Kid Control

Kid Control

Kid Control is a MikroTik feature designed for parental oversight and network management. It allows parents to monitor device usage, enforce time limits, restrict bandwidth, and create scheduled access windows for children’s devices. The feature integrates with RouterOS’s queue system to provide bandwidth shaping and can work with both IPv4 and IPv6 devices.

Unlike traditional queue configurations that focus solely on bandwidth management, Kid Control provides a simplified interface specifically tailored for household parental control scenarios. It tracks device activity through MAC addresses and IP addresses, creating a user-friendly way to manage internet access for family members.

Overview

Kid Control operates by creating queue rules that limit bandwidth and access times for registered devices. When you add a device to Kid Control, the router creates simple queue entries that enforce your configured limits. The system can identify devices by their MAC address, which remains constant even when IP addresses change due to DHCP reassignments or network reconnections.

The primary features of Kid Control include bandwidth rate limiting (both upload and download), daily time limits, weekly schedule configuration, and device activity monitoring. These features work together to help parents ensure children have appropriate internet access without requiring complex firewall or queue configurations.

How Kid Control Differs from Standard Queues

Kid Control simplifies the queue configuration process by abstracting away the complexity of packet marking and queue tree structures. Where standard queues require understanding of mangle rules, queue types, and hierarchical tree structures, Kid Control provides a straightforward interface that automatically creates the necessary queue rules in the background.

When you configure a rate limit in Kid Control, it creates simple queue entries with appropriate targets. The system handles the translation between device identification (MAC address) and queue targets automatically. This abstraction makes Kid Control accessible to home users while still leveraging RouterOS’s powerful queuing capabilities.

Adding Devices to Kid Control

Basic Device Addition

Add a device to Kid Control using the MAC address of the device you want to manage:

/ip kid-control device add name="Tablet-Mia" mac-address=AA:BB:CC:DD:EE:FF

After adding the device, you can view the device list:

/ip kid-control device print

Device Parameters

Parameter	Description
name	Descriptive name for the device
mac-address	MAC address of the device (format: XX:XX:XX:XX:XX:XX)
rate-down	Download rate limit (format: number followed by unit: k, M, G)
rate-up	Upload rate limit
rx-byte-limit	Total download bytes allowed per interval
tx-byte-limit	Total upload bytes allowed per interval
time	Schedule when access is allowed (format: day-hours, e.g., 08:00-18:00)
disabled	Enable or disable the device rule

Rate Limit Format

Rate limits accept various formats:

/ip kid-control device add name="Game-Console" mac-address=11:22:33:44:55:66 rate-down=10M rate-up=1M

Valid units include:

• k - kilobits per second
• M - megabits per second
• G - gigabits per second

Configuring Bandwidth Limits

Setting Download and Upload Limits

Apply bandwidth restrictions to control how much bandwidth a device can use:

/ip kid-control device add name="Kids-PC" mac-address=AA:BB:CC:DD:EE:FF \
    rate-down=5M rate-up=1M

This configuration limits the device to 5 Mbps download and 1 Mbps upload.

Setting Byte Limits

For data caps that reset periodically, use byte limits:

/ip kid-control device add name="Tablet" mac-address=AA:BB:CC:DD:EE:FF \
    rx-byte-limit=1G tx-byte-limit=500M

The byte limits track total data transferred and reset based on the interval configured in the Kid Control settings. The default interval is 24 hours.

Configuring Time Limits

Daily Schedule

Control when a device has internet access using time parameters:

/ip kid-control device add name="Weekday-Limit" mac-address=AA:BB:CC:DD:EE:FF \
    time=08:00-18:00

This allows internet access only between 8 AM and 6 PM.

Weekly Schedule

Configure different access times for different days of the week:

/ip kid-control device add name="School-Days" mac-address=AA:BB:CC:DD:EE:FF \
    time=08:00-18:00-smtwtfs

The day specification uses abbreviations: s (Sunday), m (Monday), t (Tuesday), w (Wednesday), t (Thursday), f (Friday), s (Saturday).

Separate Weekday and Weekend Schedules

Create different schedules for school days and weekends:

/ip kid-control device add name="School-Nights" mac-address=AA:BB:CC:DD:EE:FF \
    time=08:00-21:00-mtwtf
/ip kid-control device add name="Weekend-Mornings" mac-address=AA:BB:CC:DD:EE:FF \
    time=09:00-23:00-ss

Combined Configuration

You can combine bandwidth limits with time schedules for comprehensive control:

/ip kid-control device add name="Controlled-Device" \
    mac-address=AA:BB:CC:DD:EE:FF \
    rate-down=5M \
    rate-up=1M \
    time=07:00-21:00-mtwtf

This configuration limits the device to 5 Mbps down / 1 Mbps up, but only during school days from 7 AM to 9 PM.

Monitoring Device Activity

Viewing Device Status

Check the current status of all Kid Control devices:

/ip kid-control device print detail

The output shows device names, MAC addresses, rate limits, and current activity statistics.

Viewing Statistics

Monitor data usage for each device:

/ip kid-control device print stats

The statistics include:

• Total bytes transferred (rx-byte, tx-byte)
• Current queue status
• Packets matched
• Current transfer rates

Managing Kid Control Settings

Global Settings

Configure global Kid Control parameters that affect all devices:

/ip kid-control set accounting-interval=daily

Settings Parameters

Parameter	Description	Default
accounting-interval	How often byte limits reset	daily
ena	Enable or disable Kid Control	yes
force-legacy-id	Use legacy device identification	no

Controlling All Devices

You can enable or disable all Kid Control rules at once:

/ip kid-control set ena=no

Common Configuration Examples

Example 1: Weekday Homework Schedule

Limit a child’s tablet to 2 Mbps during school hours, allowing full access after homework is done:

/ip kid-control device add name="Mias-Tablet" mac-address=AA:BB:CC:DD:EE:FF \
    rate-down=2M rate-up=512k time=15:00-21:00-mtwtf
/ip kid-control device add name="Mias-Tablet-Weekend" mac-address=AA:BB:CC:DD:EE:FF \
    rate-down=10M rate-up=2M time=08:00-23:00-ss

Example 2: Complete Weekend Shutdown

Completely block internet access on weeknights while allowing limited access on weekends:

/ip kid-control device add name="Gaming-Room" mac-address=11:22:33:44:55:66 \
    time=20:00-08:00-mtwtf,08:00-22:00-ss

Example 3: Data Cap for Mobile Devices

Limit a mobile device to 500MB per day to prevent excessive data usage:

/ip kid-control device add name="Phone-Limit" mac-address=AA:BB:CC:DD:EE:FF \
    rx-byte-limit=500M

Troubleshooting

Device Not Being Limited

1. Verify the MAC address is correct and matches exactly
2. Check that the device is not excluded by other firewall rules
3. Ensure Kid Control is enabled

/ip kid-control print
/ip kid-control device print

Schedule Not Working

1. Verify the time format is correct
2. Check the router’s system time is accurate
3. Ensure time specifications use the correct day abbreviations

/system clock print

Device Still Has Access During Blocked Time

Check if there are conflicting queue rules:

/queue simple print

Kid Control creates simple queue entries. Other queue rules may conflict with or override Kid Control rules.

Rate Limiting Not Effective

1. Verify rate values are within your actual bandwidth capacity
2. Check if FastTrack is enabled, which bypasses queue processing

/ip firewall filter print where action=fasttrack-connection

IPv6 Considerations

Kid Control works with IPv6 devices, but device identification relies on MAC addresses. If devices use IPv6 privacy extensions and change addresses frequently, the MAC-based identification should still function correctly since Kid Control tracks the device’s hardware address rather than its IP address.

For dual-stack devices (both IPv4 and IPv6), ensure your firewall rules don’t inadvertently bypass Kid Control queues for IPv6 traffic.

Best Practices

Start with conservative rate limits and adjust based on observed behavior. Children often need time to adjust to new restrictions, and overly aggressive limits can cause frustration. Review byte limit usage weekly during the first month to ensure limits are appropriate for your household’s needs.

Use descriptive device names that identify who owns the device and what type of device it is. This makes managing multiple devices much easier as your network grows.

Document your Kid Control configuration, including the rationale for specific limits and schedules. This helps maintain consistency and makes it easier to adjust settings as children’s needs change.

Test new configurations during low-activity periods to ensure they work as expected before relying on them during critical times.

Related Commands

• /ip kid-control - Main Kid Control configuration
• /ip kid-control device - Device management
• /queue simple - View created queue rules
• /system clock - Verify router time for schedules

Related Resources

• Official MikroTik Kid Control Documentation
• Queue Types Overview
• Simple Queues Guide
• Firewall and QoS Overview