Hi,
Recently I had a task to build a parent/child relationship using simple queues to limit a pool of IPs, those IPs belong to different segments and are not sequential, basically this:
I have a bunch of IPs in different ranges say:
[]192.168.0.0-192.168.0.10
[]192.168.0.16-192.168.0.33
[]172.16.100.0/24
[]172.16.101.10-172.16.101.100
All of these IPs belong to a single service that was provisioned and as such requires to share a common pool of bandwidth over a very specific interface (as in, they cannot exceed upload/download when traffic passes through this interface),
For example, say the down/up limits are 100 Mbps each and the interface is SFP1.
This is what I did:
1.- I build a firewall address-list and added all the prefixes in there
2.- I build 2 firewall mangle prerouting rules that either match this address-list as source or as a destination
3.- Build a simple queue with max-limit = 100M/100M, target = sfp1 and packet-mark the one set in point #2
ip firewall address-list add list=test01 address=192.168.0.0-192.168.0.10
ip firewall address-list add list=test01 address=192.168.0.16-192.168.0.33
ip firewall mangle add chain=prerouting passthrough=no action=mark-packet new-packet-mark=test-traffic src-address-list=test01
ip firewall mangle add chain=prerouting passthrough=no action=mark-packet new-packet-mark=test-traffic dst-address-list=test01
queue simple add name=test-queue packet-mark=test-traffic target=sfp1 max-limit=100M/100M
This worked, I was seeing the limits as intended, but then the project required to limit every single IP in the ranges with a specific max-limit but keeping the total-limit of the previous queue, so a parent/child relationship.
I know simple queues using parents require the parent to match first the traffic or else the child won’t work, so I kept the queue I did in the previous code and now added a queue for every single IP in all the ranges present in the address-list like this:
queue simple add name=child-1 parent=test-queue max-limit=20M/20M target=192.168.0.0
queue simple add name=child-1 parent=test-queue max-limit=20M/20M target=192.168.0.1
queue simple add name=child-1 parent=test-queue max-limit=20M/20M target=192.168.0.2
queue simple add name=child-1 parent=test-queue max-limit=20M/20M target=192.168.0.3
...
As soon I did this, the parent queue stopped working and neither of the child queues worked as well. I tried many things with no success until I changed the parent’s queue target to 0.0.0.0/0 (was sfp1 before) and the queue started working…
Or so I though, only for the download traffic is getting catched by, upload traffic isn’t getting registered at all (and of course isn’t getting limited either).
The hardware we’re using is CCR1036-12G-4S, RouterOS 6.38.7 - We haven’t upgraded it because it has to follow a change management and approval process, so my hope is that this isn’t a bug but some error by my side.
Anyone has any idea of why is this happening?
To summarize
[]I have a bunch of IP ranges that are not sequential
[]I need to limit the download and upload of this bunch of ranges as a whole
[]I then need each IP to have a specific limit but can never ago above the max-limit of the whole group
[]I only need to limit traffic that traverse a specific interface