![MikroTik hEX 路由器 – 如何限制以太网带宽](https://linux22.com/image/1572073/MikroTik%20hEX%20%E8%B7%AF%E7%94%B1%E5%99%A8%20%E2%80%93%20%E5%A6%82%E4%BD%95%E9%99%90%E5%88%B6%E4%BB%A5%E5%A4%AA%E7%BD%91%E5%B8%A6%E5%AE%BD.png)
我有一个运行 RouterOS 6.4 的 MikroTik hEX 路由器。 eth1
是我的 WAN 端口。
eth2
连接到 TP-Link Wi-Fi 路由器。此 Wi-Fi 网络上的所有设备的地址都在 范围内192.168.42.100 - 192.168.42.200
。此路由器上的 Wi-Fi 网关为192.168.42.254
,eth1
TP-Link 路由器上的 连接到 MikroTik ,地址为192.168.88.10
。
eth3
连接到 D-Link Wi-Fi 路由器。此 Wi-Fi 网络上的所有设备的地址都在 范围内192.168.84.100 - 192.168.84.132
。此路由器上的 Wi-Fi 网关为192.168.84.254
,eth1
D-Link 路由器上的 连接到 MikroTik ,地址为192.168.88.11
。
MikroTik 上的所有端口都在一个桥接器中,以便网络上的所有设备(来自两个不同的 Wi-Fi 路由器)可以互相看到。
我已禁用桥上的 FastForward,并启用了桥上的 IP 防火墙。我还禁用了默认的 FastForward 防火墙规则。
我有一个simple queue
指定了范围内 IP 地址的带宽限制的队列192.168.84.0/24
。此队列不起作用。
我曾尝试eth3
从桥上移除 MikroTik – 但是当我这样做时,MikroTik 几乎死机 – 设备变得没有响应,就好像 CPU(或某些东西)正在极其努力地工作一样。
以下是相关配置的列表。我只想限制来自 的设备上传/下载带宽eth3
。
从我在网上读到的内容来看,这可能与桥梁有关 - 但是,正如我所说的那样 - 当我eth3
从桥梁上移除时 - 设备变得没有响应。
/interface print
Flags: D - dynamic, X - disabled, R - running, S - slave
# NAME TYPE ACTUAL-MTU L2MTU MAX-L2MTU MAC-ADDRESS
0 R ether1-wan ether 1500 1596 2026 CC:2D:E0:68:E3:EE
1 RS ether2-gw ether 1500 1596 2026 CC:2D:E0:68:E3:EF
2 RS ether3-guest ether 1500 1596 2026 CC:2D:E0:68:E3:F0
3 S ether4-vpn ether 1500 1596 2026 CC:2D:E0:68:E3:F1
4 S ether5-direct ether 1500 1596 2026 CC:2D:E0:68:E3:F2
5 R ;;; defconf
bridge bridge 1500 1596 CC:2D:E0:68:E3:EF
6 R pppoe-out1 pppoe-out 1480
/interface bridge print
Flags: X - disabled, R - running
0 R ;;; defconf
name="bridge" mtu=auto actual-mtu=1500 l2mtu=1596 arp=enabled arp-timeout=auto mac-address=CC:2D:E0:68:E3:EF protocol-mode=rstp fast-forward=no igmp-snooping=no auto-mac=no admin-mac=CC:2D:E0:68:E3:EF
ageing-time=5m priority=0x8000 max-message-age=20s forward-delay=15s transmit-hold-count=6 vlan-filtering=no dhcp-snooping=no
/ip address print
Flags: X - disabled, I - invalid, D - dynamic
# ADDRESS NETWORK INTERFACE
0 192.168.88.2/24 192.168.88.0 ether2-gw
1 192.168.88.5/24 192.168.88.0 ether5-direct
2 D xxx.xxx.xx.x/32 xxx.xxx.xx.x pppoe-out1
3 192.168.88.3/24 192.168.88.0 ether3-guest
4 192.168.88.4/24 192.168.88.0 ether4-vpn
/queue simple print
Flags: X - disabled, I - invalid, D - dynamic
0 name="quest-limit" target=192.168.84.0/24 parent=none packet-marks="" priority=8/8 queue=default-small/default-small limit-at=0/0 max-limit=512k/2M burst-limit=0/0 burst-threshold=0/0 burst-time=0s/0s
bucket-size=0.1/0.1
/queue simple print
Flags: X - disabled, I - invalid, D - dynamic
0 name="quest-limit" target=192.168.84.0/24 parent=none packet-marks="" priority=8/8 queue=default-small/default-small limit-at=0/0 max-limit=512k/2M burst-limit=0/0 burst-threshold=0/0 burst-time=0s/0s
bucket-size=0.1/0.1
/ip route print
Flags: X - disabled, A - active, D - dynamic, C - connect, S - static, r - rip, b - bgp, o - ospf, m - mme, B - blackhole, U - unreachable, P - prohibit
# DST-ADDRESS PREF-SRC GATEWAY DISTANCE
0 ADS 0.0.0.0/0 pppoe-out1 1
1 S 192.168.21.0/24 ether4-vpn 1
2 A S 192.168.42.0/24 ether2-gw 1
3 A S 192.168.84.0/24 ether3-guest 1
4 ADC 192.168.88.0/24 192.168.88.2 bridge 0
5 ADC xxx.xxx.xx.x/32 xxx.xxx.xx.x pppoe-out1 0
/ip firewall> filter print
Flags: X - disabled, I - invalid, D - dynamic
0 ;;; defconf: accept established,related,untracked
chain=input action=accept connection-state=established,related,untracked
1 ;;; defconf: drop invalid
chain=input action=drop connection-state=invalid
2 ;;; defconf: accept ICMP
chain=input action=accept protocol=icmp
3 ;;; defconf: drop all not coming from LAN
chain=input action=drop in-interface-list=!LAN
4 ;;; defconf: accept in ipsec policy
chain=forward action=accept ipsec-policy=in,ipsec
5 ;;; defconf: accept out ipsec policy
chain=forward action=accept ipsec-policy=out,ipsec
6 X ;;; defconf: fasttrack
chain=forward action=fasttrack-connection connection-state=established,related log=no log-prefix=""
7 ;;; defconf: accept established,related, untracked
chain=forward action=accept connection-state=established,related,untracked
8 ;;; defconf: drop invalid
chain=forward action=drop connection-state=invalid
9 ;;; defconf: drop all from WAN not DSTNATed
chain=forward action=drop connection-state=new connection-nat-state=!dstnat in-interface-list=WAN