Setting up PPTP server default profile afect shaping.

RouterOS General
1

Hi to all. First of all I want to say thanks to development team of RouterOS for awesome “Swiss knife” for network administrator. The problem, that I have faced, exists (I know exactly) in RoutersOS 3.22, 3.25, 3.30, 4.5. So, I have clients, which authenticate to router (by the way, I used RB433, RB433AH, RB600A and RB1000) using PPTP. All users divide in some groups by ip-address criteria. All packets that destined to or originated from clients from the same group marks by some marker (one for incoming packets and one for outgoing packets for the same group). In queue tree I have next setup for download:

name=“down512_1” parent=global-out packet-mark=“” limit-at=0 priority=8
max-limit=512k burst-limit=0 burst-threshold=0 burst-time=0s

name=“queue3” parent=down512_1 packet-mark=pac512_1 limit-at=0
queue=pcq-down priority=8 max-limit=0 burst-limit=0 burst-threshold=0
burst-time=0s

In this example, exists group named “down512_1”. All packets that destined to ip addresses that belong to group “down512_1” mark with marker “pac512_1”. So, as you can see, users that belong to “down512_1” must share 512kbps for download. And I have noticed that for properly work of this, I must setting double bandwidth in queue “down512_1” if I setting up default profile “default” in setup of PPTP server. Another words for sharing 512 kbps I must set up max-limit=1M. If I not doing so and leave 512 kbps my users sharing only 256 kbps. If I setting up in PPTP server property “default profile=default-encryption” I must not double max-limit. Another words, for sharing 512 kbps I must set up “max-limit=512k”. By the way, I didn’t experience such problem with upload. What can you say about all this?
Thank you.

2

please, look at http://wiki.mikrotik.com/wiki/Packet_Flow#IPsec_encryption

it will give you a picture about PPTP. it is similar to that example, just instead of IPSec Encryption use ‘PPTP Encapsulation’ term. you can see that your traffic passes ‘postrouting’ block (this includes global-out) twice: first as ‘raw’ traffic, and then as encapsulated packet.

you can try to solve your problem by adding that rule at the top:

/ip firewall mangle add chain=prerouting packet-mark=your_mark(it should be empty for 'normal' packets yet) action=mark-packet new-packet-mark=no-mark
3

The matter is that I must double max-limit if I not using encryption profile.