Simple Queue

Simple Queue

Simple Queue is the fastest way to apply per-client or per-subnet bandwidth limits in RouterOS. It requires no packet marking and no firewall rules — you specify a target address and a rate limit, and RouterOS enforces it.

Overview

A Simple Queue rule matches packets by source or destination IP address (or subnet), then applies upload and download caps in a single rule. Rules are evaluated in order from top to bottom; the first match wins.

Simple Queue is the right tool when you need to:

• Limit bandwidth for individual hosts or small subnets
• Give clients a burst allowance for short downloads without raising their steady-state rate
• Apply fair per-user sharing across a shared uplink with PCQ

For policies that require traffic classification by protocol, application, or more than two levels of hierarchy, Queue Tree gives finer control.

How Traffic Direction Works

RouterOS determines upload and download relative to the target:

• Download — traffic destined for the target address (e.g., web responses arriving at a client)
• Upload — traffic sourced from the target address (e.g., requests leaving a client)

The max-limit parameter takes two values: upload/download. When setting max-limit=10M/50M, upload is capped at 10 Mbps and download at 50 Mbps.

Tip: When target is a subnet rather than a single host, also set the interface parameter to tell RouterOS which side of the router is the “client” side. Without it, direction can be misidentified.

Queue Ordering

Simple Queues are evaluated top to bottom. The first rule whose target matches the packet is applied — subsequent rules are skipped.

This has one important consequence: a broad rule like target=0.0.0.0/0 at the top of the list will match every packet, leaving no traffic for per-client rules below it. Always place specific rules above general ones.

# Correct order: specific before general
client-A   target=192.168.88.10/32   max-limit=10M/50M   ← matched first
client-B   target=192.168.88.11/32   max-limit=5M/20M
catch-all  target=0.0.0.0/0          max-limit=2M/5M    ← fallback only

---

Example 1: Single Client Rate Limit

Limit one host to 10 Mbps upload and 50 Mbps download:

/queue simple
add name=client-10 target=192.168.88.10/32 max-limit=10M/50M

Example 2: Multiple Clients with Catch-All

Per-client limits with a lower-rate default for unlisted hosts:

/queue simple
add name=client-A    target=192.168.88.10/32  max-limit=10M/50M
add name=client-B    target=192.168.88.11/32  max-limit=5M/20M
add name=client-C    target=192.168.88.12/32  max-limit=2M/10M
add name=default     target=0.0.0.0/0          max-limit=1M/5M

Note: The default rule must be last. If it were first, all traffic would match it immediately.

---

Burst Configuration

Burst allows a client to temporarily exceed their max-limit for short intervals — useful for fast page loads and file downloads without permanently raising the steady-state cap.

Burst Parameters

Parameter	Description
burst-limit	Maximum rate allowed during burst
burst-threshold	Burst activates while the rolling average is below this value; deactivates once the average exceeds it
burst-time	Length of the averaging window in seconds. Not a burst duration — it is the window over which the average is measured

How Burst Works

1. RouterOS continuously measures the average rate over the burst-time window.
2. If the average is below burst-threshold, burst is active — traffic can reach burst-limit.
3. Once the average hits burst-threshold, burst deactivates and the queue drops back to max-limit.

Rule of thumb: Set burst-threshold between max-limit and burst-limit. A threshold equal to or above burst-limit means burst is always active (no effect). A threshold at or below max-limit means burst is always inactive.

Example: Burst on a Client Queue

/queue simple
add name=client-burst \
    target=192.168.88.10/32 \
    max-limit=10M/50M \
    burst-limit=15M/70M \
    burst-threshold=8M/40M \
    burst-time=16s/16s

In this example, the client can burst to 15 Mbps upload / 70 Mbps download. Burst deactivates when the 16-second rolling average exceeds 8 Mbps upload or 40 Mbps download, then reactivates once the average falls back below those thresholds.

Common pitfall: If burst-time is very short (e.g., 2 s) and the client’s rate immediately hits burst-threshold within that window, burst will appear to have no effect. Use a window of 8–16 seconds for typical HTTP browsing bursts.

---

Per-Connection Fairness with PCQ

By default, a Simple Queue applies one FIFO buffer to all traffic matching the target. When many connections share a queue, a single high-bandwidth flow (e.g., a large download) can crowd out smaller flows.

PCQ (Per Connection Queue) solves this by splitting traffic into sub-streams — typically by source or destination address — and applying an equal policy to each sub-stream.

Step 1 — Create PCQ queue types

/queue type
add name=pcq-download kind=pcq pcq-classifier=dst-address pcq-rate=0
add name=pcq-upload   kind=pcq pcq-classifier=src-address pcq-rate=0

Setting pcq-rate=0 means each sub-stream shares available bandwidth equally rather than having a fixed per-stream cap.

• Use dst-address for download queues — streams are separated by who is receiving the traffic.
• Use src-address for upload queues — streams are separated by who is sending.

Step 2 — Apply PCQ types to a Simple Queue

/queue simple
add name=shared-clients \
    target=192.168.88.0/24 \
    max-limit=100M/200M \
    queue=pcq-upload/pcq-download

The queue parameter takes upload-type/download-type. With the PCQ types above, all 192.168.88.0/24 clients share the 100 Mbps upload and 200 Mbps download equally — a heavy user cannot crowd out light users.

---

DSCP and Priority Marking

RouterOS can rewrite DSCP (Differentiated Services Code Point) values on egress to signal traffic priority to downstream devices. This is done in /ip firewall mangle and complements queue-based shaping.

Marking DSCP with Mangle

/ip firewall mangle
# VoIP gets Expedited Forwarding (EF, DSCP 46)
add chain=postrouting protocol=udp dst-port=5060,10000-20000 \
    action=change-dscp new-dscp=46 comment="VoIP EF marking"

# Bulk traffic gets Best Effort (DSCP 0)
add chain=postrouting src-address=192.168.88.0/24 \
    action=change-dscp new-dscp=0 comment="LAN best effort"

Using Packet Marks with Simple Queue

Simple Queue can match on packet marks set in mangle, enabling protocol-based shaping without requiring Queue Tree:

# Step 1: mark VoIP packets
/ip firewall mangle
add chain=forward protocol=udp dst-port=5060,10000-20000 \
    action=mark-packet new-packet-mark=pm-voip passthrough=no

# Step 2: apply a priority queue to those marks
/queue simple
add name=voip-priority packet-mark=pm-voip max-limit=5M/5M priority=1
add name=all-other     target=0.0.0.0/0    max-limit=100M/200M priority=8

Priority (1–8, where 1 is highest) controls which queue is served first when the parent interface is congested. VoIP at priority 1 is always dequeued ahead of general traffic at priority 8.

Note: Packet-mark matching in Simple Queue and full hierarchical control over both traffic directions are the two main reasons to consider migrating to Queue Tree as policy complexity grows.

---

Monitoring

List all Simple Queues with live statistics:

/queue simple print stats

Sample output:

Flags: X - disabled, I - invalid
 0   name="client-A" target=192.168.88.10/32
     rate=3.2Mbps/18.5Mbps packet-rate=450/2100
     queued-bytes=0/0 queued-packets=0/0
     bytes=1234567/9876543 packets=9000/75000
     dropped=0/0

Key statistics fields:

Field	Description
rate	Current upload / download throughput
packet-rate	Packets per second (upload / download)
queued-bytes / queued-packets	Bytes / packets currently buffered
dropped	Packets dropped due to queue overflow
bytes / packets	Cumulative totals since last reset

Watch in real time:

/queue simple print stats interval=1

Reset counters:

/queue simple reset-counters-all

---

Troubleshooting

Queue shows 0 bytes even though client is active

• FastTrack is bypassing the queue subsystem. Disable FastTrack for traffic you want to shape, or add a /ip firewall filter rule to mark connections as non-fasttrack before they reach Simple Queue.
• The target address does not match the actual source/destination. Verify with /ip firewall connection print to see what addresses are in active connections.

Client exceeds the configured max-limit

• A FastTracked connection is in progress — packets on existing fast-path connections bypass queuing. Drop the connection or disable FastTrack.
• Hardware offloading on the interface is active. Disable offload for the shaped interface if present.
• The queue entry is marked I (invalid) in print stats, meaning RouterOS cannot apply it — check for a missing or misspelled parent queue name.

Burst is not activating

• burst-threshold is set at or below max-limit. The average rate starts at max-limit, so it immediately hits the threshold and burst never engages. Raise burst-threshold above max-limit.
• burst-time is too short — the averaging window fills quickly with high-rate samples, keeping the average near max-limit. Try 8–16 seconds.

Per-client PCQ fairness seems uneven

• Verify the PCQ classifier direction matches traffic direction: dst-address for download, src-address for upload.
• If using pcq-rate (non-zero), ensure it is set correctly for the desired per-client cap.
• Run /queue simple print stats to check queued-bytes — if one sub-stream is heavily queued while others are not, classification may be incorrect.

---

Parameters Reference

Simple Queue Entry Properties

Parameter	Type	Default	Description
name	string	—	Unique rule name
target	IP/subnet	0.0.0.0/0	Client address(es) to match; upload = traffic from target, download = traffic to target
interface	interface	all	Interface on the client side; required when target is a subnet to ensure correct direction detection
max-limit	rate/rate	0/0	Hard cap as upload/download; 0 = unlimited
limit-at	rate/rate	0/0	Guaranteed minimum rate as upload/download
priority	1–8	8	Queue service priority; 1 = highest, 8 = lowest
queue	queue type/type	default/default	Inner queue discipline as upload-type/download-type (e.g., pcq-upload/pcq-download)
packet-mark	string	""	Match only packets carrying this mark from /ip firewall mangle
burst-limit	rate/rate	0/0	Peak burst rate as upload/download
burst-threshold	rate/rate	0/0	Burst on/off switch threshold as upload/download
burst-time	duration/duration	0s/0s	Rate averaging window for burst calculation
time	time range	—	Optional time schedule for when the rule is active
disabled	boolean	no	Disable without removing
comment	string	""	Free-text annotation

Read-Only Statistics

Field	Description
rate	Current upload / download throughput
packet-rate	Current upload / download packets per second
bytes	Total bytes processed (upload / download)
packets	Total packets processed
queued-bytes	Bytes currently buffered in the queue
queued-packets	Packets currently buffered
dropped	Total packets dropped due to overflow

---

Related Resources

• Queue Tree — Hierarchical QoS with HTB: multiple levels, packet-mark classification, and finer priority control
• PCQ Example — Detailed Per Connection Queue fair-sharing walkthrough
• Queue Types Overview — PCQ, SFQ, RED, FQ-CoDel, CAKE algorithm details
• Firewall Mangle — Packet marking for DSCP rewriting and mark-based queue classification
• Packet Flow in RouterOS — Where Simple Queues attach in the processing pipeline
• Official MikroTik Queuing Documentation