如何利用mikrotik队列控制带宽

Question

我有一个mikrotik路由器，我想限制无线局域网用户的速度。我为target = wlan创建了一个队列，并设置了下限和upload = 64k，但是当我测试它时，它似乎不能正常工作！测试下载速度>500 K。路由器配置是默认的。我该怎么做？

/interface bridge
add admin-mac=E4:8D:8C:46:C7:0F auto-mac=no comment=defconf name=bridge
/interface wireless
set [ find default-name=wlan1 ] band=2ghz-b/g/n channel-width=20/40mhz-Ce \
    disabled=no distance=indoors frequency=auto mode=ap-bridge ssid=PNG1 \
    wireless-protocol=802.11
/interface ethernet
set [ find default-name=ether2 ] name=ether2-master
set [ find default-name=ether3 ] master-port=ether2-master
set [ find default-name=ether4 ] master-port=ether2-master
set [ find default-name=ether5 ] master-port=ether2-master
/ip neighbor discovery
set ether1 discover=no
set bridge comment=defconf
/interface wireless security-profiles
set [ find default=yes ] authentication-types=wpa-psk,wpa2-psk mode=\
    dynamic-keys wpa-pre-shared-key=noor3664 wpa2-pre-shared-key=noor3664
/ip hotspot profile
add dns-name=so.zzz hotspot-address=10.5.50.1 login-by=http-pap name=hsprof1 \
    use-radius=yes
/ip pool
add name=dhcp ranges=192.168.88.10-192.168.88.254
add name=hs-pool-2 ranges=10.5.50.2-10.5.50.254
/ip dhcp-server
add address-pool=dhcp authoritative=after-10sec-delay disabled=no interface=\
    bridge name=defconf
add address-pool=hs-pool-2 interface=ether2-master lease-time=1h name=dhcp1
/ip hotspot
add address-pool=hs-pool-2 addresses-per-mac=1 interface=ether2-master name=\
    hotspot1 profile=hsprof1
/ip hotspot user profile
add address-pool=hs-pool-2 advertise=yes advertise-interval="" advertise-url="" \
    name=uprof1 open-status-page=http-login transparent-proxy=yes
/queue type
set 0 pfifo-limit=200
/queue interface
set ether2-master queue=default-small
/queue simple
add limit-at=30k/30k max-limit=30k/30k name=queue1 queue=default/default \
    target=bridge total-queue=default
/interface bridge port
add bridge=bridge comment=defconf interface=ether2-master
add auto-isolate=yes bridge=bridge interface=wlan1
/ip address
add address=192.168.88.1/24 comment=defconf interface=bridge network=\
    192.168.88.0
add address=10.5.50.1/24 comment="hotspot network" interface=ether2-master \
    network=10.5.50.0
/ip dhcp-client
add comment=defconf dhcp-options=hostname,clientid disabled=no interface=ether1
/ip dhcp-server network
add address=10.5.50.0/24 comment="hotspot network" gateway=10.5.50.1
add address=192.168.88.0/24 comment=defconf gateway=192.168.88.1
/ip dns
set allow-remote-requests=yes servers=4.2.2.4
/ip dns static
add address=10.5.50.1 name=router
/ip firewall filter
add chain=input comment="defconf: accept ICMP" protocol=icmp
add chain=input comment="defconf: accept established,related" connection-state=\
    established,related
add action=drop chain=input comment="defconf: drop all from WAN" in-interface=\
    ether1
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" \
    connection-state=established,related
add chain=forward comment="defconf: accept established,related" \
    connection-state=established,related
add action=drop chain=forward comment="defconf: drop invalid" connection-state=\
    invalid
add action=drop chain=forward comment=\
    "defconf:  drop all from WAN not DSTNATed" connection-nat-state=!dstnat \
    connection-state=new in-interface=ether1
/ip firewall nat
add action=masquerade chain=srcnat comment="defconf: masquerade" out-interface=\
    ether1
add action=masquerade chain=srcnat comment="masquerade hotspot net
    src-address=10.5.50.0/24
add action=masquerade chain=srcnat comment="masquerade hotspot net
    src-address=10.5.50.0/24
add action=masquerade chain=srcnat comment="masquerade hotspot net
    src-address=10.5.50.0/24
/ip hotspot user
add name=admin
/radius
add address=192.168.88.1 service=hotspot
add address=192.168.88.1 service=hotspot
/system clock
set time-zone-name=Asia/Tehran
/system leds
set 0 interface=wlan1
/system routerboard settings
set protected-routerboot=disabled
/tool mac-server
set [ find default=yes ] disabled=yes
add interface=bridge
/tool mac-server mac-winbox
set [ find default=yes ] disabled=yes
add interface=bridge
[admin@MikroTik] > 

Answer 1

禁用防火墙上的任何快速跟踪规则。

快速轨道将绕过几乎整个堆栈--包括队列。

文档中非常清楚地提到了这一点。

http://wiki.mikrotik.com/wiki/Manual:Wiki/Fasttrack

Description IPv4 FastTrack处理程序自动用于标记连接。使用防火墙操作“快速通道连接”标记连接的快车道。目前只有TCP和UDP连接可以被快速跟踪(即使任何连接都可以标记为快速通道)。IPv4 FastTrack处理程序支持NAT (SNAT、DNAT或两者都支持)。请注意，并不是连接中的所有数据包都可以被快速跟踪，因此很可能会看到一些数据包通过慢速路径，即使连接被标记为快速通道。这就是为什么快速连接通常遵循相同的action=accept规则.快速跟踪数据包绕过防火墙、连接跟踪、简单队列、带有parent=global的队列树、ip流量(6.33中取消的限制)、ip计费、ipsec、热点通用客户端、vrf分配，因此要由管理员确保快速跟踪不干扰其他配置；

Answer 2

您需要使用PCQ的简单队列来控制所有(或特定范围)用户的带宽。以下是一个例子：

/ip firewall address-list
add address=10.0.0.20-10.0.0.255 list=USER_LIST

# Marking packets going to USER_LIST
/ip firewall mangle
add action=mark-connection chain=prerouting comment="MARK CONN USER_LIST" src-address-list=USER_LIST new-connection-mark=user_conn passthrough=yes
add action=mark-packet chain=prerouting comment="MARK PKTS USER_LIST" connection-mark=user_conn new-packet-mark=user_pkts passthrough=yes

# Creating PCQ base Queue - 512k per user
/queue type
add kind=pcq name=user-download-512k pcq-classifier=dst-address pcq-dst-address6-mask=64 pcq-rate=512k pcq-src-address6-mask=64
add kind=pcq name=user-upload-512k pcq-classifier=src-address pcq-dst-address6-mask=64 pcq-rate=512k pcq-src-address6-mask=64

#- Make sure you move this simple queue on TOP, or else it will not work
/queue simple
add comment="Allow 512k Down/up per user by zaib" name="512k per user" packet-marks=user_pkts queue=user-upload-512k/user-download-512k target=""

这里有更多信息.队列示例