So now that I seem to have figured out (with the help of some good Samaritans) why my firewall wasn't behaving like all the documentation and online help said it should, I can move on to the next part of my learning journey: Queues.

I am assuming (and hopefully correctly) that Queues are MT's version of flow control / policy.

With some more community help, I hope to accomplish the same outcome in two separate ways: rate limiting
I already figured out how to rate limit the download speed (can't control the uplink speed on this particular device).

The last method I need to learn is how to set this on a per-policy or per-session basis. Our VoIP phones all connect to the same IP. Is it possible to give any session that connects to the desired IP a specific amount of bandwidth, while limiting the over all bandwidth of everything else; or is interface-rate limiting my best hope of accomplishing this type of QoS?

There are a number of ways one could tackle this, since each user has a unique IP address, you can look at per connection queuing with a set pool of bandwidth, making sure there is enough left for voice.

1. Another option would be to reserve an amount of bandwidth for the number of concurrent calls you plan to have and provide a guarantee that all traffic to and from the VoIP SBC is reserved. eg. 64kbs * 10 calls = 640Kbs
2. You could use per connection queuing for all data traffic on your WAN. Doing this will provide each use with a slice of bandwidth divisible by the number of users leaving bandwidth for voice. 10Mbs / 5 users = 2Mbs per user or / 10 = 1Mbs per user.
3. Maybe a simple priority queue in place providing all traffic to the SBC is prioritized over all other traffic.

There are a number of ways one could tackle this, since each user has a unique IP address, you can look at per connection queuing with a set pool of bandwidth, making sure there is enough left for voice.

1. Another option would be to reserve an amount of bandwidth for the number of concurrent calls you plan to have and provide a guarantee that all traffic to and from the VoIP SBC is reserved. eg. 64kbs * 10 calls = 640Kbs
2. You could use per connection queuing for all data traffic on your WAN. Doing this will provide each use with a slice of bandwidth divisible by the number of users leaving bandwidth for voice. 10Mbs / 5 users = 2Mbs per user or / 10 = 1Mbs per user.
3. Maybe a simple priority queue in place providing all traffic to the SBC is prioritized over all other traffic.

I am liking options 1 and 3.
1) I could do this via bandwidth settings on the ethernet interfaces themselves (assuming I have all data going through a specific port, and voice going through another). I guess my question would be this: is there a way to set custom bandwidth, or am I stuck to a maximum of 10Mbps ? Some sites have 75/75 connections. Is it possible to set the "data" port to say, 73Mbps, and the "voice" port to 2 Mbps?

3)How would I go about setting up such a queue?

So lets say that my SBC is at IP 192.168.22.24.
What kind of Queue do I setup so that UDP traffic going to and from that address have highest priority going through my Mikrotik?

What you need to do is create a simple queue and set a guaranteed amount of bandwidth but limited to a maximum amount. This means that it will always be given at least this amount if it needs it. If not then other services such as browsing can use the available/unused bandwidth.

A Basic option would be the example below.

Code: Select all

/queue simple
add limit-at=1M/1M max-limit=2M/2M name=Voice target=192.168.22.24/32

So this goes back to my first question a few posts ago: is it possible to set custom limits or am I limited to what options are hard coded into the router? (see my 75Mb example above). Is this queue per-connection, or is that more of a complicated beast?

If I were to psuedo-code this, it sounds like this : all traffic going to 192.168.22.24/32 is guaranteed 1MB of bandwidth, not to exceed 2MB.

Managing traffic can become a complicated exercise, such as using Queue Trees. I'd start with my suggestion and then work from there. Yes you are correct about my example providing a guarantee and a limit.

I'd suggest doing some reading up on Queue Trees and play around with them on a test router. You use Firewall Mangle rules to mark traffic and then using these marks decide on how to control/manipulate it

I'd start with my suggestion and then work from there. Yes you are correct about my example providing a guarantee and a limit.

Is it possible to also add a simple queue that does the same thing for any traffic that originates from the SBC? I don't really see a way to indicate a source address. Or would I need to configure a Mangle filter to prioritize inbound traffic?