Prerouting Connections cannot be shaped

RouterOS General
1

I’ve marked connections using chain prerouting. But these connections cannot be shaped using simple rules.Why so?

Example:
/ ip firewall mangle
add chain=prerouting src.addrss-list=512k action=mark-connection new-connection-mark=512k_conn passthrough=yes
add chain=prerouting connection-mark=512k_conn action=mark-packet new-packet-mark=512k_p passthrough=no

/ queue simple
add name=“512k” packet-marks=512k_p max-limit=128000/512000 priority=8

It’s not limiting the connections.It’s unlimited.

2

Do you have another mangle related to list=512k on another chain? I just tried your code and it work perfect. Or could you attach the output of
/ip fi ma export

so we could have better overview of your system

3

No other rule for 512k list. But i’m using web proxy and caching.

4

Does mangle counters increase?
Try to use ‘Queue Tree’ instead of ‘Simple Queues’.
http://wiki.mikrotik.com/wiki/Queue_with_Masquerading_and_Internal_Web-Proxy

HTH,

5

  1. Just make another packet-mark on chain output and name it “packet-from-proxy” with dst-address-list=512k

  2. make another simple queue entry with packet mark= packet-from-proxy

  3. let me know if that work

6

Mangle increases.

Output chain is working fine with dst-address-list only for download traffic. But i wanted to do like what it says here
http://wiki.mikrotik.com/wiki/TransparentTrafficShaper
Looks very simple. I did not bridge thou.

7

In my basic understanding of simple queue.

  1. you could make a traffic shaping based on target address
  2. you could also use the packet mark


    Next take a look on your traffic. With an assumption you have transparent proxy for http traffic (destination port 80). I will simplify the packet stream into 4 stream in 2 connection
a) ------------->              c) ------------->
CLIENT            RouterOS                     WEB-SERVER
b) <------------               d) <------------

  1. connection I. between client and ROS
    a) request came from client an redirect by ROS
    b) ROS as a proxy response the request to client

  2. connection II. between ROS and WEB-Server
    c) Proxy request
    d) web-server response

Let see what you have done.

  1. connection marking for connection I

  2. packet marking for packet stream a) “512_p”

  3. shaping with simple queue parameter = packet mark = “512_p”

My Question, on packet stream b), do you have marked packet flow in those direction?
I Guess, you will have no-mark packet in this direction (b). That’s the reason you could not do traffic shaping in single flow packet mark. On the download direction you will also need to mark the packet.

Let’s make it simple, you have already marked the upload packet stream with 512_p. Just make as i posted the same packet mark in output chain, but rename instead “packet-from-proxy” to “512_p”. And disable the simple queue entry with packet mark “packet-from-proxy”.

Correct me, if i am wrong please.

8

Output chain is working fine with dst-address-list only for download traffic. But i wanted to do like what it says here
http://wiki.mikrotik.com/wiki/TransparentTrafficShaper
Looks very simple. I did not bridge thou.

Your scenario and on wiki scenario have following differences

  1. on WIKI, it is single connection with two way data stream a) and b). Since both data steam came from outside of RouterOS you could mark the packet on prerouting chain
  a) -------------------------------------------->
CLIENT                RouterOS              WEB-SERVER
  b) <-------------------------------------------
  1. on your scenario look on my post, the a) data stream came from client, that is fine to mark the packet on pre-routing. but the b) data stream came from RouterOS. in this case you could not mark the packet based on connection as shown on the wiki. The packet came from RouterOS will never passing through the chain prerouting.

For detail let see the http://wiki.mikrotik.com/wiki/Manual:Packet_Flow


Correct me, if i am wrong please

9

Thanks. I understood. One more question. I’ve given two IPs for a client for his two PCs. But he pays for one. He wants to brows from both the pcs. Now can i restrict him to brows only from one pc at a time? No simultaneous connection from both the pcs. is it possible?

10

I have not tried it before, it will be complicated. but it could be done with some tricks.

  1. you have to group the ip address of the same user in subnet. It could be done with dhcp static ip

2a) create pcc type of queue name it download and set the classify base on dst-address aslo the src-address mask name it download
2b) create second pcc for upload with dst-address and dst-address-mask

  1. set on your simple queue to use this queue type

With this trick you will classify both ip on the same queue

For detail you could learn about PCC on mikrotik wiki

11

it seems beyond my exprties, but i’ll give it a try. thanks a lot.

12

anytime