I've now tried to get this working and had to reset the router multiple times.
From everything I've read I go around is circles and now I have a splitting headache.

Past...
FTTH is 20 mb down, 10 mb up
FTTH connection. Using queues I assigned each IP about 15 mb down of the bandwidth. This means no one could grab 100% for the bandwidth.
Principle simply, not everyone is trying to down at the same time.
It worked for us.

Now
FTTH is 100 mb down, 50 mb up
Using old settings, adjust the badwidth to 80 mb down, we run into problems. The connection capped out at about 30 mb.
Setting Fasttrack up it resolved to connection 30 mb capped and I am downloading at 100 mb.
But now Queues are no longer working. Already had it that one system updating pulled all 100 mb to itself, lagging the rest of the network.

1. Can Queues be setup on fasttrack, or a 100mb connection speed.
2. If not, what other options is there?

Queues worked for me, as I problem IP I could isolate to a slow collection...
The router has been reset to defaults with just the PPPoE connection and Wifi setup.

Hardware - MikroTik RouterBOARD hAP ac
OS version - MikroTik RouterOS 6.47.2

Queues and fasttrack are mutually exclusive. But then your router might net be powerful enough to run firewalling without fasttrack at wire speed.

I suggest you to disable fasttrack again and while traffic is bottlenecked, run /tool profile cpu=all to see if CPU is bottleneck[*] and if it is, verify which process consumes most CPU cycles.

N.b. hAP ac is slightly aged device with not-so-fast single-core CPU and while it is normally capable of routing around 300Mbps traffic (sum of UL and DL), this is only possible if fasttrack is enabled.

[*]due to timing issues (most protocols don't handle well out-of-order packet delivery, those who tolerate it still struggle) packets belonging to same connection are handled by same CPU core. Which means that typical single-connection traffic (HTTP/FTP/SMB downloads, single threaded speed tests, ...) will utilize single CPU core. Some devices feature higher number of relatively weak CPUs (more or less all devices except recent ARM-based ones) will be bottleneck for such transfers while they'll do just fine for large number of concurrent transfers (e.g. edge router for decently sized LAN).

Do not use the mangle rules and the queue tree you had. Create a new SFQ queue type with a perturb time of 10. Then add a simple queue with your LAN as target, a max limit of 90M/45M and use the new SFQ queue type you created. This should stop any client from starving all others by sharing the bandwidth equally and in theory, not peg your CPU.

Do not use the mangle rules and the queue tree you had. Create a new SFQ queue type with a perturb time of 10. Then add a simple queue with your LAN as target, a max limit of 90M/45M and use the new SFQ queue type you created. This should stop any client from starving all others by sharing the bandwidth equally and in theory, not peg your CPU.

Iam your fan, always read information from you.
1. Can u share your QOS script?
2. Which one is better pcq or sfq? Can u tell good configuration for game?
3. Iam looking for configuration to separate between Internet download manager (IDM) and streaming movie which both of them using same port 443 TCP. Any advice drom you? If i can block IDM its better, so my plan is people can download while streaming movie.

Big thanks

I will try to answer this clearly...

1. It's not my script...but a simple way to avoid clients starving off others is fair queuing. SFQ allows packets from each flow with a round-robin scheduler. It doesn't prioritize anything, so it will delay high priority packets once the limit is reached. The MT Wiki has more info on the available parameters.


2. There's no better queue type really, notwithstanding that the best option for performance is always none. PCQ is Mikrotik's more advanced queue type, which offers additional rate control on a per-user basis, i.e. it automatically creates sub-streams for each IP address. It's a very simple to set up QoS strategy that can accommodate many users with rate limits. A very basic example from the Wiki:


For low latency gaming, if you must use QoS, I prefer low overhead FIFO algorithms, but this can be a lot more time-consuming to set up properly than SFQ, PCQ or Cake (there's a sticky about QoS with RouterOS). There's no free lunch with queuing - it always adds latency (just like any code through a CPU requires CPU time). You can also fasttrack small packet connections on the required ports to avoid queues used by other traffic.

3. What you are looking for is app detection, which is not possible with Mikrotik. L7 and TLS Host are workarounds that do not work with SSL. This requires DPI over encrypted traffic, like what is available with SonicWall (DPI-SSL).