Community discussions

MikroTik App

What behaviour of counters on fasttracking rules do you want?

I want no dummy rules. Each rule should count its own counters correctly.
83 (39%)
I want non-removable one dummy rule for all fasttracking rules to display summary values and real rules can show nonsenses further.
3 (1%)
I want one dummy rule for each fasttracking rule to display values individually (as many dummy rules as many real fasttracking rules).
8 (4%)
I want to have general option to enable or disable this dummy rule.
97 (46%)
I want to have an individual option in each fasttracking rule to invoke corresponding dummy rule for counting values.
20 (9%)
 
Total votes: 211
 
jarda
Forum Guru
Forum Guru
Topic Author
Posts: 7756
Joined: Mon Oct 22, 2012 4:46 pm

Feature request: Remove fasttrack dummy rule

Sat Jul 11, 2015 12:28 pm

Hi,
I am absolutely against having general accepting rule in forward chain, that I cannot remove:
fasttrack.jpg
Everyone that sees it must think that it is accepting all traffic in forward chain.

I dont know if it is really accepting or not. This makes big mess in firewall, to have "dummy" rules that (hopefully) do nothing. How can I be sure???

Please, remove it as soon as possible, or at least make it selectable for example in real fasttracking rule open an option to invoke dummy rules for those who want it and keep the firewall otherwise clean without such garbage.

I am using more than one fasttracking rules and such one dummy accepting rule does not say anything. I have asked several times and had not get answer, so asking again:

Why the fasttracking rules do not count their hits but count something different? Make them count correctly and you do not need any dummy rules!

I am creating the polling question. As the answers are not fully disjunctive, everyone can select up to 2 answers.

Thank you very much.
You do not have the required permissions to view the files attached to this post.
 
User avatar
G2Dolphin
Member Candidate
Member Candidate
Posts: 164
Joined: Sun May 17, 2015 6:03 pm
Location: Moscow, Russia

Re: Feature request: Remove fasttrack dummy rule

Sat Jul 11, 2015 2:16 pm

Not only these rules are mess for some people (including me), they are just cannot be deleted! Considering everything (obviously excluding some deep system things) in ROS can be set up by us, this is a step backwards.
I can understand these rules if they were unique. But they are just showing the same information that in "IP - Settings". I'm not too lazy to go there and see, if I need. But I don't need that info be forced.
 
jarda
Forum Guru
Forum Guru
Topic Author
Posts: 7756
Joined: Mon Oct 22, 2012 4:46 pm

Re: Feature request: Remove fasttrack dummy rule

Sat Jul 11, 2015 8:44 pm

I hate settings that do not have any real reason but cannot be removed too.

The ipsec policies and proposals that cannot be removed even there is not used ipsec on the device at all, for example. But it is another topic...
 
User avatar
lordkappa
Member Candidate
Member Candidate
Posts: 133
Joined: Wed May 16, 2012 1:53 pm
Location: Vancouver, Canada

Re: Feature request: Remove fasttrack dummy rule

Sat Jul 11, 2015 11:20 pm

This feature should be nixed. Not even optional, just removed.

Having a do-nothing rule in firewall because your OS can't correctly track fastpathed traffic is just kludgy and unprofessional. As stated before, the same counters are available in ip->settings.
 
vortex
Forum Guru
Forum Guru
Posts: 1092
Joined: Sat Feb 16, 2013 6:10 pm

Re: Feature request: Remove fasttrack dummy rule

Sun Jul 12, 2015 12:09 am

I imagine this was a quick workaround for what some people were missing and that it will be cleaned up in a future release, but maybe not in 6.30.x .
 
User avatar
G2Dolphin
Member Candidate
Member Candidate
Posts: 164
Joined: Sun May 17, 2015 6:03 pm
Location: Moscow, Russia

Re: Feature request: Remove fasttrack dummy rule

Sun Jul 12, 2015 8:25 am

it will be cleaned up in a future release, but maybe not in 6.30.x .
Why not? It's not a really complex problem. But it's MikroTik choice anyways — to remove it, or not.
 
User avatar
bajodel
Long time Member
Long time Member
Posts: 551
Joined: Sun Nov 24, 2013 8:30 am
Location: Italy

Re: Feature request: Remove fasttrack dummy rule

Sun Jul 12, 2015 9:11 am

+1 ..up
 
vortex
Forum Guru
Forum Guru
Posts: 1092
Joined: Sat Feb 16, 2013 6:10 pm

Re: Feature request: Remove fasttrack dummy rule

Sun Jul 12, 2015 1:03 pm

it will be cleaned up in a future release, but maybe not in 6.30.x .
Why not? It's not a really complex problem. But it's MikroTik choice anyways — to remove it, or not.
Maybe they would fix it, but not in 6.30.x because it might imply an architectural change.
 
andriys
Forum Guru
Forum Guru
Posts: 1526
Joined: Thu Nov 24, 2011 1:59 pm
Location: Kharkiv, Ukraine

Re: Feature request: Remove fasttrack dummy rule

Sun Jul 12, 2015 6:53 pm

Why the fasttracking rules do not count their hits but count something different? Make them count correctly and you do not need any dummy rules!
I'd like to support you and vote against the dummy rules, which are undoubtedly just a mess. I would have vote for option #1, but your wording is quite misleading. Your "Each rule should count its own counters correctly" implies the rule's packet/byte counters are incorrect, but in fact they aren't! What real rule counters show you is perfectly correct. You just need to understand what they show exactly. And Mikrotik needs to document that stuff in a clear way.

As I understand, things work as follows:
  1. If packet matches a fasttracked connection, it is not being processed by the firewall at all. Just accepted. Thus no rule's counters are being updated when such packets are being processed by your router.
  2. A rule with 'action=fasttrack' (fasttrack rule) just marks the corresponding connection-tracking entry for fasttrack. The packet hitting a fasttrack rule is not being fasttracked yet, and thus updates the rules' counters.
  3. A fasttrack rule does not automatically imply 'accept', effectively passing the matching packet through. If you have an accept rule immediately following the fasttrack rule with the same traffic selectors, the hit and byte count on both rules is always the same. This is perfectly normal and expected.
 
TomosRider
Member Candidate
Member Candidate
Posts: 209
Joined: Thu Nov 20, 2014 1:51 pm

Re: Feature request: Remove fasttrack dummy rule

Mon Jul 13, 2015 12:14 am

Im with you Jarda.
 
User avatar
macgaiver
Forum Guru
Forum Guru
Posts: 1764
Joined: Wed May 18, 2005 5:57 pm
Location: Sol III, Sol system, Sector 001, Alpha Quadrant

Re: Feature request: Remove fasttrack dummy rule

Mon Jul 13, 2015 9:44 am

It looks like person that that made this pool doesn't know how fasttrack works:
I want no dummy rules. Each rule should count its own counters correctly.
There will be no difference in counters for other rules - as soon as you enable fasttrack, fasttracked traffic will skip firewall - will not be counted in any rules, will be invisible in firewall and queues, that is how fasttrack works, so with and without fasttrack dummy rule other rules will count exatly the same amount of traffic.
I want non-removable one dummy rule for all fasttracking rules to display summary values and real rules can show nonsenses further.
Same as before..., only small fraction of traffic will go through firewall with fasttrack, and dummy rules have no effect of "nonsense further"
I want one dummy rule for each fasttracking rule to display values individually (as many dummy rules as many real fasttracking rules).
Fasttrack-connection works with connections, similar to connection-mark, you don't know how many rules are marking your traffic with the same mark, it is impossible.
I want to have general option to enable or disable this dummy rule.
I can agree to this option, but be ready that there will be someone that will report that traffic is missing in firewall and queues as soon as you disable it.
I want to have an individual option in each fasttracking rule to invoke corresponding dummy rule for counting values.
Already stated before - it is impossible as fasttrack is binary flag in connection tracking you can't say what rule added the flag.


Bottom line, If you use fasttrack, most of the traffic will take the shortcut, skipping your firewall counters and queues, that is the way it works.
So fasttracked traffic is invisible for firewall and queues. To make it visible dummy rule was added.

so the pool options should be

a) i like dummy rules it allows me easier to see all my traffic in the firewall
b) i don't like dummy rules, i can live with traffic that is invisible to my firewall and queues
c) i like option that allows me enable/disable dummy rules
 
jarda
Forum Guru
Forum Guru
Topic Author
Posts: 7756
Joined: Mon Oct 22, 2012 4:46 pm

Re: Feature request: Remove fasttrack dummy rule

Mon Jul 13, 2015 10:50 am

Sure I am the person that does not know everything. And probably I do not fully understand the fasttrack counting approach.

I know that the fasttracking rule more or less works like mange and once the connection is marked it bypasses the firewall.

But: If there is possibility to count the values and display them in dummy rule, the values could be displayed on real rules instead on the dummy ones.

I am mainly against the forced dummy rules. If I would like to have such rule in firewall or in mangle, I would like to put it there on my own. Maybe some other options are not smart enough, but it is interesting anyway what people vote for...
 
User avatar
macgaiver
Forum Guru
Forum Guru
Posts: 1764
Joined: Wed May 18, 2005 5:57 pm
Location: Sol III, Sol system, Sector 001, Alpha Quadrant

Re: Feature request: Remove fasttrack dummy rule

Mon Jul 13, 2015 11:05 am

But: If there is possibility to count the values and display them in dummy rule, the values could be displayed on real rules instead on the dummy ones.
It is a workaround, you can't get those counters any other way manually, you need to go to /ip settings to see them
Check console, it have better representation. of that rule, winbox view can be misleading i agree.
 
andriys
Forum Guru
Forum Guru
Posts: 1526
Joined: Thu Nov 24, 2011 1:59 pm
Location: Kharkiv, Ukraine

Re: Feature request: Remove fasttrack dummy rule

Mon Jul 13, 2015 12:35 pm

But: If there is possibility to count the values and display them in dummy rule, the values could be displayed on real rules instead on the dummy ones.
Dummy rules show cumulative fasttrack counters (i.e. grand total bytes/packet fasttracked). You may have more then 1 fasttrack rule in your configuration, and showing the same number of packets/bytes on all your real fasttrack rules will be even more misleading then it is now with the fake (dummy) rules. Making fasttrack update per-rule counters is not an option, I think, as that should be quite expensive, while fasttrack is all about performance.
 
jarda
Forum Guru
Forum Guru
Topic Author
Posts: 7756
Joined: Mon Oct 22, 2012 4:46 pm

Re: Feature request: Remove fasttrack dummy rule

Mon Jul 13, 2015 1:25 pm

Maybe it is correct, but you never know. We are not ros developers.

The counters are held in conntrack on each connection individually. Maybe it is possible to number internally the fasttracking rules and add this number to each connection in conntrack while marked as fasttracked connection to be able to distinguish to which fasttracking rule the connection belongs. Then the regular counting would be easy and almost as fast as in total. This could be a way that mikrotik can solve my request, I think...

I guess that the counting is not part of firewall but part of conntrack anyway. So I still see possibility to get the right values where they should be.
 
User avatar
macgaiver
Forum Guru
Forum Guru
Posts: 1764
Joined: Wed May 18, 2005 5:57 pm
Location: Sol III, Sol system, Sector 001, Alpha Quadrant

Re: Feature request: Remove fasttrack dummy rule

Mon Jul 13, 2015 1:35 pm

Already there.
123.png
You do not have the required permissions to view the files attached to this post.
 
marting
Member Candidate
Member Candidate
Posts: 172
Joined: Thu Aug 21, 2014 2:07 pm

Re: Feature request: Remove fasttrack dummy rule

Mon Jul 13, 2015 4:00 pm

Where do these rules come from? I have some RB2011 with these rules and some RB2011 without these rules. All are running 6.30
These rules caused real headache because my configuration script does something like:
1. disable all interfaces
2. clear all firewall rules (filter, nat, mangle)
3. do something more
4. enable specific interfaces
Of course my script fails at this point:
[admin@INCOMPLETE_CONFIGURATION] > :foreach item in=[ /ip firewall filter find ] do { /ip firewall filter remove $item }
failure: cannot remove builtin
[admin@INCOMPLETE_CONFIGURATION] > :foreach item in=[ /ip firewall mangle find ] do { /ip firewall mangle remove $item }
failure: cannot remove builtin
I will change it to delete only non-dynamic rules. But it would be interesting to know.

Edit 1: These rules are not there when I do a /system reset-configuration no-defaults=yes . So I do not understand why they are separatly handled as "built-ins"
 
jarda
Forum Guru
Forum Guru
Topic Author
Posts: 7756
Joined: Mon Oct 22, 2012 4:46 pm

Re: Feature request: Remove fasttrack dummy rule

Mon Jul 13, 2015 5:18 pm

Looks like it is another unwanted effect of such "dummy" bad things.
 
harn2412
newbie
Posts: 27
Joined: Thu Jul 02, 2015 3:19 pm

Re: Feature request: Remove fasttrack dummy rule

Tue Jul 14, 2015 11:54 am

I only a new with RouterBoard and only test for a little with fast-track. And this is my think about dummy rule:

- I like this dummy rule because I can get a look over all fast-track streaming. I do not see the need to be monitored on a fast track streaming.

- But I also like the option to disable/enable this rule when I see don't need them.
 
jarda
Forum Guru
Forum Guru
Topic Author
Posts: 7756
Joined: Mon Oct 22, 2012 4:46 pm

Re: Feature request: Remove fasttrack dummy rule

Tue Jul 14, 2015 12:38 pm

It means you want the non-removable dummy rule as it is in 6.30 at the moment and simultaneously you want to be able to remove such non-removable dummy rule? Is not that contradictory?
 
User avatar
macgaiver
Forum Guru
Forum Guru
Posts: 1764
Joined: Wed May 18, 2005 5:57 pm
Location: Sol III, Sol system, Sector 001, Alpha Quadrant

Re: Feature request: Remove fasttrack dummy rule

Tue Jul 14, 2015 12:43 pm

Edit 1: These rules are not there when I do a /system reset-configuration no-defaults=yes . So I do not understand why they are separatly handled as "built-ins"
Rules show up as soon as you have at least one fasttrack connection in connection tracking table
(so basically as soon as you create fasttrack-connection rule in your firewall).

Dynamic dummy rules will remain there until you have at least 1 fasttrack connection remaining in connection tracking table
(yes, even after you disable your fasttrack-connection rule, cause if connection is fasttracked it can't be redirected back to normal path)
you will need to reboot

to Jarda: i think everyone in the forum already got your point about these rules, there are no real need to spam every topic
 
jarda
Forum Guru
Forum Guru
Topic Author
Posts: 7756
Joined: Mon Oct 22, 2012 4:46 pm

Re: Feature request: Remove fasttrack dummy rule

Tue Jul 14, 2015 1:31 pm

Where have you seen my spam?
 
jarda
Forum Guru
Forum Guru
Topic Author
Posts: 7756
Joined: Mon Oct 22, 2012 4:46 pm

Re: Feature request: Remove fasttrack dummy rule

Mon Jul 20, 2015 10:22 am

Ok,
a week has passed. Now the result look quite clear.

People here want to be able to switch the dynamic rules off and want each rule to show its values correctly instead those dummy rules.

Normis, what is your answer to this?
 
doush
Long time Member
Long time Member
Posts: 665
Joined: Thu Jun 04, 2009 3:11 pm

Re: Feature request: Remove fasttrack dummy rule

Mon Jul 20, 2015 1:22 pm

Actually we want MT developers to explain us in DETAIL of how fasttrack works with several examples and clear description.
 
User avatar
macgaiver
Forum Guru
Forum Guru
Posts: 1764
Joined: Wed May 18, 2005 5:57 pm
Location: Sol III, Sol system, Sector 001, Alpha Quadrant

Re: Feature request: Remove fasttrack dummy rule

Mon Jul 20, 2015 3:39 pm

Actually we want MT developers to explain us in DETAIL of how fasttrack works with several examples and clear description.

what is not clear? i think it is straight forward.

Take a look at packet flow diagram:
http://wiki.mikrotik.com/wiki/Manual:Packet_Flow_v6

first packet of the connection tracking goes through the regular routing forward.
all next packets from this connection goes directly from Physical in-interface, to physical out-interface, with some imaginery Fastpath box in the middle. So basically skipping everything in the path.
 
User avatar
macgaiver
Forum Guru
Forum Guru
Posts: 1764
Joined: Wed May 18, 2005 5:57 pm
Location: Sol III, Sol system, Sector 001, Alpha Quadrant

Re: Feature request: Remove fasttrack dummy rule

Mon Jul 20, 2015 3:44 pm

Ok,
a week has passed. Now the result look quite clear.
People here want to be able to switch the dynamic rules off and want each rule to show its values correctly instead those dummy rules.
Normis, what is your answer to this?
There are no normal answers there. 3 or 4 of them are basically implying the same thing.

Answers need to be:
1) Yes, i like dummy rules, i see that they can be useful (not possible in your pool)
2) no, i don't like dummy rules, i thing they sould be disabled
3) Option to disable/enable dummy rules should be implemented
4) i do not care, i just want to see pool results.

Then we can talk about pool objectivity.

I just received my first board from distributors with default configuration that had fasttrack enabled by default, without dummy rules i wouldn't even realize that i fasttrack is implemented already.
 
jarda
Forum Guru
Forum Guru
Topic Author
Posts: 7756
Joined: Mon Oct 22, 2012 4:46 pm

Re: Feature request: Remove fasttrack dummy rule

Mon Jul 20, 2015 9:17 pm

Maybe my questions are not the best questions that could be asked in this topic (and I agree with it), but the message is clear:
- not to force unremovable dummy rules
- show the values on the rules where they belong to

When receiving new device, you should wipe the config rather than searching for the dummy rules. Or is it fasttracking suddenly somehow without fasttrack rules? I doubt it. If there are fasttracking rules, you can see them, so you do not need additional rules that would show you what is already there...
 
Ansy
Frequent Visitor
Frequent Visitor
Posts: 72
Joined: Mon Oct 17, 2011 1:32 pm
Location: Russia
Contact:

Re: Feature request: Remove fasttrack dummy rule

Tue Jul 21, 2015 1:43 pm

Does just renaming that dummy accept rule to account rule solve the problem?
 
User avatar
macgaiver
Forum Guru
Forum Guru
Posts: 1764
Joined: Wed May 18, 2005 5:57 pm
Location: Sol III, Sol system, Sector 001, Alpha Quadrant

Re: Feature request: Remove fasttrack dummy rule

Tue Jul 21, 2015 2:32 pm

Does just renaming that dummy accept rule to account rule solve the problem?
In reality (if you print in console) there are no action at all. I think accept is default value in winbox. and that is only thing that need to be changed.
 
User avatar
G2Dolphin
Member Candidate
Member Candidate
Posts: 164
Joined: Sun May 17, 2015 6:03 pm
Location: Moscow, Russia

Re: Feature request: Remove fasttrack dummy rule

Sat Sep 12, 2015 3:22 am

So... 6.33rc5 now, still no changes on this topic. MikroTik, will you do something with these rules, or they're solid now?
 
User avatar
koshak83
just joined
Posts: 19
Joined: Wed Feb 05, 2014 4:33 pm
Location: Russian Federation, NWFD, Saint-Petersburg Federal City

Re: Feature request: Remove fasttrack dummy rule

Mon Oct 05, 2015 4:13 pm

Seriously, remove this rule. It infuriates. If a user is interested to see this information- he will look it here in Fast Path/Fasttrack section http://demo.mt.lv/webfig/#IP:Settings
 
techieg33k
just joined
Posts: 1
Joined: Fri Oct 30, 2015 7:38 pm

Re: Feature request: Remove fasttrack dummy rule

Fri Oct 30, 2015 10:46 pm

[admin@INCOMPLETE_CONFIGURATION] > :foreach item in=[ /ip firewall filter find ] do { /ip firewall filter remove $item }
failure: cannot remove builtin
[admin@INCOMPLETE_CONFIGURATION] > :foreach item in=[ /ip firewall mangle find ] do { /ip firewall mangle remove $item }
failure: cannot remove builtin
Marting I had the same issue I finally got fixed. I am not sure if you or others finding this post still need a solution, but the below lines are direct replacements for your lines that fail. The following has been tested on 6.32.3 with the following hardware: RB951Ui-2HnD, RB751U 2HnD, and RB751G-2HnD

:foreach item in=[/ip firewall filter find] do={:if ($item != "*8") do={/ip firewall filter remove $item;}}
:foreach item in=[/ip firewall mangle find] do={:if ($item != "*3") do={:if ($item != "*2") do={:if ($item != "*1") do={/ip firewall mangle remove $item;}}}}
 
User avatar
Chupaka
Forum Guru
Forum Guru
Posts: 8709
Joined: Mon Jun 19, 2006 11:15 pm
Location: Minsk, Belarus
Contact:

Re: Feature request: Remove fasttrack dummy rule

Mon Nov 02, 2015 10:54 am

just replace "/ip firewall filter find" with "/ip firewall filter find dynamic=no", using item ids (like "*8") is router-dependent
 
jo2jo
Forum Guru
Forum Guru
Posts: 1003
Joined: Fri May 26, 2006 1:25 am

Re: Feature request: Remove fasttrack dummy rule

Mon Dec 10, 2018 2:23 am

i like the FT dummy rule. there have been a few times ive added fasttrack to older RBs that DONT support it, the ONLY way i was able to notice this was by seeing the dummy rule was not increment at all.

Who is online

Users browsing this forum: RogerWilco and 93 guests