如何使用mikrotik队列控制带宽

我有一个mikrotik路由器，我想限制无线局域网用户的速度。我为target = wlan创建了一个队列并设置了downloa限制并上传= 64k，但是当我对其进行测试时，这似乎无法正常工作！测试下载速度> 500k。路由器配置是默认设置。我怎样才能做到这一点

/interface bridge
add admin-mac=E4:8D:8C:46:C7:0F auto-mac=no comment=defconf name=bridge
/interface wireless
set [ find default-name=wlan1 ] band=2ghz-b/g/n channel-width=20/40mhz-Ce \
    disabled=no distance=indoors frequency=auto mode=ap-bridge ssid=PNG1 \
    wireless-protocol=802.11
/interface ethernet
set [ find default-name=ether2 ] name=ether2-master
set [ find default-name=ether3 ] master-port=ether2-master
set [ find default-name=ether4 ] master-port=ether2-master
set [ find default-name=ether5 ] master-port=ether2-master
/ip neighbor discovery
set ether1 discover=no
set bridge comment=defconf
/interface wireless security-profiles
set [ find default=yes ] authentication-types=wpa-psk,wpa2-psk mode=\
    dynamic-keys wpa-pre-shared-key=noor3664 wpa2-pre-shared-key=noor3664
/ip hotspot profile
add dns-name=so.zzz hotspot-address=10.5.50.1 login-by=http-pap name=hsprof1 \
    use-radius=yes
/ip pool
add name=dhcp ranges=192.168.88.10-192.168.88.254
add name=hs-pool-2 ranges=10.5.50.2-10.5.50.254
/ip dhcp-server
add address-pool=dhcp authoritative=after-10sec-delay disabled=no interface=\
    bridge name=defconf
add address-pool=hs-pool-2 interface=ether2-master lease-time=1h name=dhcp1
/ip hotspot
add address-pool=hs-pool-2 addresses-per-mac=1 interface=ether2-master name=\
    hotspot1 profile=hsprof1
/ip hotspot user profile
add address-pool=hs-pool-2 advertise=yes advertise-interval="" advertise-url="" \
    name=uprof1 open-status-page=http-login transparent-proxy=yes
/queue type
set 0 pfifo-limit=200
/queue interface
set ether2-master queue=default-small
/queue simple
add limit-at=30k/30k max-limit=30k/30k name=queue1 queue=default/default \
    target=bridge total-queue=default
/interface bridge port
add bridge=bridge comment=defconf interface=ether2-master
add auto-isolate=yes bridge=bridge interface=wlan1
/ip address
add address=192.168.88.1/24 comment=defconf interface=bridge network=\
    192.168.88.0
add address=10.5.50.1/24 comment="hotspot network" interface=ether2-master \
    network=10.5.50.0
/ip dhcp-client
add comment=defconf dhcp-options=hostname,clientid disabled=no interface=ether1
/ip dhcp-server network
add address=10.5.50.0/24 comment="hotspot network" gateway=10.5.50.1
add address=192.168.88.0/24 comment=defconf gateway=192.168.88.1
/ip dns
set allow-remote-requests=yes servers=4.2.2.4
/ip dns static
add address=10.5.50.1 name=router
/ip firewall filter
add chain=input comment="defconf: accept ICMP" protocol=icmp
add chain=input comment="defconf: accept established,related" connection-state=\
    established,related
add action=drop chain=input comment="defconf: drop all from WAN" in-interface=\
    ether1
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" \
    connection-state=established,related
add chain=forward comment="defconf: accept established,related" \
    connection-state=established,related
add action=drop chain=forward comment="defconf: drop invalid" connection-state=\
    invalid
add action=drop chain=forward comment=\
    "defconf:  drop all from WAN not DSTNATed" connection-nat-state=!dstnat \
    connection-state=new in-interface=ether1
/ip firewall nat
add action=masquerade chain=srcnat comment="defconf: masquerade" out-interface=\
    ether1
add action=masquerade chain=srcnat comment="masquerade hotspot net
    src-address=10.5.50.0/24
add action=masquerade chain=srcnat comment="masquerade hotspot net
    src-address=10.5.50.0/24
add action=masquerade chain=srcnat comment="masquerade hotspot net
    src-address=10.5.50.0/24
/ip hotspot user
add name=admin
/radius
add address=192.168.88.1 service=hotspot
add address=192.168.88.1 service=hotspot
/system clock
set time-zone-name=Asia/Tehran
/system leds
set 0 interface=wlan1
/system routerboard settings
set protected-routerboot=disabled
/tool mac-server
set [ find default=yes ] disabled=yes
add interface=bridge
/tool mac-server mac-winbox
set [ find default=yes ] disabled=yes
add interface=bridge
[admin@MikroTik] > 

禁用防火墙上的所有快速通道规则。

Fasttrack将绕过整个堆栈-包括队列。

在文档中非常清楚地提到了它。
http://wiki.mikrotik.com/wiki/Manual:Wiki/Fasttrack

描述

IPv4 FastTrack处理程序自动用于标记的连接。使用防火墙操作“ fasttrack-connection”将连接标记为快速通道。当前，实际上只能快速跟踪TCP和UDP连接（即使可以将任何连接标记为快速跟踪）。IPv4 FastTrack处理程序支持NAT（SNAT和/或DNAT）。

请注意，并非连接中的所有数据包都可以快速跟踪，因此即使将连接标记为快速跟踪，也有可能看到某些数据包通过慢速路径。这就是为什么通常遵循快速通道连接是相同的action = accept规则的原因。快速跟踪的数据包绕过防火墙，连接跟踪，简单队列，父级为全局的队列树，ip流量（6.33中已删除限制），ip记帐，ipsec，热点通用客户端，vrf分配，因此由管理员确定快速通道不会干扰其他配置；

您需要使用PCQ的简单队列，以控制所有（或特定范围）用户带宽。以下是一个示例：

/ip firewall address-list
add address=10.0.0.20-10.0.0.255 list=USER_LIST

# Marking packets going to USER_LIST
/ip firewall mangle
add action=mark-connection chain=prerouting comment="MARK CONN USER_LIST" src-address-list=USER_LIST new-connection-mark=user_conn passthrough=yes
add action=mark-packet chain=prerouting comment="MARK PKTS USER_LIST" connection-mark=user_conn new-packet-mark=user_pkts passthrough=yes

# Creating PCQ base Queue - 512k per user
/queue type
add kind=pcq name=user-download-512k pcq-classifier=dst-address pcq-dst-address6-mask=64 pcq-rate=512k pcq-src-address6-mask=64
add kind=pcq name=user-upload-512k pcq-classifier=src-address pcq-dst-address6-mask=64 pcq-rate=512k pcq-src-address6-mask=64

#- Make sure you move this simple queue on TOP, or else it will not work
/queue simple
add comment="Allow 512k Down/up per user by zaib" name="512k per user" packet-marks=user_pkts queue=user-upload-512k/user-download-512k target=""

更多信息在这里。队列示例