time=5s limit-at=600k max-limit=800k name="QoS_1_Out(Steam)" packet-mark=QoS_1_Out parent=QoS_Global_Upload priority=1 queue=\
default
add limit-at=700k max-limit=800k name="QoS_2_Out(DNS+NTP+PPTP)" packet-mark=QoS_2_Out parent=QoS_Global_Upload priority=2 queue=default
add limit-at=900k max-limit=950k name="QoS_3_Out(WWW)" packet-mark=QoS_3_Out parent=QoS_Global_Upload priority=3 queue=default
add burst-limit=900k burst-time=3s max-limit=800k name="QoS_4_Out(Streaming)" packet-mark=QoS_4_Out parent=QoS_Global_Upload priority=4 queue=default
add burst-limit=950k burst-time=3s max-limit=900k name="QoS_5_Out(WWW_Heavy)" packet-mark=QoS_5_Out parent=QoS_Global_Upload priority=5 queue=default
add burst-limit=700k burst-time=3s max-limit=600k name="QoS_8_Out(Default)" packet-mark=QoS_8_Out parent=QoS_Global_Upload queue=pcq-upload-default
add max-limit=17M name=QoS_Global_Download parent=global queue=default
add limit-at=1500k max-limit=9M name="QoS_1_In(Steam)" packet-mark=QoS_1_In parent=QoS_Global_Download priority=1 queue=default
add limit-at=300k max-limit=1500k name="QoS_2_In(DNS+NTP+PPTP)" packet-mark=QoS_2_In parent=QoS_Global_Download priority=2 queue=default
add burst-limit=9M burst-threshold=6M burst-time=5s limit-at=4500k max-limit=6M name="QoS_3_In(WWW)" packet-mark=QoS_3_In parent=QoS_Global_Download \
priority=3 queue=default
add burst-limit=7500k burst-threshold=3M burst-time=5s max-limit=3M name="QoS_4_In(Streaming)" packet-mark=QoS_4_In parent=QoS_Global_Download priority=4 \
queue=default
add burst-limit=11M burst-time=2s max-limit=3M name="QoS_5_In(WWW_Heavy)" packet-mark=QoS_5_In parent=QoS_Global_Download priority=5 queue=default
add burst-limit=13M burst-threshold=4M burst-time=3s max-limit=9M name="QoS_8_In(Default+Torrent)" packet-mark=QoS_8_In parent=QoS_Global_Download queue=\
pcq-download-default
As you can see I’m mangling on ether1-gateway, although I only wanted wlan1, but it wasn’t catching anything there.