Tips and Tricks for Beginners and Experienced Users of RouterOS

This page contains various tips and tricks for RouterOS users, both beginners and experienced ones. Each subject depends on RouterOS version and might change from one version to another.

Note: This article is work in progress

Ease load on firewall by using no-mark as a mark for packets, connections and routing

When a packet travels through the firewall it is checked against each rule until it matches one (except when passthrough action is used). If you use rules which have action mark-packet, mark-connection and mark-routing, then it is worth to set additional matcher as no-mark for the related parameter. It will allow for the firewall to decide sooner if the packet matches this rule and also will allow for you to avoid re-marking.

Example script which should configure router as explained before (written on 6.34.3 RouterOS):

foreach mrk in=("packet","connection","routing") do={
  {
    foreach i in=([/ip firewall mangle find where action=("mark-" . $mrk)]) do={
      local cmd ("ip firewall mangle set " . $i . " " . $mrk . "-mark=no-mark")
      :execute $cmd
    }
  }
}

Ease load on firewall by sorting firewall filter, NAT and mangle rules

When a packet travels through the firewall it is checked against each rule until it matches one (except when passthrough action is used). It means that CPU load and packet processing speed depends on it. There is a very simple way how to ease the load on firewall filter, NAT and mangle rules - sorting. Based on the action, without breaking logical order, you should sort your firewall rules by checking packet count on statistics for each independent rule. Move rules which have more packets matched up and those who have been matched more rarely move down. Remember that you always have to be sure that logical order of rules is not affected by this sorting.

If something does not work, then maybe it is like that on purpose

In the RouterOS there is a feature called FastTrack. It makes connections even faster if it is enabled and correctly configured. Very often people are complaining that their queues or other features do not work. Make sure that FastTrack is not being accepted for the same traffic. Learn about the feature you use before you use it.
http://wiki.mikrotik.com/wiki/Manual:Wiki/Fasttrack

Note: At the moment (6.34.3) FastTrack works only with UDP/TCP IPv4 traffic. In most cases you can easily test your configuration by using ping. If ping works and TCP/UDP does not, then it is very believable that FastTrack is here to blame

Make sure that interface names are correct

Quite often after using different kinds of scripts or for any other reason interfaces on the router are renamed. If you are trying to configure something on the interface and it does not work as suspected, make sure that you are trying to configure correct one.

Example command which should show correct interface names (written on 6.34.3 RouterOS):

[admin@MikroTik] > interface export 
/interface ethernet
set [ find default-name=ether3 ] name=ether1
set [ find default-name=ether1 ] name=ether3

Limits specified on parent Simple Queue are not working

In RouterOS if you have Simple Queues with child queues, then you have to remember that after parent queue matches some kind of traffic the same traffic will be again checked by child queues. It means that you have to cover entire set of packets which are captured by parent and there is an easy way to do it by using the copy of parent as a child.

Example which shows how to correctly create child Simple Queue (written on 6.34.3 RouterOS).

This is not correct because only packets with address 192.168.88.1 will be limited by queues:

/queue simple
add max-limit=100M/100M name=GLOBAL target=192.168.88.0/24
add max-limit=10M/10M name=child1 parent=GLOBAL target=192.168.88.2/32

To fix this problem you have to add another child queue which would be copy of parent without specified limits:

/queue simple
add max-limit=100M/100M name=GLOBAL target=192.168.88.0/24
add max-limit=10M/10M name=child1 parent=GLOBAL target=192.168.88.2/32
add name=child2 parent=GLOBAL target=192.168.88.0/24

Queue slows down router

In the RouterOS, each Simple Queue works on single CPU core.

Example which shows how to ease the load on Simple Queue on multi-core systems (written on 6.34.3 RouterOS).

This queue will work on single core and will not work as fast as it would be possible:

/queue simple
add max-limit=100M/100M name=queue1 target=192.168.88.1/32,192.168.88.2/32

This queue will work on two CPU cores and will work better compared to previous queue (of course you have to be sure that limit is proper for you):

/queue simple
add max-limit=50M/50M name=queue2 target=192.168.88.1/32
add max-limit=50M/50M name=queue3 target=192.168.88.2/32

Myth about the reboot

Very often people say that problem disappeared after the reboot. In most cases it actually is not true. Reboot does many things, for example, clears DNS cache, clears different dynamic entries and so on. If the reboot helped in your case, you should think what on your device is configured and what of it is cleared by the reboot. Then you can try to trace the real reason.

Create static bindings for PPP interfaces

If you do not like that your PPP interfaces are dynamic, then you can on PPP profile execute the on-up script which creates static server binding for each client.

Example is made for PPPoE interfaces, but it can be easily adjusted for any other PPP interface types (written on 6.34.3 RouterOS):

if ([/interface pppoe-server print count-only where user=$user && !dynamic] = 0) do={
  log info message=($user . " - is being added as static binding")
  /interface pppoe-server add name=$user user=$user service=service1
  /ppp active remove [find where name=$user]
}

Note: Last command within script will disconnect client at first time authentication

Block specific domains by using scripts

At the moment, it is not possible to block access for the specific domain on RouterOS. The only way to do it is to know IP addresses used by concrete domain and blocking them by using the firewall. The idea is - find out addresses, add them to address list and drop packets destined for these addresses. Since addresses usually are dynamic, you have to refresh them periodically. For such purposes, there is a script which will implement needed configuration. All you need to do is create scheduler which refreshes these addresses time to time.

Example show how to block access to facebook.com and youtube.com (written on 6.34.3 RouterOS):

#Script to add IP addresses for specific domains to address lists
{
#Array of desired domain names
 foreach iplist in=("youtube","facebook") do={
  {
#Old entries are deleted
  /ip firewall address-list remove [find where list=$iplist]
#Dummy variable to not get into loop
  global counter true
#Check if IP addresses are not repeating themselves
   while ($counter) do={
#Resolve domain
    local ip [/resolve ("www.".$iplist.".com")]
#Add IP to address list under specific domain list if it does not already exist
    if ([len [/ip firewall address-list find where address=$ip]] = 0) do={
     /ip firewall address-list add address=$ip list=$iplist } else={
#If IP already exist in list then stop resolving this domain
     set counter false
    }
   }
  }
#If there is no firewall filter rules which blocks this specific domain then add it
  if ([:len [/ip firewall filter find where chain=forward && dst-address-list=$iplist]] = 0) do={
   /ip firewall filter add chain=forward action=drop dst-address-list=$iplist place-before=0 \ 
    comment=("This rule blocks access to " . $iplist)
  }
 }
}

Note: This will work only with IPv4 traffic

[ Top | Back to Content ]