Community discussions

MikroTik App
 
dorde
just joined
Topic Author
Posts: 13
Joined: Wed Mar 29, 2006 10:02 pm

PCQ classifier is not working well with masquerade

Sun Aug 06, 2006 10:22 am

I’ll explain problem on the simple example:

Let’s say that we have router with two Ethernet cards. One is internal and one external. And want to use it for bandwidth limiting and src-nat. If we use the example from the manual, shown below, and add src-nat rule to external card, every user will upload using same upload PCQ sub queue since source address is now masqueraded hence it is same source IP for all users and PCQ classifier is not working well.
/ip firewall mangle add chain=forward src-address=192.168.0.0/24 \
action=mark-connection new-connection-mark=users-con
/ip firewall mangle add connection-mark=users-con action=mark-packet \
new-packet-mark=users chain=forward

/queue type add name=pcq-download kind=pcq pcq-classifier=dst-address
/queue type add name=pcq-upload kind=pcq pcq-classifier=src-address

/queue tree add name=Download parent=Local max-limit=10240000
/queue tree add parent=Download queue=pcq-download packet-mark=users

/queue tree add name=Upload parent=Public max-limit=2048000
/queue tree add parent=Upload queue=pcq-upload packet-mark=users
My situation is different only because I use limited PCQ to limit user bandwidth (pcq-rate). That’s how I noticed that two users are using the same PCQ sub queue. When one user is uploading upload speed is then limited by PCQ rate, but if second user begin uploading than both users are uploading at half of the limit even if there is available bandwidth.
Note that download is working well because PCQ classifier is working.
I tried to use simple queues (PCQ type) and it is working well!!! But I would like to know how this can be done with queue tree. Can anyone help?

Thank you for your effort.
 
dorde
just joined
Topic Author
Posts: 13
Joined: Wed Mar 29, 2006 10:02 pm

Tue Aug 08, 2006 9:25 pm

From now on I will not post long questions :x
 
User avatar
Eugene
Forum Veteran
Forum Veteran
Posts: 986
Joined: Mon May 31, 2004 5:06 pm
Location: Cranfield, UK

Wed Aug 09, 2006 4:05 pm

Long questions are Good Thing (tm). They sometimes deserve long answers.

The reason for what you are experiencing is that simple queues attach to global-in and global-out interfaces, which allows them to see unmodified source addresses:
Image

You could do the same with queue trees, too.

Eugene

Who is online

Users browsing this forum: BartoszP, DanMos79, robertkjonesjr, VinceKalloe and 102 guests