Simple Queues, Working on RC11?

RouterOS General
1 
/queue simple
add burst-limit=4000000/128000 burst-time=1m/1m comment="" direction=both disabled=no dst-address=0.0.0.0/0 interface=VLAN1001 limit-at=384000/128000 \
    max-limit=4000000/128000 name="VLAN1001" parent=none priority=8 queue=default-small/default-small total-queue=default-small

Yet, a simple test with SCP THROUGH the router, I am achieving 14Mbps upload, and 20Mbps download (from the client side)… Either I am doing something horribly wrong, or simple queues are horribly broken :frowning:

EDIT: Seems that neither torch nor queues pick up traffic properly on VLAN interfaces. 99.9999% of the 14MB traffic on the Ethernet interface, is on VLAN1001, I can’t do jack to limit the traffic currently :frowning:
untitled.GIF

2

Umm, are you setting Simple Queues on client device on AP? I have found that in my situation, I can get a more precise bandwidth control from AP side rather than client side. I usually have to manually set queues higher than the the default drop down list on Mikrotik O.S. example if I want customer to have 768k download I will manually set download to about 900k. Maybe this doesn’t help your situation.

3

No, this is a core router with 8 Ethernet interfaces, the VLAN’s are running on the ‘Internal Interface’ which is Ethernet, and pushing traffic nicely, regardless of the fact that it -should- be no more than 4mbit…

-shrugs- Maybe it’s time to just go back to 2.9… 3.0 has far to much issues lately…

4

You have to specify ‘target-address’ for ‘queue simple’ entries.
It could be network address.

5

Tried that, didn’t change anything…

Whether the queue works or not, why does torch not even pick up the traffic on the VLAN?

6

Are you sure there is traffic on the VLAN interface ?
What do you see when you torch for "Internal Network’ interface ?

7

/ip address export
221 198.19.0.50/29 198.19.0.48 198.19.0.55 VLAN1001 >


Yes, 198.19.0.50/29 is on VLAN1001, as indicated by torch, my session over the VLAN Interface to Winbox is showing.

/interface vlan
add arp=enabled comment="" disabled=no interface="Internal Network" mtu=1500 name="VLAN1001" vlan-id=1001
<snip>

/interface ethernet
<snip>
set 4 arp=enabled auto-negotiation=yes cable-settings=default comment="Internal Network" disable-running-check=yes disabled=no full-duplex=yes \
    mac-address=00:E0:18:84:A4:24 mtu=1500 name="Internal Network" speed=100Mbps

/ip address
<snip>
add address=192.168.1.2/24 broadcast=192.168.1.255 comment="Internal Network" disabled=no interface="Internal Network" network=192.168.1.0

<snip>

add address=198.19.0.50/29 broadcast=198.19.0.55 comment="" disabled=no interface=VLAN1001 network=198.19.0.48

It’s impossible that 198.19.0.54 could be talking over the Internal interface, then the VLAN on the Mikrotik would be leaking traffic, which is just as bad…

8

Ok,

Traffic is going through the VRRP ‘Interface’, and not through the VLAN interface…

Scenario 1: I limit traffic on the VRRP Interface, customer change his default route to go to the physical address instead of the virtual address, he bypasses the queues

Scenario 2: I limit traffic on the VLAN Interface, customer change his default route to the virtual address and bypass queues.

Scenario 3: I setup two queues on both the interfaces, customer does fancy routing, and gets double the traffic he is limited at (4MB Down on the Virtual Interface, 4MB Down on the physical Interface). Three times more considering he can also use the physical interface on the 2nd router, as a gateway


So…

How do we limit traffic on VRRP interfaces? How do we implement firewalls on VRRP interfaces without doing everything twice… I guess, at the end of the day, VRRP is STILL not working (http://forum.mikrotik.com/t/vrrp-virtual-ip-address-or-virtual-interface/17510/1). I’m -definately- not terminating 200+ VLANs on a Mikrotik when 1) I can’t effectively manage the traffic (Queues / Firewalls / etc), or 2) there is no redundancy because I can’t ‘use’ VRRP. So again (or is that still?)… Can VRRP please be fixed?