tool kid-control

jp · Fri Dec 29, 2017 7:07 pm

Found it playing with command line completion in the CLI of 6.41

Nothing in search results or official documentation.

I'm very interested. Anyone played with it or have further documentation?

rjscomms · Sat Dec 30, 2017 1:24 pm

Hi jp,

I had a look myself but got stumped on the user part under the device section.

I tried adding a normal user and a hotspot user (although the hotspot server was not running) and it did not accept the name I tried to enter for the user part.

It does look interesting though. I'll try to remember to keep an eye on the wiki recent pages link.

Dave.

jp · Tue Jan 09, 2018 10:38 pm

It's been updated in the wiki!

doneware · Mon Jan 15, 2018 10:39 pm

It's been updated in the wiki!

https://wiki.mikrotik.com/wiki/Manual:Kid-control

btw, the last 42rc (rc9) refers to it as /ip kid-control.

to be honest, identifying devices by their IP address is kind of dumb. especially since dual stack is not a thing and most of our kid's devices support seamlessly IPv6. i learned it on a hard way - got my fine-tuned parental control stuff running ~2yrs ago and next day they were still watching youtube videos instead of doing their homework. iOS just uses whatever it is available, so the videos fell back to IPv6 as the browser realised the v4 content is accessible no more, without any user intervention.

and since all the devices implement IPv6 privacy extensions, a simple v6 capable terminal can have multiple v6 addresses simultaneously.

so my approach is based on mac address: i set up a mangle rule both for v4 and v6, where i assign all the device's mac addresses to a marked connection, then in _both_ firewalls (v4/v6) i can easily match on the flow and apply the necessary enforcement.

 6    chain=prerouting action=mark-connection new-connection-mark=kid1 
      passthrough=no src-mac-address=48:D7:05:AB:CD:EF 

 7    chain=prerouting action=mark-connection new-connection-mark= kid1 
      passthrough=no src-mac-address=88:CB:87:AE:12:34 

 8    chain=prerouting action=mark-connection new-connection-mark= kid2 
      passthrough=no src-mac-address=AC:87:A3:EF:53:D1 

 9    chain=prerouting action=mark-connection new-connection-mark= kid2 
      passthrough=no src-mac-address=5C:F5:DA:C7:F2:13

then scheduled events can enable & disable the respective firewall rules based on their "comment" value using regex matching.
i hope the kid-control will also utilise mac addresses soon.

Tue Jan 16, 2018 2:39 pm

Fixed the manual. It was moved to IP in last RC

pe1chl · Tue Jan 16, 2018 3:29 pm

to be honest, identifying devices by their IP address is kind of dumb.

I agree, and it is a bit discomforting that even today such a feature is moved from "tool" to "ip", apparently not recognizing the fact that there is "ipv6" as well.
IPv6 still appears to be very low on the MikroTik priority list. Most of the existing features and all of the new stuff only supports IPv4.

AlainCasault · Tue Jan 16, 2018 4:35 pm

To be honest, what is it that we couldn't do before by using fw filters and other facilities? I've been doing kid control for years.

Sent from Tapatalk

Tue Jan 16, 2018 4:36 pm

That's not the point. It's an interface for easier management of firewall rules. There will also be an App for this. More features will come too.

jp · Tue Jan 16, 2018 11:57 pm

Much appreciated Normis. I think this could help us bring Mikrotik more into the residential market, where it's mostly mikrotik==business for us at the moment.

Regarding using mac address instead of IP would not solve anything.. Many devices can produce a random mac address for security purposes. If they don't do that, there is a good chance you can alter the mac address.

reinerotto · Fri Jan 19, 2018 4:32 pm

>Regarding using mac address instead of IP would not solve anything.. .<
No. Because it depends upon, how to use the MAC.
ALmost 2 years ago I did a commercial parental control device (AP/router) on openwrt, based on MAC-control. And DNS-hijacking. Unknown MACs have everything blocked, so faking the MAC addrs does not help.
Again, trying to put an application on top of RoS, which is too limited in functionality to achieve the goal perfectly.
Similar to hotspot functionality.
Open RoS, and the scenario changes.

netbus · Sun Feb 04, 2018 12:55 pm

Currently it is not working in 6.41.rc15.
No matches in dynamic Rules

Edit: I mean 6.42.rc15

lewekleonek · Fri Feb 09, 2018 3:04 pm

How come that everyone including MikroTik's wiki site: https://wiki.mikrotik.com/wiki/Manual:Kid-control says that kid-control is done under:

/ip kid-control

in 6.41.

hAP ac here with 6.41.1 upgrade (both RouterOS and Routerboard firmware) and I still see that kid-control is under:

/tool kid-control

Am I missing anything here?

netbus · Thu Apr 19, 2018 4:32 pm

because ROS 6.42 is out I tried to give /ip kid-control a chance but I didn't figure out how it works
I tried diffrent time windows but there is no dynamic reject policy set. when I manual pause some kid then ROS is setting dynamic reject policy.

And the second thing I don't unterstand is "time for rate limited"
when I set some time window then this schedule is working reverse. for example I set 20:00 - 07:00 but queue is triggered from 07:00 - 20:00
Can anybody confirm?

gotsprings · Thu Apr 19, 2018 6:35 pm

Testing it for the first time in 6.42.

I don't see a dynamic firewall rule anywhere... and the "blocked device" is not blocked at all.

maidinekhalid · Tue Apr 24, 2018 12:20 pm

Testing it for the first time in 6.42.

I don't see a dynamic firewall rule anywhere... and the "blocked device" is not blocked at all.

It's the same for me

rasak · Mon May 14, 2018 2:30 pm

Hi, been trying to setup the Kid Control, however, it seems not to be working at all via WebFig

Kid added, Device added. But its impossible to create a schedule and Rate Limit via WebFig. Even manually pausing the kid doesn't work - no FW rule created

but:

it works (limited functionality) when this is set via ssh. Then Im able to limit the schedule, devices and stuff. But Rate limit doesn't work at all.
Data in WebFig is not updated at all (time schedule). I need to apply the rate limits, any ideas?

Tried on 6.42.1, the upgraded to 6.43rc11 - no change

etienneschwiz · Tue May 15, 2018 4:09 pm

There already is an Android App that works with Mikrotik for kid control using standard FW rules.

Its called LANwize.

www.lanwize.com

netbus · Tue May 15, 2018 4:41 pm

thanks for sharing this nice app but this app is independet from the mikrotik kid-control feature.
so we want to get the kid-control feature fixed.

netbus · Fri May 25, 2018 12:45 pm

Now with 6.42.2 it looks a litte bit better but there is a problem with the dynamic Policies which are generated.
They are added to the bottom of the Filter Rules wich means, they never will get traffic.
Whereas for example Hotspot is adding his Policies to the top of the Filter Rules.
Please Mikrotik, get this fixed.

nichky · Fri May 25, 2018 2:25 pm

I found some strange i want to share with you.

I've got issues with limitations the traffic. Simple i can specify the time e.g. 15:00:00 17:00:00, and if i set up same on Time For Rate Limited: 15:00:00 17:00:00 it will no work. I have to set up like 15:00:00 15:00:00

Rate Limit=1M

Anyone can shere experience about that.

Thanks

skept2it · Wed May 30, 2018 11:03 am

Really a great idea kid control but as said earlier the rules need to be added in the beginning!
At the end after a "drop all" they will not work (as it is now).

Solution could be:
make one chain for kid-control that user can place in the firewall rules where wanted (after drop invalid etc. and before drop all statement?)
and those rules are always added into that chain...

Regarding the bandwidth control do you have other queues already setup for the interface for instance or hotspot level?
Those might overrun the kid control bandwidth or interfere somehow with it and I would only use one place to define queues.

Budit · Tue Jun 12, 2018 11:02 am

I have the same problem as NetBus in that the policy is applied to the bottom of my firewalls and does not work. why would it not go to the top. I can't see anyway to do this? Anyone have a solution? Thanks

skept2it · Wed Jun 27, 2018 1:19 pm

Kid control firewall rules position is fixed now in latest routers release.
They are added in the top first position.

Note that it seems only reject rules are added. To "accept" I believe you need to do your own (which makes sense).

Envoyé de mon SM-G930F en utilisant Tapatalk

vacari · Wed Jul 18, 2018 6:43 pm

Any day of the week that contains 00:00:00-00:00:00 causes the internet to be released every other day, even if you have restrictions on time.
to solve this temporarily I had to put in the other days (those that should be released) 00:00:01-23:59:59.
Thanks

woro · Thu Nov 01, 2018 12:05 am

Meanwhile I'm on 6.43.4 and the Tik App was updated as well recently to provide user friendly (first level) kid control feature.
But still when I'm using winbox to enable/disable/configure kid-control I see incomplete firewall rules created (e.g. just for two devices instead of the configured three), I do not see them removed or disabled when I disable the "kids" and so on.
Can someone please clarify the status of that feature in 6.43.4 and if it supposed to work tell us how to use it to really make it work?

EDIT: And also provide information about the IPv6 feature. If you want to address not-that-advanced users (aka home users?) then you need to consider IPv6 meanwhile as almost all ISPs provide native nowadays. And actually it makes around half of my traffic already. Speaking of youtube when I think of my kids.

pe1chl · Thu Nov 01, 2018 10:23 am

And also provide information about the IPv6 feature.

It appears that MikroTik consider IPv6 a bolt-on feature, not an integral part of the internet protocol suite that has to be supported in all facilities on the router.
There is lack of IPv6 support in many parts of RouterOS. kid-control is just one of them.

woro · Mon Dec 03, 2018 8:31 pm

I'm still hoping someone can bring some insight into why I do not get firewall rules created in most of the cases? Currently never.

davidja · Fri Dec 07, 2018 8:13 pm

I am on the latest version and get blocked. Cant unblock at all. Any help appreciated

redwood · Thu Dec 13, 2018 8:58 am

I was just playing with kid-control and found that it would only create the filter rules when the device tried to communicate.
Also, you can't have an end time of 00:00:00 for any of your time settings. Setting 00:00:00 for any setting means the rules will never start.

netbus · Thu Dec 13, 2018 6:59 pm

does it work for ipv6 as well?

Gesendet von meinem CLT-L29 mit Tapatalk

michalkordac · Tue Dec 18, 2018 11:41 pm

Hi everyone,
figuring out the required time format input is quite difficult, as it is not documented anywhere in the mikrotik help. After some filing and guessing based on the examples I discovered it takes the following:

hh:mm:ss-hh:mm:ss

in 24h format. If the end of the day is needed, webfig will be satisfied with

1d 0:0:0

. I hope this helps.
Another issue there is, you have to reload the page (and log in again) to get thee content refreshed. Well it's just a web page and the content is not dynamic. Maybe some later version.

A real bug I still have is with attempts to use the rate-limit function. It appeared to work just fine during the initial setup. It seemed to me, that to get the rate limited, both the connection had to be allowed for the time of the day and also the "time for rate limited" connection had to be active. A rule was being generated in the Queues sections. Surprisingly, after few days, this does not happen anymore. Either something had changed, or as the rules were getting an ordered numbers every time the rule was generated, the system run out of rules to apply. In this case maybe it would be better, if the rules were generated only once (or if non-existent) and then just enabled/disabled based on the schedule.

All the above was verified using the 6.43.4 (stable) version of the RouterOS.

dougemes · Tue Dec 25, 2018 7:52 am

the time selection broke 2 months ago. I used to be able to run all the way to midnight, now you cannot have a 24 hr on for kid control. and the minutes have been deprecated so for now I have 00:00:00 to 23:59:00 to get a couple of them to run ALMOST 24 hours. when is this going to be fixed?

erlinden · Sat Dec 29, 2018 10:54 pm

[Update]
It seems to work with the settings shown underneath...

I want to use the Rate Limit in combination with Time For Rate Limited. My preferred schedule would be:

24x7 Internet access
Every day, limit at these times:
00:00:00-07:30:00
11:30:00-16:00:00
20:00:00-00:00:00

Though it seems obvious, I don't seem to get it to work. Any help?

Bigfoot · Thu Jan 03, 2019 10:24 am

Looks like kid-control is broke.

netbus · Thu Jan 03, 2019 10:30 am

Looks like kid-control is broke.

it was never working before [emoji6]

Gesendet von meinem CLT-L29 mit Tapatalk

Bigfoot · Thu Jan 03, 2019 11:16 am

I have logged a Ticket with MikroTik Support #2019010322002594, let's see what happens.

baragoon · Thu Jan 03, 2019 12:17 pm

I have logged a Ticket with MikroTik Support #2019010322002594, let's see what happens.

will be fixed with ROS7 (c)

netbus · Wed Feb 27, 2019 4:52 pm

anyone tried with 6.44?
for me it's still not working
also tested the new "website" feature which states "kidcontrol not running" [emoji2357]

Gesendet von meinem CLT-L29 mit Tapatalk

victorkemp · Thu Mar 28, 2019 3:35 pm

Hi

Don't know if this is useful but someone showed me this method to get it working.
Just a simple example:

Kids - 1 for each user group
General wifi users
Sun to Sat 00:00:00-1d00:00:00 limit at 3M
Abusers
Mon - Frid 07:00:00-17:00:00 limit aT 1m
EXCO
Sun to Sat 00:00:00-1d00:00:00 limit at 5M
Support
Sun to Sat 00:00:00-1d00:00:00 limit at 4M

Devices are populated autmatically from L2 info gathered (ARP)

To add dynamic simple Queue
double click (select) each device and add to a group by copy)

MKT adds firewall filter rules dynamically for each IP address.

victorkemp · Thu Mar 28, 2019 3:39 pm

Is Kid control supposed to be added to any of the MTC courses?

I am mentioning it in my MTCNA as part of QoS module.

caspat · Sun Mar 31, 2019 3:41 pm

Please add an option in dhcp lease to add device to a already configuered kid.

Kronyx · Fri Apr 26, 2019 5:48 pm

It would be nice to have something like this:

https://pasteboard.co/IbW0cnC.png

kinx · Sat Sep 07, 2019 11:05 am

Still doesn't work at all on 6.45.5. Annoying they release a feature that is working according to them but actually isn't.

When will this be working?

voz · Wed Oct 16, 2019 9:48 pm

it would be nice to add time quota per kid instead of fixed time intervals

AlainCasault · Fri Oct 18, 2019 9:20 pm

it would be nice to add time quota per kid instead of fixed time intervals

+1

Sent from my cell phone. Sorry for the errors.

vader7071 · Thu Nov 07, 2019 2:45 am

I have been reading this thread, and I just found kid control on my RB951.

Currently running OS 6.45.7, Firmware 6.45.7

I created the following:

/ip kid-control
add name=Drake tur-sun=06:00:00-19:30:00 tur-mon=08:00:00-19:30:00 tur-tue=08:00:00-19:30:00 tur-wed=08:00:00-19:30:00 tur-thu=08:00:00-19:30:00 tur-fri=08:00:00-19:30:00 tur-sat=06:00:00-19:30:00 

/ip kid-control device
add mac-address=xx:xx:xx:xx:xx:xx name="Nintendo Switch" user=Drake
add mac-address=xx:xx:xx:xx:xx:xx name="Toshiba Laptop" user=Drake
add mac-address=xx:xx:xx:xx:xx:xx name="Tab-A" user=Drake
add mac-address=xx:xx:xx:xx:xx:xx name="Samsung 24 TV" user=Drake
add mac-address=xx:xx:xx:xx:xx:xx name="Galaxy S5" user=Drake

The above code snippet was pulled from my export of the router settings.

As I am typing this, it is 6:30 pm (18:30 h). However, every device on the list is blocked. My understanding is the filter is supposed to allow internet between 8 am and 7:30 pm with the way I have it configured, but it seems to be working in reverse.

Do I have a setting incorrect?

netbus · Thu Nov 07, 2019 9:44 am

yes,
you only defined where no bandwith limiting is in place but no schedule for internet access.
in your example the code should look like this:

 /ip kid-control add name=Drake mon=8h-19h30m tue=8h-19h30m wed=8h-19h30m thu=8h-19h30m fri=8h-19h30m sat=6h-19h30m sun=6h-19h30m

vipivoxa · Thu Dec 12, 2019 11:38 pm

on 6.46 - sort of works and sort of doesn't.

Trying to configure via winbox UI unlimited rate access for a specific period of time. e.g.: to allow unlimited access from 6pm:00:00 pm till next day 2am:00:00, and then to assign this 'rule' (in the UI called 'Kid') to all needed devices.

1) when trying to set 18:00:00 - 23:59:59 getting the error message ERROR invalid time-unlimited-rate: seconds are not supported (6)
well time format is required to be entered with seconds, for example, trying to enter 18:00:00 - 23:59 bring over followin error text :=) "Error in - double field expected!"
2) following config: 18:00:00 - 1d00:00:00 - which suppose to allow access from 6pm till end of the day restricts access at all.
3) more than one unlimited rate access intervals for a day, like: 00:00:00-02:00:00, and then 18:00:00-23:59:00, gave no access as well (i was testing at 10 pm)
4) trying to set more simplistic unlimited rate access interval just to have access from 18:00:00-23:59:00 didn't work either.

Making me wonder if i misunderstand the concept of the unlimited rate access section in general, or it is not working like it should.

Finally, configuring all of that in the section what is located below 'unlimited rate access', leaving rate limit not defined, seemed to be working as expected.

messerbg · Sat Jan 25, 2020 2:50 am

I was having similar trouble with testing Kid Control. What I learned is: You cannot test the rules immediately. When you set a start and stop time on the Kid Control rules, that seems to set the time that the firewall rules are created or deleted. I was having the same trouble as other posters...... I set an allowed time of 2AM - 10PM, and even though I was in that time window I had no Internet. So I set the rule for a start time of 1 minute from now, and watched the rules disappear when the the MTik's clock matched the start time. I set the stop time for 1 minute later, and the block rules reappeared at that time.

Hope this helps!

jeancz · Fri Feb 14, 2020 9:40 am

on 6.46 - sort of works and sort of doesn't.

Trying to configure via winbox UI unlimited rate access for a specific period of time. e.g.: to allow unlimited access from 6pm:00:00 pm till next day 2am:00:00, and then to assign this 'rule' (in the UI called 'Kid') to all needed devices.

1) when trying to set 18:00:00 - 23:59:59 getting the error message ERROR invalid time-unlimited-rate: seconds are not supported (6)
well time format is required to be entered with seconds, for example, trying to enter 18:00:00 - 23:59 bring over followin error text :=) "Error in - double field expected!"
2) following config: 18:00:00 - 1d00:00:00 - which suppose to allow access from 6pm till end of the day restricts access at all.
3) more than one unlimited rate access intervals for a day, like: 00:00:00-02:00:00, and then 18:00:00-23:59:00, gave no access as well (i was testing at 10 pm)
4) trying to set more simplistic unlimited rate access interval just to have access from 18:00:00-23:59:00 didn't work either.

Making me wonder if i misunderstand the concept of the unlimited rate access section in general, or it is not working like it should.

Finally, configuring all of that in the section what is located below 'unlimited rate access', leaving rate limit not defined, seemed to be working as expected.

Absolutely agree with @vipivoxa, 'unlimited rate access' doesn't work at all. Any filled value has no effect. I am running on 6.46.2.

vader7071 · Fri Feb 14, 2020 7:21 pm

yes,
you only defined where no bandwith limiting is in place but no schedule for internet access.
in your example the code should look like this:
Code: Select all
 /ip kid-control add name=Drake mon=8h-19h30m tue=8h-19h30m wed=8h-19h30m thu=8h-19h30m fri=8h-19h30m sat=6h-19h30m sun=6h-19h30m

See the response here. I had the same question, and netbus answered it.

You have to set times for internet access PLUS times for unlimited speed. The nomenclature is somewhat misleading

gramels · Thu Apr 02, 2020 8:34 pm

Hi,

I would like to use kid-control with the app and therefore create a user profile for the app with minimal access rights, so that this user can only turn off and on kids control. What are the tuser list group settings to achieve this?

-gramels

WernerdB · Mon Apr 20, 2020 10:48 pm

Hi there,

Thanks, this was an awesome addition and I'm able to easily create rules to limit all the devices currently on the network.

One question; Is there a way to set a user as the default for any new devices connecting to the network? Or to setup some limitations for the unknown user?

KR,
Werner

snowtrain · Thu May 14, 2020 10:33 pm

Am I the only one having problems with Kid kontrol not switching between limited and unlimited times? For some reason the rules doesn´t change. If I log in using the Android app I can see that the profile is limited. If I click on the profile and without making any changes the profile changes to the correct settings for that time. Any suggestions?

5 name="StreamMedia" sun=6h-1d mon=6h-1d tue=6h-1d wed=6h-1d thu=6h-1d fri=6h-1d sat=6h-1d rate-limit="100k" tur-sun=6h-19h30m,21h-1d tur-mon=14h-16h,19h-1d tur-tue=14h-16h,19h-1d tur-wed=14h-16h,19h-1d tur-thu=14h-16h,19h-1d tur-fri=14h-1d tur-sat=6h-1d

netbus · Fri May 15, 2020 12:31 pm

please read the entire thread.
Perhaps this helps:

Jotne · Fri May 15, 2020 3:16 pm

I did try this some time ago, and my kid did change his mac, so did not help at all

Could be an option to block all mac address, except the one you allow, but would not be any fleksible at all.

https://www.groovypost.com/howto/change ... ws-10-why/

pe1chl · Fri May 15, 2020 4:31 pm

I did try this some time ago, and my kid did change his mac, so did not help at all

You need a different type of kid-control !!

snowtrain · Fri May 15, 2020 8:47 pm

please read the entire thread.
Perhaps this helps:

I have searched the tread as you suggested and I see some posts on that Kid control i not fixed. I used kid control and most of the time it works. But sometimes it bugs out and I am trying to investigate if I have to set the parameters differently or if this is a bug that needs to be reported to Mikrotik.
At the moment I have defined 5 kids who are linked to 6 different devices. As said, most of the time it works. The interesting thing is that the Android app seems to "kick it alive" just by "looking at the status" of a rule. Why would "just looking" at the status make it apply the rules?
Thanks for your help.

adatmentes · Tue May 26, 2020 2:24 am

Hello,

I am trying to use Kid-control feature on 6.46. It kind of works, but it has some quirks.
1: the fw rules it adds do not block internet access only, they effectively block everything from the actual IP, not even LAN access is possible. This is a major flaw.
2. Ok, i thought i will add the accept rules for specific LAN addresses in the first 2 rules, which works ok, yeah, until the rule is disabled and enabled or its timing turns it on, when the new dynamic rule gets added first, so my accept rules are pushed down and never met.

So this kid-control thing could bear some more development IMO.

I am also using inet blocking on some of my own devices, which should be easily switchable (ie, not by messing with fw rules), Kid control looked perfect with the configurable webfig interface, but kind of unusable due to the above flaws.

pepe

wgilthorpe · Wed Jul 01, 2020 9:24 am

kid-control is a good tool that still needs work.

We should be able to use offsets to setup kid control. During the summer and on weekends, I let my 16 year old use the internet until 2am. HOwever, the way kid control works now, the internet is shut down for one minute at midnight while the day on the router changes from midnight till 00:01:00 the next day. My son is annoyed by this to no end and I can see his point. If he is in the middle of a game with his friends, the server they are on kicks him.

This seems like a very arbitrary and easy thing to fix. Especially for those who may be using kid-control to manage users who are not children. The day is irrelevant to the router and why this should need to be setup this way is beyond me.

Kid-control should allow an offset to be used instead of a time. for instance, we should be able to set a rule that would be 00:02:00+6h (or something similar). This way we could shut down the internet for this user from 2am to 8am and still maintain internet for the one minute just prior to or after midnight.

I could probably write a script to create the fire wall rules to start dropping traffic at 2am until 8am, but should we have to when the kid-control feature is meant to be making this easier on the user?

kanyck · Mon Nov 09, 2020 11:42 am

I would suggest to the devs to investigate an opportunity to couple kid control with hotspot as another possibility. Identification of the kid by hotspot login solves a lot of issues, namely ipv6, MAC substitution, sharing devices, an so on. Neither IPs nor MACs are reliable as an authentication vehicle. Hotspot login solves all that.

MangNPB · Thu Jan 21, 2021 8:27 am

I just look into kid control tonight and found why kid control with "limit rate" is broking for most including myself. Most people would have simple queue rules setup by default on their networks to allocate bandwidth with priority =8 (the lowest) to each networks, like main network, guests.... A kid control with bandwidth limit also generate automatically a queue rule for each device matching the mac address with priority=8 and NO WAY to change this.
when new rule in queue is generated it goes underneath existing rules and also having the same priority the top ones take control leaving the lower lines out like it's never there.

example : i have total bandwidth of 100mb.
main network = no queue--unlimited
guests network = max 70mb ( this network connects to all the child devices and guests device - don't want infected devices to see or ping important devices on main network)
-- my queue
simple queue = guests limit max down 70mb priority= 8....
new dynamic(kid control) queue .... 1mb (after hours) priority = 8
****problem = i can't make my guest network queue any higher because 8 is max and i can't set kid control any lower to overcome guests queue. so all traffic will only look at the existing guests network queue.

How can it be fix = mikrotik needs to give us the ability to define a different priority for queue rule in the kid control profile or default in the middle = 4. this way if the child rate limited is generated it will take precedent over any other subnetwork rules existed in the simple queue.

hoping to see fix soon.

pe1chl · Thu Jan 21, 2021 11:34 am

You are trying to use "simple queue" in a "complicated" configuration.
Look at queue tree for the global priority and bandwidth management (main vs guests vs kids) and then use simple queue only to divide the bandwidth amongst different users of the same class.

MangNPB · Fri Jan 22, 2021 6:40 am

I am checking out the queue tree but there is no way to set the priority for the "automatic queue" generated by the kid control that changes based on hours with different queue name every time it changes. therefore this option is not a solution. I need the automatic generated kid control queue to be smaller than 8 for it to work. but than again this is an over complicated scenario that is quite common in most setup.

pe1chl · Fri Jan 22, 2021 11:16 am

What I mean is: use a queue tree to determine the priorities of the different classes of traffic depending on packet marks that you set (based on connection marks, probably, that are in turn based on the device class making the connection).
That way you set the priority of your guests lower than your kids and your main network, assuming that is what you want.

Then in addition, you use simple queue to regulte the kids traffic. You can also have (another) simple queue to equally divide guests traffic, for example.
I use this method all the time because aside from dividing traffic I also want to prioritize traffic based on DSCP value, which is only practical to do in queue tree.
(so e.g. VoIP traffic always has priority over file downloads)