Reserve bandwidth with queues possible?

RouterOS General
1

From what I can see, the queues are only configurable to limit traffic with different approaches. From marking traffic to simple queues, but they seem to be designed to make sure traffic doesn’t exceed a certain threshold.

I’m looking for a way to make sure some services always have an X amount of bandwidth available. In a sense prioritizing a partition of the bandwidth to a certain condition (subnet or interface). Once the pipeline starts to fill up, the router is able to make sure there is always this X amount of bandwidth available.

But I suppose this intelligence isn’t possible in RouterOS? And I probably have to identify the bursty and network hungry flows and set limits to them? And by doing that I can make sure other traffic has enough bandwidth. Is this assumption correct?

I’ve tried to get a simple queue working for experimentation. But no matter what I do (set it to IPs or interfaces), the network graphs don’t output any traffic spikes, also the network meters don’t show the slightest traffic. While I am doing an iperf between ether2 and ether3. I’m using VLAN 12, which is tagged by the devices themselves. Am I maybe forgetting some pre-condition? The documentation doesn’t mention extra steps. But maybe because these are VLANs it’s different? I also tried to limit ether1 traffic, which is connected to my laptop, no change either. Only when I set the target to 0.0.0.0/0 it register some minor traffic, but none of which I really want to shape. Which is actually the traffic between ether2 and ether3. Also when I use the subnet of the VLAN that’s active between those interfaces, nothing is registered in the network graphs. It’s a flat line.

My config:

# jun/05/2022 17:15:36 by RouterOS 7.2.3
# software id = A1GI-TFVF
#
# model = 960PGS
# serial number = 89F90861A06A
/interface bridge
add admin-mac=CC:2D:E0:81:0A:BE auto-mac=no comment=defconf name=bridge
/interface ethernet
set [ find default-name=ether2 ] poe-out=forced-on
set [ find default-name=ether3 ] poe-out=forced-on
set [ find default-name=ether4 ] poe-out=forced-on
set [ find default-name=ether5 ] poe-out=forced-on
/interface ethernet switch port
set 0 default-vlan-id=10 vlan-header=always-strip vlan-mode=secure
set 1 default-vlan-id=10 vlan-header=add-if-missing vlan-mode=secure
set 2 default-vlan-id=10 vlan-header=add-if-missing vlan-mode=secure
set 3 default-vlan-id=10 vlan-header=add-if-missing vlan-mode=secure
set 4 default-vlan-id=10 vlan-header=add-if-missing vlan-mode=secure
set 5 default-vlan-id=10 vlan-header=add-if-missing vlan-mode=secure
/interface list
add comment=defconf name=WAN
add comment=defconf name=LAN
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
/ip pool
add name=default-dhcp ranges=192.168.88.10-192.168.88.254
/ip dhcp-server
add address-pool=default-dhcp disabled=yes interface=bridge name=defconf
/queue simple
add burst-limit=150M/150M burst-threshold=10M/10M burst-time=2s/2s max-limit=100M/100M name=replication target=ether2,ether3
/interface bridge port
add bridge=bridge comment=defconf interface=ether2
add bridge=bridge comment=defconf interface=ether3
add bridge=bridge comment=defconf interface=ether4
add bridge=bridge comment=defconf interface=ether5
add bridge=bridge comment=defconf interface=sfp1
/ip neighbor discovery-settings
set discover-interface-list=LAN
/ip settings
set rp-filter=strict
/interface ethernet switch vlan
add comment=native independent-learning=yes ports=ether1,ether2,ether3,ether4,ether5,switch1-cpu switch=switch1 vlan-id=10
add comment=management independent-learning=yes ports=ether2,ether3,ether4,ether5 switch=switch1 vlan-id=11
add comment=replication independent-learning=yes ports=ether2,ether3,ether4,ether5 switch=switch1 vlan-id=12
add comment=public independent-learning=yes ports=ether2,ether3,ether4,ether5 switch=switch1 vlan-id=13
/interface list member
add comment=defconf interface=bridge list=LAN
add comment=defconf interface=ether1 list=WAN
/ip dhcp-client
add comment=defconf interface=ether1
/ip dhcp-server network
add address=192.168.88.0/24 comment=defconf dns-server=192.168.88.1 gateway=192.168.88.1 netmask=24
/ip dns
set allow-remote-requests=yes
/ip dns static
add address=192.168.88.1 comment=defconf name=router.lan
/ip firewall filter
add action=accept chain=input comment="defconf: accept established,related,untracked" connection-state=established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=invalid
add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp
add action=accept chain=input comment="defconf: accept to local loopback (for CAPsMAN)" dst-address=127.0.0.1
add action=drop chain=input comment="defconf: drop all not coming from LAN" disabled=yes in-interface-list=!LAN
add action=accept chain=forward comment="defconf: accept in ipsec policy" ipsec-policy=in,ipsec
add action=accept chain=forward comment="defconf: accept out ipsec policy" ipsec-policy=out,ipsec
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" connection-state=established,related hw-offload=yes
add action=accept chain=forward comment="defconf: accept established,related, untracked" connection-state=established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" connection-state=invalid
add action=drop chain=forward comment="defconf: drop all from WAN not DSTNATed" connection-nat-state=!dstnat connection-state=new in-interface-list=WAN
/ip firewall nat
add action=masquerade chain=srcnat comment="defconf: masquerade" disabled=yes ipsec-policy=out,none out-interface-list=WAN
/ip route
add disabled=no dst-address=172.27.13.0/24 gateway=ether1 routing-table=main suppress-hw-offload=no
/ipv6 firewall address-list
add address=::/128 comment="defconf: unspecified address" list=bad_ipv6
add address=::1/128 comment="defconf: lo" list=bad_ipv6
add address=fec0::/10 comment="defconf: site-local" list=bad_ipv6
add address=::ffff:0.0.0.0/96 comment="defconf: ipv4-mapped" list=bad_ipv6
add address=::/96 comment="defconf: ipv4 compat" list=bad_ipv6
add address=100::/64 comment="defconf: discard only " list=bad_ipv6
add address=2001:db8::/32 comment="defconf: documentation" list=bad_ipv6
add address=2001:10::/28 comment="defconf: ORCHID" list=bad_ipv6
add address=3ffe::/16 comment="defconf: 6bone" list=bad_ipv6
/ipv6 firewall filter
add action=accept chain=input comment="defconf: accept established,related,untracked" connection-state=established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=invalid
add action=accept chain=input comment="defconf: accept ICMPv6" protocol=icmpv6
add action=accept chain=input comment="defconf: accept UDP traceroute" port=33434-33534 protocol=udp
add action=accept chain=input comment="defconf: accept DHCPv6-Client prefix delegation." dst-port=546 protocol=udp src-address=fe80::/10
add action=accept chain=input comment="defconf: accept IKE" dst-port=500,4500 protocol=udp
add action=accept chain=input comment="defconf: accept ipsec AH" protocol=ipsec-ah
add action=accept chain=input comment="defconf: accept ipsec ESP" protocol=ipsec-esp
add action=accept chain=input comment="defconf: accept all that matches ipsec policy" ipsec-policy=in,ipsec
add action=drop chain=input comment="defconf: drop everything else not coming from LAN" in-interface-list=!LAN
add action=accept chain=forward comment="defconf: accept established,related,untracked" connection-state=established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" connection-state=invalid
add action=drop chain=forward comment="defconf: drop packets with bad src ipv6" src-address-list=bad_ipv6
add action=drop chain=forward comment="defconf: drop packets with bad dst ipv6" dst-address-list=bad_ipv6
add action=drop chain=forward comment="defconf: rfc4890 drop hop-limit=1" hop-limit=equal:1 protocol=icmpv6
add action=accept chain=forward comment="defconf: accept ICMPv6" protocol=icmpv6
add action=accept chain=forward comment="defconf: accept HIP" protocol=139
add action=accept chain=forward comment="defconf: accept IKE" dst-port=500,4500 protocol=udp
add action=accept chain=forward comment="defconf: accept ipsec AH" protocol=ipsec-ah
add action=accept chain=forward comment="defconf: accept ipsec ESP" protocol=ipsec-esp
add action=accept chain=forward comment="defconf: accept all that matches ipsec policy" ipsec-policy=in,ipsec
add action=drop chain=forward comment="defconf: drop everything else not coming from LAN" in-interface-list=!LAN
/system clock
/system identity
set name=rt2
/tool mac-server
set allowed-interface-list=LAN
/tool mac-server mac-winbox
set allowed-interface-list=LAN
2

Look at “limit-at” for reserved bandwith in wiki or help website.

See also http://forum.mikrotik.com/t/limit-at-and-max-limit/122599/1

HTB theory found here: https://wiki.mikrotik.com/wiki/Manual:HTB

3

The names of queue parameters are not really self-explanatory. The limit-at, which you haven’t configured at all, is the guaranteed rate for the queue; the max-limit is the maximum the queue can get even if more free bandwidth is available in the parent queue. Some limit-at value different from 0 must be specified in order that the queue worked at all.

So my typical setup would be a parent queue with limit-at and max-limit set to the same value representing the available bandwidth of the physical link; the parent of this queue may be “global” (which has some consequences) or an interface. The parent queue would have several child queues (leaves) with their own limit-at and max-limit parameters; the sum of limit-at of all child queues must not exceed the limit-at of the parent queue. The max-limit of each child queue may be up to the limit-at of the parent queue; the child queues use the free bandwidth of the parent queue, according to the priority value (which is only taken into account for queues that have no children). limit-at takes precedence over priority - even the queue with lowest priority will get all of its limit-at if it uses it; if it doesn’t, the unused portion is available to the other queues and priority governs which one will get it if the demand exceeds the available bandwidth.

4

The strange thing is, when I set a queue for one of the IP subnets that’s being used on the VLANs between hosts that run the iperf, no traffic is detected. But I tried to set limit-at as well. That didn’t limit traffic, as expected. Because I would expect that the queue setting should at least show some traffic first, then at least I know this queue matches the traffic I’m trying to shape.

Could it perhaps be related to my VLAN setup? I’m using the switch chip VLAN setup on my Hex PoE Mikrotik (QCA8337). Maybe that combination doesn’t support queuing? VLAN 13 does have the switch1-cpu port included, which allows a port to the CPU, where I suppose the queuing is processed.


/queue/simple/print  detail
Flags: X - disabled, I - invalid; D - dynamic 
 0    name="replication" target=172.27.13.0/24 dst=172.27.13.0/24 parent=none packet-marks="" 
      priority=8/8 queue=default-small/default-small limit-at=10M/10M max-limit=100M/100M 
      burst-limit=150M/150M burst-threshold=10M/10M burst-time=2s/2s bucket-size=0.1/0.1

Edit: I by the way also don’t see any traffic counters going with 1Gbit/s in the firewall. Which should be the case when I run an iperf for a few minutes. Quite strange… It must be either the VLAN setup or maybe firewall/queues are not supported by the hardware acceleration I’m using.

5

If you have enabled switch chip forwarding, traffic between Ethernet ports of the switch chip bypasses the CPU completely, that’s the essence of “hardware accelerated bridging”. So yes, in that case, it is not surprising that the queues do not work.

6

Thanks for confirming. Well, then I better just use hardware acceleration since I get 5x more bandwidth that way. It wouldn’t make sense to go for the software VLANs just to play around with queues and then have bandwidth issues. It does suck that I cannot apply firewall rules on the Mikrotik for the VLANs though. For that it also needs interaction with the CPU. I guess I just have to make sure the perimeter is secured and the hosts run a firewall as well.