Hi everyone, I need help figuring out how to configure a QOS according to my logic in an AC3 LTE to which I'm connected via LTE, obtaining a speed of about 20 Mbps download and 13 Mbps upload.
The requirement is this: I would like to give maximum priority to a specific device (Xiaomi TV Box) for video streaming, all the remaining bandwidth is reserved for the rest of the LAN. This LAN is very simple, a couple of smartphones, two Windows laptops, a tablet and the TV box.
So I completely disabled Fasttrack and created two Cake Types for Download and Upload, subsequently I marked the packets in Firewall Mangle towards the TV Box and created two parent queues for Download and Upload in Queue Tree and then two child rules, one for the TV Box and one for the rest of the traffic. Everything seems to be working fine, but I don't think I need to set the autorate ingress option to upload, as I suddenly have a 0.9 Mbps upload at various times of the day, and if I completely disable these rules, it goes back to normal speeds. Since it's my parents' house, I'm not physically there all year round, so I can't adjust the download and upload bandwidth from time to time, which is why I initially appreciated the autorate ingress option.
Reading online, I read that it's not necessary to prioritize a specific device, but simply create two master rules for Download and Upload and route all incoming and outgoing LAN traffic to them. Cake will automatically prioritize Streaming and VoIP. Is this correct? I'm very confused about this. I've attached my configuration, and thanks in advance to anyone who can help.
# 2026-07-21 13:39:18 by RouterOS 7.21.5
# software id = XXXXXXXX
#
# model = RBD53GR-5HacD2HnD
# serial number = XXXXX
/interface bridge
add admin-mac=xxxxxxx auto-mac=no comment=defconf igmp-snooping=yes \
name=bridge port-cost-mode=short
/interface wireguard
add listen-port=13231 mtu=1420 name=WG-IN
/interface list
add comment=defconf name=WAN
add comment=defconf name=LAN
/interface lte apn
set [ find default=yes ] apn=internet.it ip-type=ipv4 name=Wind-Tre \
use-network-apn=no
add apn=mobile.vodafone.it ip-type=ipv4 name="Vodafone IT" use-peer-dns=no
add apn=web.ho-mobile.it name=Ho-Mobile use-peer-dns=no
add apn=web.kenamobile.it name=Kena-Mobile use-peer-dns=no
/interface lte
set [ find default-name=lte1 ] allow-roaming=yes apn-profiles=Kena-Mobile \
band=3,20 comment=WAN network-mode=lte
/interface wifi security
add authentication-types=wpa2-psk connect-priority=0/1 disabled=no \
group-key-update=5m name=Default wps=push-button
add authentication-types=wpa3-psk disabled=no group-key-update=1h name=\
Sec_for_5Ghz_Bridge wps=disable
/interface wifi steering
add disabled=no name=Default neighbor-group=dynamic-Wifi_oPesc-afd2577d rrm=\
yes wnm=yes
/interface wifi
# changed intended channel to 2437/n/Ce
set [ find default-name=wifi1 ] channel.band=2ghz-n .frequency=2412,2437,2462 \
.reselect-interval=30m..1h .width=20/40mhz comment="Wlan 2.4 Ghz" \
configuration.antenna-gain=3 .country="United States" .mode=ap .ssid=\
XXXXX .tx-power=20 disabled=no mtu=1500 name=wlan1 security=Default \
security.ft=yes .ft-over-ds=yes steering=Default
set [ find default-name=wifi2 ] channel.band=5ghz-ac .frequency=5700-5805 \
.width=20/40/80mhz comment="Wlan 5 Ghz" configuration.antenna-gain=6 \
.country="United States" .hide-ssid=yes .mode=ap .multicast-enhance=\
enabled .ssid=XXXXX .tx-power=23 disabled=no mtu=1500 name=wlan2 \
security=Sec_for_5Ghz_Bridge security.ft=yes .ft-over-ds=yes steering=\
Default
/ip pool
add name=dhcp ranges=192.168.51.10-192.168.51.254
/ip dhcp-server
add address-pool=dhcp interface=bridge name=defconf
/ip smb users
set [ find default=yes ] disabled=yes
/queue type
add cake-autorate-ingress=yes cake-diffserv=besteffort cake-nat=yes \
cake-rtt-scheme=internet kind=cake name=Cake_Download
add cake-autorate-ingress=yes cake-diffserv=besteffort cake-nat=yes \
cake-rtt-scheme=internet kind=cake name=Cake_Upload
/queue tree
add name=Total_Download parent=bridge queue=Cake_Download
add name=Total_Upload parent=lte1 queue=Cake_Upload
add name=TrafficDW_Priority-1 packet-mark=Traffic-DW_Priority1 parent=\
Total_Download priority=1 queue=Cake_Download
add name=TrafficDW_Priority-8 packet-mark=Traffic-DW_Priority8 parent=\
Total_Download queue=Cake_Download
add name=TrafficUP_Priority-1 packet-mark=Traffic-UP_Priority1 parent=\
Total_Upload priority=1 queue=Cake_Upload
add name=TrafficUP_Priority-8 packet-mark=Traffic-UP_Priority8 parent=\
Total_Upload queue=Cake_Upload
/interface bridge port
add bridge=bridge comment=defconf ingress-filtering=no interface=ether1 \
internal-path-cost=10 path-cost=10
add bridge=bridge comment=defconf ingress-filtering=no interface=ether2 \
internal-path-cost=10 path-cost=10
add bridge=bridge comment=defconf ingress-filtering=no interface=ether3 \
internal-path-cost=10 path-cost=10
add bridge=bridge comment=defconf ingress-filtering=no interface=ether4 \
internal-path-cost=10 path-cost=10
add bridge=bridge comment=defconf ingress-filtering=no interface=ether5 \
internal-path-cost=10 path-cost=10
add bridge=bridge interface=wlan1
add bridge=bridge interface=wlan2
/ip firewall connection tracking
set udp-timeout=10s
/ip neighbor discovery-settings
set discover-interface-list=LAN
/interface list member
add comment=defconf interface=bridge list=LAN
add comment=defconf interface=lte1 list=WAN
add interface=WG-Valerio list=LAN
/interface wireguard peers
add allowed-address=10.10.10.20/30 comment=\
"[XXXXXXX]" endpoint-address=\
XXXXXX endpoint-port=13233 interface=WG-IN name=\
"VPN - XXXX" persistent-keepalive=20s public-key=\
"XXXXXXXXXXX"
/ip address
add address=192.168.51.1/24 comment=defconf interface=bridge network=\
192.168.51.0
add address=10.10.10.22/30 comment="WG-IN [10.10.10.21 - 10.10.10.23]" \
interface=WG-IN network=10.10.10.20
/ip dhcp-server lease
add address=192.168.51.3 client-id=XXXXXXX comment=Tablet-Huawei \
mac-address=XXXXXX server=defconf
add address=192.168.51.2 client-id=XXXXX comment=HAP_AC2_Repeater \
mac-address=XXXX server=defconf
add address=192.168.51.4 client-id=XXXXX mac-address=\
XXXXXXXXX server=defconf
/ip dhcp-server network
add address=192.168.51.0/24 comment=defconf dns-server=192.168.51.1 gateway=\
192.168.51.1
/ip dns
set allow-remote-requests=yes cache-size=32768KiB servers=1.1.1.1,1.0.0.1
/ip dns adlist
add file=sblack-unified-adlist
/ip dns static
add address=192.168.51.1 comment=defconf name=router.lan type=A
/ip firewall filter
add action=accept chain=input comment=\
"defconf: accept established,related,untracked" connection-state=\
established,related,untracked
add action=accept chain=input comment="Allow VPN [Wireguard]" dst-port=13231 \
in-interface=lte1 protocol=udp
add action=drop chain=input comment="defconf: drop invalid" connection-state=\
invalid
add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp
add action=accept chain=input comment=\
"defconf: accept to local loopback (for CAPsMAN)" dst-address=127.0.0.1
add action=drop chain=input comment="defconf: drop all not coming from LAN" \
in-interface-list=!LAN
add action=accept chain=forward comment="defconf: accept in ipsec policy" \
ipsec-policy=in,ipsec
add action=accept chain=forward comment="defconf: accept out ipsec policy" \
ipsec-policy=out,ipsec
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" \
connection-state=established,related disabled=yes
add action=accept chain=forward comment=\
"defconf: accept established,related, untracked" connection-state=\
established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" \
connection-state=invalid
add action=drop chain=forward comment=\
"defconf: drop all from WAN not DSTNATed" connection-nat-state=!dstnat \
connection-state=new in-interface-list=WAN
/ip firewall mangle
add action=mark-packet chain=forward new-packet-mark=Traffic-UP_Priority1 \
out-interface-list=WAN passthrough=no src-address=192.168.51.4
add action=mark-packet chain=forward dst-address=192.168.51.4 \
in-interface-list=WAN new-packet-mark=Traffic-DW_Priority1 passthrough=no
add action=mark-packet chain=forward new-packet-mark=Traffic-UP_Priority8 \
out-interface-list=WAN passthrough=no src-address=192.168.51.0/24
add action=mark-packet chain=forward dst-address=192.168.51.0/24 \
in-interface-list=WAN new-packet-mark=Traffic-DW_Priority8 passthrough=no
/ip firewall nat
add action=masquerade chain=srcnat comment="defconf: masquerade" \
ipsec-policy=out,none out-interface-list=WAN
/ip service
set telnet disabled=yes
set ftp port=2190
set ssh port=2295
set www port=8080
set api disabled=yes
set api-ssl disabled=yes
/ip upnp
set enabled=yes
/ip upnp interfaces
add interface=bridge type=internal
add interface=lte1 type=external
/snmp
set enabled=yes
/system clock
set time-zone-name=Europe/Rome
/system identity
set name=RB_HAPAC3_LTE
/system leds
# using RSRP, modem-signal-threshold ignored
set 0 leds=led1,led2,led3,led4
add interface=lte1 leds=led5 type=interface-activity
/system logging
set 0 topics=info,!wireguard
/system note
set note=" ##### VALORI LTE #####\r\
\n\r\
\n* RSSI= Potenza del segnale ricevuto\r\
\n > \9665 dBm: Eccellente\r\
\n da \9665 dBm a \9675 dBm: Buono\r\
\n da \9675 dBm a \9685 dBm: Sufficiente\r\
\n* RSRP= Potenza del segnale di riferimento ricevuto\r\
\n >= \9680 dBm: Eccellente\r\
\n da \9680 dBm a \9690 dBm: Buono\r\
\n da \9690 dBm a \96100 dBm: Sufficiente\r\
\n* SINR= Rapporto segnale/rumore connessione 4G\r\
\n >= 20 dB: Eccellente\r\
\n da 13 dB a 20 dB: Buono\r\
\n da 0 dB a 13 dB: Appena Sufficiente\r\
\n* RSRQ= Segnale di riferimento qualit\E0 radio\r\
\n >= \9610 dB: Eccellente\r\
\n da \9610 dB a \9615 dB: Buono\r\
\n da \9615 dB a \9620 dB: Sufficiente\r\
\n\r\
\n* TACCHE SEGNALE IN ROS= -1. Verde\r\
\n -2. Giallo\
\r\
\n -3. Aranci\
o\r\
\n -4. Rosso\
\r\
\n\r\
\n/console/clear-history " show-at-login=no
/system package update
set channel=long-term
/system routerboard mode-button
set enabled=yes on-event=dark-mode
/system routerboard settings
set auto-upgrade=yes
/system scheduler
add comment="Disabilita il wireless" disabled=yes interval=1d name=Wlan-OFF \
on-event="/interface wireless disable wlan1\r\
\n" policy=\
ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon \
start-date=2021-08-26 start-time=02:00:00
add comment="Abilita il wireless" disabled=yes interval=1d name=Wlan-ON \
on-event="/interface wireless enable wlan1\r\
\n" policy=\
ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon \
start-date=2021-08-26 start-time=06:00:00
add comment="Disabilita l'LTE" disabled=yes interval=1d name=Lte-OFF \
on-event="/interface lte disable lte1\r\
\n\r\
\n" policy=\
ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon \
start-date=2021-08-26 start-time=03:00:00
add comment="Abilita l'LTE" disabled=yes interval=1d name=Lte-ON on-event=\
"/interface lte enable lte1\r\
\n\r\
\n" policy=\
ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon \
start-date=2021-08-26 start-time=05:00:00
add comment="Riavvia la RB" disabled=yes interval=2w1d name=RB_Reboot \
on-event="/system reboot" policy=\
ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon \
start-date=2021-12-09 start-time=04:00:00
add comment="Run Script fot Update" interval=1w name=Anti_Banner-Update \
on-event=Anti_Banner policy=\
ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon \
start-date=2024-08-12 start-time=04:30:00
add comment="Run Script at Reboot" name=Anti_Banner-Reboot on-event=\
Anti_Banner policy=\
ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon \
start-time=startup
/system script
add comment=defconf dont-require-permissions=no name=dark-mode owner=*sys \
policy=ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon \
source="\r\
\n :if ([system leds settings get all-leds-off] = \"never\") do={\r\
\n /system leds settings set all-leds-off=immediate \r\
\n } else={\r\
\n /system leds settings set all-leds-off=never \r\
\n }\r\
\n "
add comment="Reboot RB da SMS" dont-require-permissions=yes name=reboot \
owner=admin policy=\
ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon source=\
"/system reboot"
add dont-require-permissions=no name=Anti_Banner owner=admin policy=\
ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon source="#\
\_Ritatdo di 30s utile al reboot di ROS\r\
\n:delay 180s\r\
\n# Check cache size and adjust if not large enough\r\
\n:if ([ip/dns/get cache-size]!=32768) do={/ip/dns/set cache-size=32768}\r\
\n# Remove all current adlists\r\
\n/ip/dns/adlist remove [find]\r\
\n# Fetch new adlist source file(s)\r\
\n/tool/fetch url=https://raw.githubusercontent.com/StevenBlack/hosts/mast\
er/hosts output=file dst-path=sblack-unified-adlist\r\
\n# Short delay to ensure file is created in RAM\r\
\n:delay 1s\r\
\n# Create new adlist from file\r\
\n/ip/dns/adlist/add file=sblack-unified-adlist\r\
\n# Remove temp file from RAM\r\
\n/file remove sblack-unified-adlist"
add dont-require-permissions=no name=Clear_HistoryTerminal owner=admin \
policy=ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon \
source=/console/clear-history
/system watchdog
set ping-start-after-boot=7m ping-timeout=10m watch-address=8.8.8.8
/tool e-mail
set certificate-verification=no
/tool mac-server
set allowed-interface-list=LAN
/tool mac-server mac-winbox
set allowed-interface-list=LAN
/tool sms
set allowed-number=+39XXXXXXXXXX port=lte1 receive-enabled=yes