MikroTik Simple Queue: How to Limit Bandwidth per IP (Step by Step)
By Madan Kc, ISP/GPON engineer at DG Link Network · Updated
Quick answer: To limit a client’s speed on MikroTik, add a simple queue: /queue simple add name=user1 target=192.168.88.10/32 max-limit=5M/10M. The target is the client’s IP. The first number in max-limit is the client’s upload and the second is the client’s download. The speed is in megabits per second.
Create a simple queue
A simple queue limits the traffic to and from one or more addresses. It is the easiest way to shape bandwidth on a MikroTik router for fixed or DHCP clients.
- Give the client a fixed address. Use a static DHCP lease or a static IP, otherwise the queue stops matching when the address changes.
- Add the queue:
/queue simple add name=user1 target=192.168.88.10/32 max-limit=5M/10M comment="Customer 1, 10M plan"In WinBox, open Queues, then the Simple Queues tab, press +, set Name, Target and Max Limit (Target Upload and Target Download), and apply.
To change it later:
/queue simple set [find name=user1] max-limit=10M/20M
/queue simple disable [find name=user1]
/queue simple remove [find name=user1]Which number is upload and which is download?
For a queue whose target is a LAN client, max-limit is written as upload/download, as seen from the client:
| Value | Client upload | Client download |
|---|---|---|
max-limit=5M/10M | 5 Mbps | 10 Mbps |
max-limit=2M/20M | 2 Mbps | 20 Mbps |
max-limit=512k/2M | 512 kbps | 2 Mbps |
The letters mean k = kilobits and M = megabits per second, not bytes. A 10M queue gives about 1.25 MB/s in a download manager. A common mistake is writing the numbers the wrong way round and giving a customer a fast upload and a slow download.
Useful options
| Option | What it does |
|---|---|
target | The client IP, or a subnet such as 192.168.88.0/24 to limit a whole group together. |
limit-at | The speed the client is guaranteed when the link is busy. |
burst-limit | A higher speed allowed for a short time, e.g. 10M/20M. |
burst-threshold | If average speed stays below this, the burst is allowed, e.g. 4M/8M. |
burst-time | The window used to average the speed, e.g. 10s/10s. |
parent | Puts the queue under another queue, so a group shares one total limit. |
priority | 1 is highest and 8 is lowest. |
Example with burst
/queue simple add name=user2 target=192.168.88.11/32 \
max-limit=5M/10M burst-limit=10M/20M \
burst-threshold=4M/8M burst-time=10s/10sExample with a parent queue
/queue simple add name=office target=192.168.88.0/24 max-limit=50M/100M
/queue simple add name=pc1 target=192.168.88.20/32 parent=office max-limit=10M/20MSimple queues are read from the top of the list down, and a packet goes to the first queue that matches. If a broad queue is above a specific one, the specific one never sees traffic, so put specific queues first.
The FastTrack catch
If your queue seems to do nothing, check FastTrack. The default firewall configuration on many MikroTik routers has a fasttrack-connection rule, and FastTracked packets bypass simple queues.
/ip firewall filter print and look for action=fasttrack-connection. Either disable that rule, or change it so it skips the addresses you want to limit. Disabling it raises CPU use on busy routers, so test on a quiet link first.Check it works
/queue simple print stats
/queue simple print detail where name=user1Watch the rate column while the client runs a speed test. It should sit close to the limit, and the queued and dropped counters should grow when the client hits the cap. In WinBox you can also open the queue and use the Traffic tab for a live graph.
If the client is not limited: check that the target IP is correct, that no earlier queue catches the traffic, that FastTrack is not bypassing it, and that the client is not using a different address, such as an IPv6 address.
PPPoE customers and when to use something else
For PPPoE customers you rarely need to write simple queues by hand. Put the speed in the PPP profile and the router creates the queue when the customer connects. That is covered in MikroTik PPPoE speed limit per user, and the full server is in the MikroTik PPPoE server complete setup guide. If customers can’t connect at all, see MikroTik PPPoE client cannot connect.
- Simple queue: a few fixed or DHCP clients, easy to read, easy to change.
- PCQ queue type: many clients that should share a link fairly without one queue each.
- Queue tree: advanced shaping by connection mark, with more setup.
With hundreds of customers, avoid hundreds of hand-made simple queues. Use profiles or a PCQ setup instead, because long queue lists cost CPU.
FAQ
How do I limit bandwidth per user on MikroTik?
Add a simple queue with the client’s IP as the target and a max-limit, for example max-limit=5M/10M. For PPPoE customers, set the speed in the PPP profile instead.
What does max-limit=5M/10M mean?
The first value is the client’s upload speed (5 Mbps) and the second is the download speed (10 Mbps).
Why is my MikroTik simple queue not working?
Most often FastTrack is bypassing the queue, an earlier queue matches first, or the client IP has changed. Check these three before anything else.
Simple queue or queue tree: which should I use?
Use simple queues for a small number of clients. Use a queue tree with PCQ when you need shaping by connection mark or fair sharing across many users.
Can I limit a whole subnet together?
Yes. Set the target to the subnet, for example 192.168.88.0/24, or create a parent queue and put each client queue under it.
Sources: MikroTik RouterOS documentation for simple queues and FastTrack, and my own use of these queues on ISP routers. Syntax can differ slightly between RouterOS v6 and v7; run /queue simple add ? to see the options on your router.