我有一个 mikrotik 路由器，我想限制 wlan 用户的速度。我为目标 = wlan 创建了一个队列，并设置了下载和上传限制 = 64k，但当我测试它时，这似乎无法正常工作！测试下载速度 > 500k。路由器配置是默认的。我该怎么做
/interface bridge
add admin-mac=E4:8D:8C:46:C7:0F auto-mac=no comment=defconf name=bridge
/interface wireless
set [ find default-name=wlan1 ] band=2ghz-b/g/n channel-width=20/40mhz-Ce \
disabled=no distance=indoors frequency=auto mode=ap-bridge ssid=PNG1 \
wireless-protocol=802.11
/interface ethernet
set [ find default-name=ether2 ] name=ether2-master
set [ find default-name=ether3 ] master-port=ether2-master
set [ find default-name=ether4 ] master-port=ether2-master
set [ find default-name=ether5 ] master-port=ether2-master
/ip neighbor discovery
set ether1 discover=no
set bridge comment=defconf
/interface wireless security-profiles
set [ find default=yes ] authentication-types=wpa-psk,wpa2-psk mode=\
dynamic-keys wpa-pre-shared-key=noor3664 wpa2-pre-shared-key=noor3664
/ip hotspot profile
add dns-name=so.zzz hotspot-address=10.5.50.1 login-by=http-pap name=hsprof1 \
use-radius=yes
/ip pool
add name=dhcp ranges=192.168.88.10-192.168.88.254
add name=hs-pool-2 ranges=10.5.50.2-10.5.50.254
/ip dhcp-server
add address-pool=dhcp authoritative=after-10sec-delay disabled=no interface=\
bridge name=defconf
add address-pool=hs-pool-2 interface=ether2-master lease-time=1h name=dhcp1
/ip hotspot
add address-pool=hs-pool-2 addresses-per-mac=1 interface=ether2-master name=\
hotspot1 profile=hsprof1
/ip hotspot user profile
add address-pool=hs-pool-2 advertise=yes advertise-interval="" advertise-url="" \
name=uprof1 open-status-page=http-login transparent-proxy=yes
/queue type
set 0 pfifo-limit=200
/queue interface
set ether2-master queue=default-small
/queue simple
add limit-at=30k/30k max-limit=30k/30k name=queue1 queue=default/default \
target=bridge total-queue=default
/interface bridge port
add bridge=bridge comment=defconf interface=ether2-master
add auto-isolate=yes bridge=bridge interface=wlan1
/ip address
add address=192.168.88.1/24 comment=defconf interface=bridge network=\
192.168.88.0
add address=10.5.50.1/24 comment="hotspot network" interface=ether2-master \
network=10.5.50.0
/ip dhcp-client
add comment=defconf dhcp-options=hostname,clientid disabled=no interface=ether1
/ip dhcp-server network
add address=10.5.50.0/24 comment="hotspot network" gateway=10.5.50.1
add address=192.168.88.0/24 comment=defconf gateway=192.168.88.1
/ip dns
set allow-remote-requests=yes servers=4.2.2.4
/ip dns static
add address=10.5.50.1 name=router
/ip firewall filter
add chain=input comment="defconf: accept ICMP" protocol=icmp
add chain=input comment="defconf: accept established,related" connection-state=\
established,related
add action=drop chain=input comment="defconf: drop all from WAN" in-interface=\
ether1
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" \
connection-state=established,related
add chain=forward comment="defconf: accept established,related" \
connection-state=established,related
add action=drop chain=forward comment="defconf: drop invalid" connection-state=\
invalid
add action=drop chain=forward comment=\
"defconf: drop all from WAN not DSTNATed" connection-nat-state=!dstnat \
connection-state=new in-interface=ether1
/ip firewall nat
add action=masquerade chain=srcnat comment="defconf: masquerade" out-interface=\
ether1
add action=masquerade chain=srcnat comment="masquerade hotspot net
src-address=10.5.50.0/24
add action=masquerade chain=srcnat comment="masquerade hotspot net
src-address=10.5.50.0/24
add action=masquerade chain=srcnat comment="masquerade hotspot net
src-address=10.5.50.0/24
/ip hotspot user
add name=admin
/radius
add address=192.168.88.1 service=hotspot
add address=192.168.88.1 service=hotspot
/system clock
set time-zone-name=Asia/Tehran
/system leds
set 0 interface=wlan1
/system routerboard settings
set protected-routerboot=disabled
/tool mac-server
set [ find default=yes ] disabled=yes
add interface=bridge
/tool mac-server mac-winbox
set [ find default=yes ] disabled=yes
add interface=bridge
[admin@MikroTik] >
答案1
禁用防火墙上的所有快速通道规则。
Fasttrack 将绕过几乎整个堆栈 - 包括队列。
文档中说得很清楚。
http://wiki.mikrotik.com/wiki/Manual:Wiki/Fasttrack
描述
IPv4 FastTrack 处理程序自动用于标记连接。使用防火墙操作“fasttrack-connection”将连接标记为快速通道。目前只有 TCP 和 UDP 连接可以实际进行快速通道（即使任何连接都可以标记为快速通道）。IPv4 FastTrack 处理程序支持 NAT（SNAT、DNAT 或两者）。
请注意，连接中并非所有数据包都可快速跟踪，因此即使连接标记为快速跟踪，也可能会看到一些数据包通过慢速路径。这就是为什么快速跟踪连接通常遵循相同的操作=接受规则的原因。快速跟踪数据包绕过防火墙、连接跟踪、简单队列、父级=全局的队列树、ip 流量流（6.33 中删除限制）、ip 会计、ipsec、热点通用客户端、vrf 分配，因此管理员必须确保快速跟踪不会干扰其他配置；
答案2
您需要使用 PCQ 进行简单的队列以便控制所有（或特定范围）用户的带宽。以下是一个例子：
/ip firewall address-list
add address=10.0.0.20-10.0.0.255 list=USER_LIST
# Marking packets going to USER_LIST
/ip firewall mangle
add action=mark-connection chain=prerouting comment="MARK CONN USER_LIST" src-address-list=USER_LIST new-connection-mark=user_conn passthrough=yes
add action=mark-packet chain=prerouting comment="MARK PKTS USER_LIST" connection-mark=user_conn new-packet-mark=user_pkts passthrough=yes
# Creating PCQ base Queue - 512k per user
/queue type
add kind=pcq name=user-download-512k pcq-classifier=dst-address pcq-dst-address6-mask=64 pcq-rate=512k pcq-src-address6-mask=64
add kind=pcq name=user-upload-512k pcq-classifier=src-address pcq-dst-address6-mask=64 pcq-rate=512k pcq-src-address6-mask=64
#- Make sure you move this simple queue on TOP, or else it will not work
/queue simple
add comment="Allow 512k Down/up per user by zaib" name="512k per user" packet-marks=user_pkts queue=user-upload-512k/user-download-512k target=""
更多信息请点击此处。队列示例