The official Mikrotik router thread

[PhireSide]

I am not really gaining anything in theory, but now I have one queue, instead of 16 setup per static ip

At the very least you should have less CPU usage and overhead which should mean better performance, especially since the RB750r2 is a bit older now.

 

[LandyMan]

So public holiday, everyone is still asleep, it gave me the opportunity to waste 8 Gb to fine-tune the settings.
I ended up (on a 100/100 line), with 83Mbps down/63Mbps up config. This gives the best latency results at the highest speed

 

[PsyWulf]

Are you running Docker at all?

You've piqued my interests. Elaborate

 

[Genisys]

What is the performance impact going from ROS6 to ROS7? I want to upgrade my router but still a little hesitant at the moment

 

[PhireSide]

You've piqued my interests. Elaborate

I was going to ask if you knew about Grafolean, which is a tool you can use to pull Traffic Flow (NetFlow) data from the Mikrotik into a dashboard using Postgres and Mosquitto

 

[PsyWulf]

I was going to ask if you knew about Grafolean, which is a tool you can use to pull Traffic Flow (NetFlow) data from the Mikrotik into a dashboard using Postgres and Mosquitto

Well you didn't ask me originally but I'm interested in a workable option like this too thanks

 

[LandyMan]

So public holiday, everyone is still asleep, it gave me the opportunity to waste 8 Gb to fine-tune the settings.
I ended up (on a 100/100 line), with 83Mbps down/63Mbps up config. This gives the best latency results at the highest speed
View attachment 1298958

Interestingly, I notices some major ping spikes and packet drops while gaming last night ... Now I am not sure if it is related to my changes, or if my line was shitting itself during that time

 

[yogidabear]

Interestingly, I notices some major ping spikes and packet drops while gaming last night ... Now I am not sure if it is related to my changes, or if my line was shitting itself during that time

Did you do a trace or ping to another IP to check if it was you or the game server? If you have the old compact export you can copy paste the old queues in to check as well.

I do not game, but use VoIP extensively all day to a couple servers and have no voice issues since I moved over to a single fq codel queue. Where like you previously I had specific queues for that

 

[LandyMan]

Did you do a trace or ping to another IP to check if it was you or the game server? If you have the old compact export you can copy paste the old queues in to check as well.

I do not game, but use VoIP extensively all day to a couple servers and have no voice issues since I moved over to a single fq codel queue. Where like you previously I had specific queues for that

LOL, I was in the middle of a game, and my PC is wwwaaayyy on the other side of the house. I might run a winMTR session for some time over the weekend to see what the spikes potentially look like
Will keep an eye on it for the next couple of days. All the original queues are still there (just disabled), so I can revert if I need to

 

[LandyMan]

So I took off the codel queue. It did not do what I wanted it to do. The ping spikes and packet drops happen when my son is busy running updates. So he basically flatlines the link, with the rest of the devices suffering (not splitting available bandwidth between all devices equally)

 

[giggity]

Has anyone set up ZeroTier on their MikroTik router? I want to set it up for remote access

So I took off the codel queue. It did not do what I wanted it to do. The ping spikes and packet drops happen when my son is busy running updates. So he basically flatlines the link, with the rest of the devices suffering (not splitting available bandwidth between all devices equally)

Something is wrong with your setup then. Check that the queue is actually taking effect. Is there traffic flowing through it?

 

[LandyMan]

Has anyone set up ZeroTier on their MikroTik router? I want to set it up for remote access

Something is wrong with your setup then. Check that the queue is actually taking effect. Is there traffic flowing through it?

Yep, and it hits red in the Mikrotik app, meaning it is being throttled

 

[PhireSide]

Yep, and it hits red in the Mikrotik app, meaning it is being throttled

It might be worth looking into giving him a static IP, then applying a static queue of, say, no more than 65mbps to his IP? That should apply an overall queue to all the traffic but also make sure that he cannot draw down more than a certain mbps which should at least keep your network stable.

I know static IPs are easy to bypass but it's not like you want to block him from the internet or anything, you are just making sure he doesn't make it unpleasant for everyone else on the network.

Eg:

[phireside@MikroTik] > /queue simple/ print
Flags: X - disabled, I - invalid; D - dynamic
 0 I  name="fq_codel" target=pppoe0 parent=none packet-marks="" priority=8/8
      queue=fq_codel/fq_codel limit-at=0/0 max-limit=28M/28M
      burst-limit=30M/30M burst-threshold=0/0 burst-time=3s/3s
      bucket-size=0.1/0.1 total-queue=fq_codel
      time=6h30m-22h,sun,mon,tue,wed,thu,fri,sat

 1    name="Limit 10.0.0.10 to 5mbps" target=pppoe0 dst=10.0.0.10/32 parent=none
      packet-marks="" priority=8/8 queue=default-small/default-small
      limit-at=0/0 max-limit=5M/5M burst-limit=0/0 burst-threshold=0/0
      burst-time=0s/0s bucket-size=0.1/0.1

 

[LandyMan]

It might be worth looking into giving him a static IP, then applying a static queue of, say, no more than 65mbps to his IP? That should apply an overall queue to all the traffic but also make sure that he cannot draw down more than a certain mbps which should at least keep your network stable.

I know static IPs are easy to bypass but it's not like you want to block him from the internet or anything, you are just making sure he doesn't make it unpleasant for everyone else on the network.

Eg:

View attachment 1300708

[phireside@MikroTik] > /queue simple/ print
Flags: X - disabled, I - invalid; D - dynamic
0 I name="fq_codel" target=pppoe0 parent=none packet-marks="" priority=8/8
queue=fq_codel/fq_codel limit-at=0/0 max-limit=28M/28M
burst-limit=30M/30M burst-threshold=0/0 burst-time=3s/3s
bucket-size=0.1/0.1 total-queue=fq_codel
time=6h30m-22h,sun,mon,tue,wed,thu,fri,sat

1 name="Limit 10.0.0.10 to 5mbps" target=pppoe0 dst=10.0.0.10/32 parent=none
packet-marks="" priority=8/8 queue=default-small/default-small
limit-at=0/0 max-limit=5M/5M burst-limit=0/0 burst-threshold=0/0
burst-time=0s/0s bucket-size=0.1/0.1

Thanks. Already have static IPs and queues setup for devices that can potentially kill the line, so just had to re-enable them

 

[PhireSide]

Thanks. Already have static IPs and queues setup for devices that can potentially kill the line, so just had to re-enable them

@B-127 had a clever idea and that is to use a Mangle rule to mark packets to/from the PC's mac address and mark the packets with a tag. This way you don't need to worry about the IP address changing. It won't do anything for mac spoofing, but it may be more reliable to block via the mac than the IP.

Then, with Queues, you can apply the queue to only packets matching that packet mark.

EDIT: It becomes a bit tricky because you need to have a prerouting Mangle rule marking the Connection from srcmac as, in my example, named Throttle_MC, and then you also have to have a prerouting Mangle rule marking all traffic matching the Throttle_MP connection mark with an action of Mark Packet. If you just mark the packets, it will only end up throttling the uploaded packets, not the ones coming from WAN into the device.

Firewall config:

 3    chain=prerouting action=mark-packet new-packet-mark=Throttle_MP passthrough=yes connection-mark=Throttle_MC log=no log-prefix=""

 4    chain=prerouting action=mark-connection new-connection-mark=Throttle_MC passthrough=yes src-mac-address=##:##:##:##:##:## log=no log-prefix=""

Queue config:

 1    name="Throttle_Q" target=pppoe0 parent=none packet-marks=Throttle_MP priority=8/8 queue=default-small/default-small limit-at=0/0 max-limit=5M/5M burst-limit=0/0 burst-threshold=0/0 burst-time=0s/0s
      bucket-size=0.1/0.1

Speedtest:

 

[AfricanTech]

Can't you achieve the same outcome using the kid control function?

 

[PhireSide]

Can't you achieve the same outcome using the kid control function?

I've tried it myself but I couldn't get it to work properly. Limits would be in place, but the actual speeds don't match what was set in the kid-control function.

No idea if maybe something else is wrong or misconfigured.

 

[AfricanTech]

I've tried it myself but I couldn't get it to work properly. Limits would be in place, but the actual speeds don't match what was set in the kid-control function.

No idea if maybe something else is wrong or misconfigured.

If I remember correctly the limits have a 'burst' ability and you need to configure that as well. I don't use it anymore 'cos my teenagers PC and Console connect wirelessly and I use the Ubiquiti Controller to manage bandwidth limits rather than directly on the router.

 

[Naks]

Chaps, I'm hoping someone here can help me with this issue I'm having with a brand new AC2 router.

I am trying to port forward on 3 specific ports to a PC on my LAN, and I've watched a dozen YT videos and read numerous guides, but I cannot get it to work.

I've created the following NAT rules:

add action=dst-nat chain=dstnat comment="Open port 9191" \ dst-address=MyPublicIP dst-port=9191 protocol=tcp to-addresses=\ MyPCIP to-ports=9191
add action=dst-nat chain=dstnat comment="Open port 9595" \ dst-address=MyPublicIP dst-port=9595 protocol=tcp to-addresses=\ MyPCIP to-ports=9595
add action=dst-nat chain=dstnat comment="Open port 9898" \ dst-address=MyPublicIP dst-port=9898 protocol=tcp to-addresses=\ MyPCIP to-ports=9898

None of these work, whether I try to access with the MyPublicIP or a hostname (DDNS).

I've even reset it to default and started from scratch, still no luck.

Help please?

 

[PsyWulf]

Chaps, I'm hoping someone here can help me with this issue I'm having with a brand new AC2 router.

I am trying to port forward on 3 specific ports to a PC on my LAN, and I've watched a dozen YT videos and read numerous guides, but I cannot get it to work.

I've created the following NAT rules:

add action=dst-nat chain=dstnat comment="Open port 9191" \ dst-address=MyPublicIP dst-port=9191 protocol=tcp to-addresses=\ MyPCIP to-ports=9191
add action=dst-nat chain=dstnat comment="Open port 9595" \ dst-address=MyPublicIP dst-port=9595 protocol=tcp to-addresses=\ MyPCIP to-ports=9595
add action=dst-nat chain=dstnat comment="Open port 9898" \ dst-address=MyPublicIP dst-port=9898 protocol=tcp to-addresses=\ MyPCIP to-ports=9898

None of these work, whether I try to access with the MyPublicIP or a hostname (DDNS).

I've even reset it to default and started from scratch, still no luck.

Help please?

Why are you using dst-address (instead of interface in if anything)?