Simple Queues - What's Missing?

RouterOS Beginner Basics
1

I have a large number of packets passing through without getting tagged, what am I missing?

Important parts of the config.

Networks and addresses:

/ip address
add address=10.15.24.1/24 interface=24-DESK-BRIDGE network=10.15.24.0
add address=10.24.254.1/29 interface=254-TV-FEED-BRIDGE network=10.24.254.0
add address=10.24.10.254/24 interface=10-TV-INT-BRIDGE network=10.24.10.0
add address=10.24.30.1/24 interface=30-WIFI-BRIDGE network=10.24.30.0
add address=10.24.220.1/24 interface=220-DEVICES-BRIDGE network=10.24.220.0
add address=10.24.20.1/24 interface=20-LAN-BRIDGE network=10.24.20.0
add address=10.24.100.1/24 interface=0-MANAGEMENT-BRIDGE network=10.24.100.0
add address=10.24.50.1/24 interface=50-CAMERA-BRIDGE network=10.24.50.0
add address=10.24.90.1/24 interface=90-WIFI-CAPSMAN-BRIDGE network=10.24.90.0

Mangle rules to mark packets. Besides needing to clean up how I handle marking packets from the children’s devices, I cover three primary zones. General LAN (10.24.0.0/16), Management (10.24.100.0/24), and the desk (10.15.24.0/24). The final passthrough mangle is seeing 20% of the packets passing through the router… Why?

/ip firewall mangle
add action=mark-packet chain=prerouting comment=Surface dst-address=!10.24.0.0/16 new-packet-mark=child passthrough=no src-mac-address=50:1A:C5:E9:B6:4D
add action=mark-packet chain=prerouting comment=Kindle dst-address=!10.24.0.0/16 new-packet-mark=child passthrough=no src-mac-address=F0:4F:7C:C8:20:D5
add action=mark-packet chain=prerouting comment="Vizio TV" dst-address=!10.24.0.0/16 new-packet-mark=child passthrough=no src-mac-address=A4:8D:3B:2A:04:2D
add action=mark-packet chain=prerouting comment="iPhone" dst-address=!10.24.0.0/16 new-packet-mark=child passthrough=no src-mac-address=E8:80:2E:BC:F6:0C
add action=mark-packet chain=forward comment="To Child" dst-address-list=Child new-packet-mark=child passthrough=no
add action=mark-packet chain=forward comment="From Child" new-packet-mark=child passthrough=no src-address-list=Child
add action=mark-packet chain=forward comment="To Management" dst-address=10.24.100.0/24 new-packet-mark=management packet-mark=no-mark passthrough=no
add action=mark-packet chain=input comment="From Management" new-packet-mark=management packet-mark=no-mark passthrough=no src-address=10.24.100.0/24
add action=mark-packet chain=forward comment="To LAN" dst-address=10.24.0.0/16 new-packet-mark=standard packet-mark=no-mark passthrough=no
add action=mark-packet chain=input comment="From LAN" new-packet-mark=standard packet-mark=no-mark passthrough=no src-address=10.24.0.0/16
add action=mark-packet chain=forward comment="To Desk" dst-address=10.15.24.0/24 new-packet-mark=priority packet-mark=no-mark passthrough=no
add action=mark-packet chain=input comment="From Desk" new-packet-mark=priority packet-mark=no-mark passthrough=no src-address=10.15.24.0/24
add action=passthrough chain=postrouting packet-mark=no-mark

Finally, the queues, which effectively handle the packets which are actually marked.

/queue simple
add name=All-Traffic queue=ethernet-default/ethernet-default target=""
add name=DeskLan packet-marks=priority parent=All-Traffic priority=4/4 queue=ethernet-default/ethernet-default target=""
add name=Management packet-marks=management parent=All-Traffic priority=3/3 queue=ethernet-default/ethernet-default target=""
add name=LAN packet-marks=standard parent=All-Traffic priority=5/5 queue=ethernet-default/ethernet-default target=""
add max-limit=20M/20M name=Child packet-marks=child parent=All-Traffic queue=ethernet-default/ethernet-default target=""
2

You aren’t marking some packets, obviously. Those are hitting your rule at the bottom.

Maybe your chain=input should be chain=forward?

Keep in mind with your simple queue setup, it is very easy to make a mistake and forget about some packets somewhere. I prefer to use interface-attached queue trees instead of simple queues for prioritization since it makes it basically impossible to forget about some traffic if you match every possible mark on every interface.

If you really need to use simple queues, I would forego the packet marking and just use the subnets as the target for the queues. If you want your iPhone etc to have priority, give it a static IP with a DHCP reservation, very easy to do.

The problem with packet marking and simple queues and all of these negative conditions, “any subnet except this” etc, you can very easily forget about some traffic, then your QoS doesn’t work.