Problem with shaping through pptp

RouterOS General
1

I am using pptp-server on RouterOS. If it works with encryption then all traffic that shapes with queue-tree and packet mark shapes correctly: if I set max-limit 1Mbps, I get 1Mbps. If it works with no encryption then if I set max-limit 1Mbps, I get 512Kbps. But queue shows me that it consumes 1Mbps. This happens when parent queue attached to global-out. If it attached to pptp interface, traffic shapes correctly. With pptp-encryption it’s no difference to what interface attached parent queue. In case of pppoe it’s no difference between using enryption or not and no matter to what interface attached parent queue.
I tried it with different routerboards (RB433, RB433AH, RB1000) and different versions of RouterOS (3.x till 5.0rc3).

What differences between encrypted or not enrcypted pptp from the shaper point of view?
Thank you.

2

Guys from the staff, is it a bug? Please, give comments for this matter.

3

Anybody? It’s realy big problem for me now! Please, help.
Thank you.

4

I would send an email to support@mikrotik.com.

5

It’s interesting that traffic is exactly half. Can you show your mangle rules?

6 
/ip firewall mangle add chain=forward src-address-list=shape_list action=mark-packet new-packet-mark=upload passthrough=no
/ip firewall mangle add chain=forward dst-address-list=shape_list action=mark-packet new-packet-mark=download passthrough=no

Also, using pppoe and the same rules and queues shaping works perfect with or without encryption.
Thank you, guys, for replying :slight_smile:

7

Does it make a difference if you mangle in prerouting chain?

8

No, it doesn’t. Nor postrouting chain too.

9

Looks like the only chance to get answer on this question is to send mail to support. I’ll write about it.

10

Hi guys, MT 433AH, ROS 4.11, exactly the same problem, w/o encryption in pptp tunnel queue tree shape traffic to exactly a half of setup, for example - 5M queue show that its full with real 2.5mbit/s traffic, so its a bug i think. I’ve try mangle by src/dst IP and by in/out iface (pptp tunel iface in this case), results are the same. So WTF?