Queue tree and fasttrack mutually exclusive?

RouterOS General
1

Hello from North Dakota, USA!
I’m seeing unexpected results on my queue tree when fasttrack is enabled - can anyone else confirm or explain if this is intended?

I have parent queue DOWNLOAD on my LAN bridge, several child queues - set for PCQ
I have parent queue UPLODAD on my WAN physical, several child queues - set for PCQ

My upload works exactly as I expect, doing PCQ and max-limit being enforced. However, the download does NOT enforce max-limit unless I disable fasttrack, and I suspect that it is not giving the PCQ behavior desired, either.

Am I doing anything wrong by putting the parent queue on a bridge? Can you not use fasttrack with download pcq? Am I missing something? I get exactly the behavior I expect with fasttrack disabled, but CPU is much higher when doing so.

TIA – Marc

2

Read the manual, please:

Fasttracked packets bypass firewall, connection tracking, simple queues, queue tree with parent=global, ip accounting, ipsec, hotspot universal client, vrf assignment, so it is up to administrator to make sure fasttrack does not interfere with other configuration;

3

Hi, thanks for your response! Can you clarify that:

queue tree with parent=global

is the expected behavior by selecting a parent=bridge in addition to global?

4

What do you mean? To my knowledge a particular queue tree may only have a single parent, and that’s either global or an interface queue.

Anyways, please check this thread out, I think you may find it useful/helpful.

5

I looked through that link - cool stuff. However, I’m now wondering if I’m just doing it wrong - I continued to test with and without fasttrack and it is 100% not applying to my queue tree if fasttrack is enabled. My method is to add a mangle for each LAN device like so:

/ip firewall mangle
add action=mark-packet chain=prerouting in-interface=bridge-local new-packet-mark=adults passthrough=no src-address=192.168.87.244
add action=mark-packet chain=postrouting dst-address=192.168.87.244 new-packet-mark=adults out-interface=ether1-gateway passthrough=no

and my queue tree looks like:

/queue tree
add name=Download parent=bridge-local queue=pcq-download-default
add limit-at=4800059 max-limit=74800059 name=adults-down packet-mark=adults parent=Download priority=1 queue=pcq-download-default
add limit-at=3936845 max-limit=74800059 name=kids-down packet-mark=kids parent=Download priority=5 queue=pcq-download-default
add limit-at=2624563 max-limit=74800059 name=media-down packet-mark=media parent=Download priority=3 queue=pcq-download-default
add limit-at=1312281 max-limit=74800059 name=guest-down packet-mark=guest parent=Download queue=pcq-download-default
add name=Upload parent=ether1-gateway queue=pcq-upload-default
add limit-at=964067 max-limit=13737958 name=adults-up packet-mark=adults parent=Upload priority=1 queue=pcq-upload-default
add limit-at=723050 max-limit=13737958 name=kids-up packet-mark=kids parent=Upload priority=5 queue=pcq-upload-default
add limit-at=482033 max-limit=13737958 name=media-up packet-mark=media parent=Upload priority=3 queue=pcq-upload-default
add limit-at=241016 max-limit=13737958 name=guest-up packet-mark=guest parent=Upload queue=pcq-upload-default

I can only assume that even though I want a mangle to occur, even with fasttrack, it isn’t happening. So maybe it’s not that I’ve got my queue tree wrong, but maybe mangle isn’t the right method to use here? Any thoughts/suggestions?

6

Re-reading documentation and indeed, Fasttracked packets bypass firewall … etc and mangle is part of firewall. So I think maybe there is no way to use FT and QT together?

7

You can use together since you specify the source that will not be queued.

/ip firewall filter
	add chain=forward action=fasttrack-connection routing-mark=!kz-routing src-address=10.1.1.0/24 log=no log-prefix=""
/ip firewall mangle
	add chain=prerouting action=mark-routing new-routing-mark=kz-routing passthrough=yes src-address-list=kz-ips log=no log-prefix=""
/ip route
	add distance=1 gateway=pppoe-out1 routing-mark=kz-routing

This works like a charm.
In my case, certain IPs from an address-list isn’t fasttracked because of an mangle rule for prerouting I want.