Limiting a user to a given amount of traffic II

jlct021 · Thu Nov 29, 2012 8:04 am

To try get this script working:

http://wiki.mikrotik.com/wiki/Limiting_ ... traffic_II

:local traf;
/queue simple
  :for i from=1 to= 254 do =  {
    :if ([/queue simple find target-addresses=("192.168.1." . $i)] != "") do={
      :set traf [get [find target-addresses=("192.168.1." . $i)] total-bytes]
      :if ($traf  > 104857600) do = {
        set [find target-addresses=("192.168.1." . $i)] max-limit= 32000/64000
      }
    }
  }

Ive done the following:

1) I created a simple queue:

/queue simple print
Flags: X - disabled, I - invalid, D - dynamic
 0    name="queue1" target-addresses=172.18.88.192/28 interface=all parent=none
      packet-marks="" direction=both priority=8
      queue=default-small/default-small limit-at=0/0 max-limit=0/0
      burst-limit=0/0 burst-threshold=0/0 burst-time=0s/0s
      total-queue=default-small

2) Edited the script to match my subnet: (limits very low just to test) and added via Winbox

/system script print                                        Flags: I - invalid                                               
 0   name="test" owner="test"
     policy=ftp,reboot,read,write,policy,test,winbox,password,sniff,sensitive,
       api
     last-started=nov/19/2012 21:35:11 run-count=22 source=
       :local traf;
         :for i from=192 to=206 do =  {
           :if ([/queue simple find target-addresses=("172.18.88." . $i)] != "") do={
             :set traf [get [find target-addresses=("172.18.88." . $i)] total-bytes]
             :if ($traf  > 1) do = {
               set [find target-addresses=("172.18.88." . $i)] max-limit= 1/1
             }
           }

3) Scheduled the task to run every 1min (agian just to test for now)

/system scheduler> /system schedule print
Flags: X - disabled
 #   NAME   START-DATE  START-TIME   INTERVAL             ON-EVENT    RUN-COUNT
 0   sch... nov/19/2012 19:50:41     1m                   /system...          25

Yet the script appears to be having no effect. Have tried changing my simpe queue to just that of my current ip rather than the entire /28 subnet with no effect. (Have also checked others posts on the forum relating to the script)

Any pointers?

skot · Thu Nov 29, 2012 11:14 pm

What version of RouterOS are you running? I think the example script you've found is from an older version, and there are other problems.

1. The original script has syntax issues. There are a couple places where there should be no spaces. Example ":for i from=1 to= 254 do = {"

2. Also, the script won't find the IP addresses unless a subnet mask is specified. In the simple queue, it might only show up as 172.18.88.50, but the script finds it as 172.18.88.50/32.

3. Your final script is missing the /queue simple code at the top

Fixing these things worked for me on v5.14:

:local traf;
/queue simple
:for i from=192 to=206 do={
	:if ([/queue simple find target-addresses=("172.18.88." . $i . "/32")] != "") do={
		:set traf [get [find target-addresses=("172.18.88." . $i . "/32")] total-bytes]
		:if ($traf  > 200) do={
			:set [find target-addresses=("172.18.88." . $i . "/32")] max-limit= 1/1
		}
	}
}

jlct021 · Fri Nov 30, 2012 3:06 am

What version of RouterOS are you running?

 /system resource> print
    version: 5.22

1. The original script has syntax issues. There are a couple places where there should be no spaces. Example ":for i from=1 to= 254 do = {"

2. Also, the script won't find the IP addresses unless a subnet mask is specified. In the simple queue, it might only show up as 172.18.88.50, but the script finds it as 172.18.88.50/32.

3. Your final script is missing the /queue simple code at the top

In addition to your suggestions I tried changing ":for i from=192 to=206 do={" to ":for i from=193 to=206 do={" as 192 is the broadcast address.

 /system script print  
Flags: I - invalid 
 0   name="script1" owner="test" 
     policy=ftp,reboot,read,write,policy,test,winbox,password,sniff,sensitive,
       api 
     last-started=nov/30/2012 01:23:19 run-count=4 source=
       :local traf;
       /queue simple
       :for i from=193 to=206 do={
          :if ([/queue simple find target-addresses=("172.18.88." . $i . "/32")] !
= "") do={
             :set traf [get [find target-addresses=("172.18.88." . $i . "/32")] to
tal-bytes]
             :if ($traf  > 200) do={
                :set [find target-addresses=("172.18.88." . $i . "/32")] max-limit
= 1/1
             }
          }
       }

 /queue simple print
 1    name="queue1" target-addresses=172.18.88.192/28 interface=all parent=none 
      packet-marks="" direction=both priority=8 
      queue=default-small/default-small limit-at=0/0 max-limit=0/0 
      burst-limit=0/0 burst-threshold=0/0 burst-time=0s/0s 
      total-queue=default-small

Tried changing simple queue target address to just that of my current IP:

/queue simple print
 1    name="queue1" target-addresses=172.18.88.205/32 interface=all parent=none 
      packet-marks="" direction=both priority=8 
      queue=default-small/default-small limit-at=0/0 max-limit=0/0 
      burst-limit=0/0 burst-threshold=0/0 burst-time=0s/0s 
      total-queue=default-small

Still no result...

Is

 /system script print 
Flags: I - invalid

an indication ROS isn't happy with the script?

skot · Fri Nov 30, 2012 5:19 am

Sorry, I had a typo. There should not be a semi-colon before the last "set"

:local traf;
/queue simple
:for i from=192 to=206 do={
   :if ([/queue simple find target-addresses=("172.18.88." . $i . "/32")] != "") do={
      :set traf [get [find target-addresses=("172.18.88." . $i . "/32")] total-bytes]
      :if ($traf  > 200) do={
         set [find target-addresses=("172.18.88." . $i . "/32")] max-limit= 1/1
      }
   }
}

There might be another issue as well. The simple queues don't seem to work for me when set to default-small. After I change to default (3 places), they work ok.

/queue simple print
 1    name="queue1" target-addresses=172.18.88.205/32 interface=all parent=none
      packet-marks="" direction=both priority=8
      queue=default/default limit-at=0/0 max-limit=0/0
      burst-limit=0/0 burst-threshold=0/0 burst-time=0s/0s
      total-queue=default

jlct021 · Sat Dec 01, 2012 7:45 am

Thank you

The network I intend to use this on is a /24

Is there a way to apply the script to a sigle simple queue with a /24 target address?

Or must a simple queue be created for each address on that subnet?

Simple queue for each IP is the only way I've been able to get it to work so far.

skot · Sat Dec 01, 2012 8:29 pm

Is there a way to apply the script to a sigle simple queue with a /24 target address?

Yes. Change the script in 3 places:

:local traf;
/queue simple
:for i from=192 to=206 do={
   :if ([/queue simple find target-addresses=("172.18.88." . $i . "/24")] != "") do={
      :set traf [get [find target-addresses=("172.18.88." . $i . "/24")] total-bytes]
      :if ($traf  > 200) do={
         set [find target-addresses=("172.18.88." . $i . "/24")] max-limit= 1/1
      }
   }
}

jlct021 · Sun Dec 02, 2012 1:21 pm

Thanks

In addition I also changed

:for i from=192 to=206 do={

to include the broadcast ip after which it ran.

However it seems I'm still facing the problem of needing separate /32 simple queues for each user i want to limit.

I say this because when I run the script:

/system script print
Flags: I - invalid 
 1   name="/24" owner="admin" policy=ftp,reboot,read,write,policy,test,winbox,password,sniff,sensitive,api last-started=dec/02/2012 13:24:46 run-count=18 
     source=
       :local traf;
       /queue simple
       :for i from=0 to=255 do={
          :if ([/queue simple find target-addresses=("192.168.88." . $i . "/24")] != "") do={
             :set traf [get [find target-addresses=("192.168.88." . $i . "/24")] total-bytes]
             :if ($traf  > 200) do={
                set [find target-addresses=("192.168.88." . $i . "/24")] max-limit= 65536/65536
             }
          }
       }

against my simple queue:

 /queue simple print
Flags: X - disabled, I - invalid, D - dynamic 
  1    name="/24" target-addresses=192.168.88.0/24 interface=all 
      parent=none packet-marks="" direction=both priority=8 
      queue=default/default limit-at=0/0 max-limit=0/0 
      burst-limit=0/0 burst-threshold=0/0 burst-time=0s/0s 
      total-queue=default

and the limit get applied as it should:

/queue simple print
Flags: X - disabled, I - invalid, D - dynamic 
 1    name="/24" target-addresses=192.168.88.0/24 interface=all 
      parent=none packet-marks="" direction=both priority=8 
      queue=default/default limit-at=0/0 max-limit=65536/65536 
      burst-limit=0/0 burst-threshold=0/0 burst-time=0s/0s 
      total-queue=default

All users regardless of how much they themselves have or haven't used get throttled along with it. The script is limiting the subnet as a whole, not individual users.

Without creating separate /32 simple queue's for each user on the subnet is it possible to limit only users who've exceeded their individual limits rather than the subnet as a whole?

The script is for a coffee shop that gives free wifi to customers after a purchase. They authenticate using a WPA2 key that gets changed by staff each morning. I've lowered the signal strength to try cover just the shop space but the system is (not surprisingly) still being abused.

skot · Mon Dec 03, 2012 8:34 am

Without creating separate /32 simple queue's for each user on the subnet is it possible to limit only users who've exceeded their individual limits rather than the subnet as a whole?

I don't know how you would track each individual's limits without separate queues.

Have you used the hotspot feature in the RouterOS? I wonder if it might be helpful for what you are doing. You can configure default rx/tx rate limits for hotspot users, and a new dynamic queue is created for each one. With the individual queues in place, you could use a script to loop through all hotspot queues, check bytes and change the queue accordingly.

There could be other ways to do this, but the hotspot setup is the only one I'm familiar with.

jlct021 · Tue Dec 11, 2012 7:50 pm

Havn't tried Hotspot / Usermanager yet. (Want to limit staff having to do anything more than changing WPA2 key daily if possible)

Ended up creating a /27 LAN subnet (DHCP lease of 3hours) with 29 simple que's.

script1 every 2.5 minutes limiting users to 75/75kbps if they exeed a 100mb total.
script2 every 2.5 minutes (after script1) limiting users to 10/10kbps if they exeed 125mb total.
script3 every 4 hours (after script1,2) resets all users with totals over 1kb back to 4mbps.
script4 every 4 hours (after script 1,2,3) resets all users with total of 0 back to 4mbps (rb reboots leave limited users limited otherwise)
script5 every 4 hours (after script1,2,3,4) resests all counters. (/que simple reset-counters) but doesnt reset limits hence script3,4

Still checking on it every 8 hours or so but for most part seems to be working.

Is open to abuse by users giving themselves (as yet not limited) static IP's (rinse repeat)

But better than no limiting at all for now.

Thanks again

EarthStation · Thu Dec 13, 2012 8:30 am

Is open to abuse by users giving themselves (as yet not limited) static IP's (rinse repeat)

But better than no limiting at all for now.

Thanks again

You could set the arp to "reply-only" on the AP interface, which will ensure that only DHCP issued addresses are allowed to operate. Will block all non-DHCP addresses.

lizaman2010 · Thu Apr 04, 2013 8:51 am

[*]I got an error, take a look please

[/color]

Thu Apr 04, 2013 12:39 pm

[*]I got an error, take a look please

[/color]

paste the script into the script editor, not the console command line

Limiting a user to a given amount of traffic II

Limiting a user to a given amount of traffic II

Re: Limiting a user to a given amount of traffic II

Re: Limiting a user to a given amount of traffic II

Re: Limiting a user to a given amount of traffic II

Re: Limiting a user to a given amount of traffic II

Re: Limiting a user to a given amount of traffic II

Re: Limiting a user to a given amount of traffic II

Re: Limiting a user to a given amount of traffic II

Re: Limiting a user to a given amount of traffic II

Re: Limiting a user to a given amount of traffic II

Re: Limiting a user to a given amount of traffic II

Re: Limiting a user to a given amount of traffic II

Who is online