How to Limit WiFi Speed ​​on MikroTik: Traffic Management

With the growing number of connected devices and consumption of heavy media content, managing wireless network bandwidth is becoming a critical task for an administrator. WiFi speed limitation On MikroTik equipment, it not only allows for fair channel distribution among users, but also prevents performance degradation of critical services due to the actions of a single active subscriber. Without proper configuration Queue Tree or simple queues, even a powerful router may not be able to handle the data flow from torrents or video streaming.

The RouterOS traffic management system offers flexible tools for implementing QoS (Quality of Service) policies. You can set a hard limit in megabits for a specific guest, allocate guaranteed bandwidth for video conferences, or simply throttle background speeds for IoT devices. Understanding how it works Simple Queues and packet filtering rules are the foundation on which the stable operation of the entire local network is built.

In this article, we'll examine in detail the mechanisms for implementing restrictions, explore the nuances of working with wireless interfaces, and learn how to create effective rules that won't overload the router's processor. Proper configuration will allow you to fully control the situation, whether you're using a home router. hAP ac² or corporate CCR.

How queues and traffic schedulers work

The basis of rate limiting in MikroTik is a queuing mechanism that controls the order of data packet transmission. Simple Queues (Simple queues) are the most straightforward and frequently used tool for basic traffic shaping. They operate on the FIFO (First In, First Out) principle, but with the ability to set upload and download limits for selected addresses.

It's important to understand that WiFi speed limiting has its own unique characteristics compared to a wired connection. A wireless interface is half-duplex, meaning it cannot simultaneously transmit and receive data on the same frequency. Therefore, setting overly aggressive limits or complex filtering rules can lead to increased latency and a reduction in overall throughput.

When configuring rules, keep in mind that traffic goes through several processing stages. First, the packet enters the interface, then passes through firewall chains, is processed by NAT rules, and finally, is queued. The queue rule applies only to traffic that the router routes or generates itself, so it is important to choose the correct direction (global-in, global-out, or a specific interface).

There are two main approaches to restriction: IP address restriction and MAC address restriction. The first method is more efficient and is preferable for stationary devices, while the second is convenient for guest networks, where IP addresses can change dynamically. Choosing the right approach depends on your network architecture and security requirements.

Configuring Simple Queues to Restrict by IP Address

The most common scenario is setting a speed limit for a specific device or subnet. This is done using the interface Queues -> Simple QueuesCreating a new rule begins with defining the target address (Target) and the desired maximum speed (Max Limit). This is a basic level of control that is effective in 90% of home and office use cases.

When configuring a rule, it is important to set the traffic direction correctly. Parameter Target indicates the address of the recipient or sender, depending on the context, and Max Limit Defines the upper limit of the bandwidth. If you want to limit a client downloading a file from the internet, you need to limit the download_speed for its IP address.

Let's look at an example of configuration via the command line, which is more reliable than using the WinBox graphical interface, especially when adding rules in bulk. The command below will create a queue for the device with the address 192.168.88.50, limiting its speed to 10 Mbps download and 2 Mbps upload.

/queue simple
add name="Guest_Limit" target=192.168.88.50/32 max-limit=2M/10M

Note the speed syntax: first, the upload limit is specified, followed by a slash, followed by the download limit. In the context of a router, "upload" refers to data sent from the client to the network (or internet), and "download" refers to data received by the client. Confusion between these two is a common mistake among beginners.

For more fine-tuning, you can use the parameter burst, which allows a short-term overrun of the set limit if the channel is free. This creates the illusion of a faster connection for the user, but prevents the channel from becoming unusable for long periods. However, for strict restrictions, such as in guest areas, it's better to use hard limits without burst modes.

Rate limiting for DHCP clients and by MAC address

In dynamic networks where devices frequently connect and disconnect, binding restrictions to a static IP address can be inconvenient. In such cases, a combination of DHCP Server and Simple Queues is more efficient. MikroTik allows you to automatically assign a hostname or MAC address as a queue target, simplifying administration.

One method is to create a static entry in DHCP Lease. You find the device in the list IP -> DHCP Server -> Leases, double-click and change its status Make Static. After that in the field Comment You can add a special prefix or use a script that will automatically create a queue for this client. However, a more flexible approach is to use dynamic queues.

To implement MAC address-based restriction without IP binding, Queue Tree is often used in conjunction with Firewall Mangle. This is a more complex but also more powerful method. First, in the section IP -> Firewall -> Mangle A rule is created that marks packets (Action: mark-packet) from a specific MAC address. Then in Queues -> Queue Tree A rule is created that limits the rate for packets with this tag.

⚠️ Attention: MAC address restriction only works within the local network. If you try to filter traffic by the MAC address of a client located behind NAT (for example, on a guest network with a separate gateway), the rule may not work, as MAC addresses are not routed through routers.

Advantage of using Queue Tree The advantage of Simple Queues in this context is the ability to implement more complex processing logic. You can combine multiple MAC addresses into a single group, apply different priorities, and use more complex conditions. However, it's worth keeping in mind that Queue Trees consume more CPU resources.

If you are using DHCP Server, you can also use the option add-mac-comment Or on-boot scripts that will automatically create queues for new clients based on their MAC addresses. This requires writing a small script in MikroTik Script, but eliminates the need for manual configuration of each new device.

Traffic Prioritization and Fairness (PCQ)

Hard Limiting isn't always the best solution. Sometimes it's more efficient to use fair distribution algorithms, such as PCQ (Per Connection Queue)This mechanism divides available bandwidth equally among active connections, preventing a situation where one torrent user "chokes" everyone else.

PCQ is especially useful in scenarios where the number of users varies. If one user is connected, they receive the full available bandwidth. If ten are connected, the bandwidth is divided equally between them. This is implemented through a Queue Tree using a classifier, which groups connections by source or destination IP address.

Configuring PCQ requires creating several rules in the Queue Tree: one for traffic marking (if Mangle is not used) and separate rules for Upload and Download streams with different classifiers. For Download (incoming traffic), the classifier is usually dst-address, because the router sees the packet going to the client and classifies it by destination address.

Why is PCQ better than a simple limit?

PCQ dynamically adapts to load. With a simple limit, if a user has 10 Mbps and the channel is free, they won't get more. PCQ allows the free resource to be used, but automatically reduces the speed when the channel is full with other users.

An important aspect is the order of rules. PCQ rules should be processed after rules with strict priorities (for example, for VoIP or video conferencing), but before rules with low priorities. MikroTik has a lower numerical value for this parameter. priority means higher processing priority.

Using Firewall Mangle to Mark Packets

To implement complex rate limiting schemes, especially in combination with Queue Tree, traffic must be pre-marked. This is handled by the module Firewall MangleIt allows packets to be "marked" with special marks, which are then used by queues to make decisions about priority or limiting.

The marking process usually takes place in a chain prerouting for incoming traffic and postrouting For outgoing traffic. Using Mangle reduces processor load, as marking occurs once when a connection is established or the first packet passes through, and the queue then simply looks at the mark without re-analyzing IP addresses and ports.

/ip firewall mangle
add chain=prerouting src-address=192.168.88.0/24 action=mark-packet new-packet-mark="LAN_Upload" passthrough=yes
add chain=postrouting dst-address=192.168.88.0/24 action=mark-packet new-packet-mark="LAN_Download" passthrough=yes

Parameter passthrough=yes is critically important. It tells the router that after marking, the packet should go through the rest of the Mangle rules. If you set passthrough=no, the packet will be marked, but further rules processing will be interrupted, which may disrupt the operation of other services, such as NAT or port forwarding.

⚠️ Attention: When marking traffic for Queue Tree, make sure you don't mark the router's own service traffic (such as DNS or NTP requests) unless that's your goal. Use the following parameters: in-interface And out-interface to indicate the direction precisely.

Mangle also allows you to limit speeds not only by addresses but also by protocols or ports. For example, you can create a separate label for P2P traffic and set it to a very low priority or a hard limit without affecting the user's other traffic. This requires a more in-depth knowledge of network protocols, but it yields excellent traffic management results.

Diagnosing problems and checking the effectiveness of settings

After setting up the limits, you need to ensure that they are working correctly and do not introduce excessive delays. The main monitoring tool in MikroTik is the built-in graph in the Simple Queues or Queue Tree window, as well as the utility TorchTorch allows you to see traffic in real time, broken down by protocol and address, which helps identify anomalies.

To check the effectiveness of the restrictions, use external speed measurement services, such as Speedtest, from the device to which the rule is applied. Compare the results with the configured ones. Minor deviations (5-10%) are acceptable due to protocol overhead and Wi-Fi operation, but significant drops in speed may indicate configuration errors or CPU overload.

It's also worth paying attention to the processor load. In the window System -> Resources The CPU Load indicator shouldn't constantly hover at 100%. If this happens, the chosen limiting method is too resource-intensive for your hardware. In this case, it's worth simplifying the Mangle rules or switching from Queue Tree to simpler mechanisms, if possible.

Logging can also be a useful tool. By enabling logging for specific Mangle rules (parameter log=yes), you can track which packets are affected by your rules. However, keep in mind that active logging places a significant load on the system and should only be used temporarily for debugging purposes.

Why is WiFi speed limiting slower than cable?

A wireless connection incurs overhead due to signal encoding, waiting for delivery acknowledgements (ACKs), and airtime competition. Furthermore, WiFi operates in half-duplex mode. Therefore, the actual usable speed will always be lower than the theoretical one, and any router overhead associated with queue management is more noticeable on WiFi.

Is it possible to limit the speed for a specific website (eg YouTube)?

Technically, this is possible through Layer 7 protocols or TLS hosts, but in today's environment, where all traffic is encrypted (HTTPS), it's very difficult to do so reliably. MikroTik can see the domain name when establishing a connection, but it's more effective to limit the user's overall speed rather than specific services.

Will the queue settings be reset when I reboot the router?

No, all settings made through the interface or console (including Queues and Firewall) are saved in the configuration file and are applied automatically after a reboot. Resets occur only when running a command. system reset-configuration or loading a backup copy without these rules.

Does speed limiting affect ping (latency)?

A properly configured limit (especially using PCQ and priorities) can even improve ping for important tasks by preventing buffer overflows. However, a hard limit without bursts can increase latency if an application attempts to exceed the limit, causing packets to buffer in the queue.