Hi Guys,
I am having some trouble with limiting total bandwidth of a hotspot.
I have a 100M link that I share with another firewall. I want to limit the total bandwidth that the hotspot uses to 70M leaving 30M for the other firewall.
I also limit the individual bandwith of each user of the hotspot to 2M, 4M or 8M depending on user profile. This part works without issues. I see traffic in the queue list being limited. Where I don’t think its working is the Total Bandwidth of the Hotspot. I have it limited with this line;
add dns-name= hotspot-address=X.X.X.X html-directory=Hotspot1 login-by=cookie,http-chap,mac-cookie name=Hotspot rate-limit=70M/70M use-radius=yes
I hardly ever see traffic on this queue. I was expecting it to show the sum of the traffic but I guess I am wrong…
Can someone tell me if I am doing this wrong?
Below is the relevant part of my config…
Thanks
\
may/08/2019 15:15:09 by RouterOS 6.42.7
model = 1100AHx2
/interface bridge
add arp=proxy-arp fast-forward=no name=Bridge_Out
add arp=proxy-arp fast-forward=no name=VPN_Bridge
/interface ethernet
set [ find default-name=ether1 ] comment=WAN
set [ find default-name=ether2 ] arp=proxy-arp comment=WIFI
set [ find default-name=ether3 ] comment=WIFI
set [ find default-name=ether4 ] comment=WIFI
set [ find default-name=ether11 ] comment=“Conexion a la red interna para radius”
set [ find default-name=ether12 ] comment=“Conexion a switch internet para administracion”
set [ find default-name=ether13 ] arp=disabled
/interface vlan
add interface=Bridge_Out name=vlan100_Hotspot vlan-id=100
/ip hotspot profile
set [ find default=yes ] login-by=cookie,http-chap,mac-cookie
add dns-name= hotspot-address=10.100.100.1 html-directory=Hotspot1 login-by=cookie,http-chap,mac-cookie name=Hotspot rate-limit=70M/70M use-radius=yes
add hotspot-address=10.100.100.1 name=hsprof1
/ip hotspot user profile
set [ find default=yes ] keepalive-timeout=23h59m59s mac-cookie-timeout=2d name=Huesped rate-limit=8M/8M shared-users=4 status-autorefresh=23h1m
add keepalive-timeout=3h mac-cookie-timeout=8h name=Salones rate-limit=8M/8M shared-users=150 transparent-proxy=yes
add keepalive-timeout=3h mac-cookie-timeout=4h name=Bo rate-limit=2M/2M shared-users=150 transparent-proxy=yes
/ip hotspot
add address-pool=hs-pool-15 disabled=no interface=vlan100_Hotspot name=hotspot1 profile=Hotspot
/ip hotspot user
add name=salon profile=Salones server=hotspot1
add name=jcrs server=hotspot1
add name=Salon profile=Salones server=hotspot1
add name=Salones profile=Salones server=hotspot1
add name=salones profile=Salones server=hotspot1
add name=ncf server=hotspot1
add name=Bona profile=Bo
/ip pool
add name=hs-pool-15 ranges=10.100.100.2-10.100.103.250
add name=vpn-pool ranges=10.200.200.2-10.200.200.10
add name=dhcp_pool2 ranges=192.168.28.2-192.168.31.240
/ip dhcp-server
add address-pool=hs-pool-15 disabled=no interface=vlan100_Hotspot lease-time=8h name=dhcp1
add address-pool=dhcp_pool2 disabled=no interface=Bridge_Out lease-time=12h name=dhcp2
/interface bridge port
add bridge=Bridge_Out interface=ether2
add bridge=Bridge_Out interface=ether3
add bridge=Bridge_Out interface=vlan100_Hotspot
add bridge=Bridge_Out interface=ether6
add bridge=Bridge_Out interface=ether4
add bridge=Bridge_Out interface=ether5
/ip address
add address=186.67.113.227/29 interface=ether1 network=186.67.113.224
add address=10.10.10.1/24 interface=ether12 network=10.10.10.0
add address=10.100.100.1/22 comment=“hotspot network” interface=vlan100_Hotspot network=10.100.100.0
add address=192.168.70.50/24 interface=ether11 network=192.168.70.0
add address=10.200.200.1/24 interface=VPN_Bridge network=10.200.200.0
add address=192.168.28.1/22 interface=Bridge_Out network=192.168.28.0
/ip dhcp-server lease
add address=10.100.101.111 client-id=1:78:36:cc:aa:7d:b9 mac-address=78:36:CC:AA:7D:B9 server=dhcp1
/ip dhcp-server network
add address=10.100.100.0/22 comment=“hotspot network” gateway=10.100.100.1
add address=192.168.28.0/22 dns-server=8.8.8.8,1.1.1.1 gateway=192.168.28.1
/ip dns
set servers=8.8.8.8
/ip firewall address-list
add list=LAN
/ip firewall filter
add action=accept chain=input dst-port=500 in-interface=ether1 protocol=udp
add action=accept chain=input dst-port=1701 in-interface=ether1 protocol=udp
add action=accept chain=input dst-port=4500 in-interface=ether1 protocol=udp
add action=accept chain=input in-interface=ether1 protocol=ipsec-esp
add action=accept chain=input in-interface=ether1 protocol=ipsec-ah
add action=accept chain=input dst-port=8291 in-interface=ether1 protocol=tcp src-address=x.x.x.x
add action=accept chain=input dst-port=8291 in-interface=ether1 protocol=tcp src-address=x.x.x.x
add action=drop chain=input dst-port=8291 in-interface=ether1 log=yes log-prefix=“Winbox Attempt” protocol=tcp
add action=accept chain=input dst-port=161 in-interface=ether1 log-prefix=“Winbox Attempt” protocol=udp src-address=x.x.x.x
add action=accept chain=input comment=“defconf: accept ICMP” protocol=icmp
add action=accept chain=input comment=“defconf: accept established,related” connection-state=established,related
add action=drop chain=input comment=“defconf: drop all from WAN” in-interface=ether1 log-prefix="drop "
add action=fasttrack-connection chain=forward comment=“defconf: fasttrack” connection-state=established,related disabled=yes
add action=accept chain=forward comment=“defconf: accept established,related” connection-state=established,related
add action=drop chain=forward comment=“defconf: drop invalid” connection-state=invalid
add action=drop chain=forward comment=“defconf: drop all from WAN not DSTNATed” connection-nat-state=!dstnat connection-state=new in-interface=ether1
add action=passthrough chain=unused-hs-chain comment=“place hotspot rules here” disabled=yes
add action=passthrough chain=unused-hs-chain comment=“place hotspot rules here” disabled=yes