Traffic shaping on MikroTik is the subject that separates ISPs that manage their network from ISPs that let their network manage them. Without per-subscriber rate limiting, a handful of heavy users can saturate an uplink shared by hundreds of subscribers. Without priority queuing, a VoIP call competes equally with a bulk download. Without burst configuration, a subscriber on a 10 Mbps plan cannot even load a web page at reasonable speed because every connection has to ramp up from zero.

RouterOS offers three tools for traffic shaping: Simple Queues (easy but limited), Queue Trees with PCQ (powerful and scalable), and HTB Queue Trees with mangle marking (the most flexible but most complex). This article focuses on Queue Trees with PCQ since that is the appropriate approach for most ISP deployments.

Understanding the Queue Architecture

RouterOS processes traffic through interfaces in a specific order. For traffic leaving the router toward subscribers (download direction), shaping happens in the output queue of the subscriber-facing interface. For traffic entering the router from subscribers (upload direction), it happens in a global queue that intercepts traffic before it is processed.

Queue Trees are attached to an interface or parent queue and process traffic based on packet marks assigned by the mangle firewall chain. This is the key architectural point: Queue Trees themselves do not identify which packets belong to which subscriber. Mangle rules do that identification and mark the packets, then the Queue Tree applies the rate limit to marked traffic.

PCQ (Per Connection Queue) is the algorithm that makes per-subscriber limiting practical at scale without requiring one queue entry per subscriber. PCQ automatically classifies connections by source or destination IP and applies the configured rate limit to each unique IP independently. One PCQ queue entry limits every subscriber individually without you manually creating and managing individual entries.

Mangle Configuration for Download Shaping

Mark download traffic with a mangle rule on the forward chain. The rule matches traffic destined for your subscriber address range and assigns a packet mark that your queue tree will act on:

/ip firewall mangle
add chain=forward action=mark-packet new-packet-mark=subscriber-download \
    passthrough=no dst-address=100.64.0.0/10 \
    comment="Mark subscriber download traffic"

For operators with multiple subscriber tiers (10 Mbps, 20 Mbps, 50 Mbps plans), use address lists populated from RADIUS accounting to assign different marks per tier:

/ip firewall mangle
add chain=forward action=mark-packet new-packet-mark=tier-10mbps \
    passthrough=no dst-address-list=subscribers-10mbps
add chain=forward action=mark-packet new-packet-mark=tier-20mbps \
    passthrough=no dst-address-list=subscribers-20mbps

PCQ Queue Type Configuration

Create PCQ queue types for download and upload, specifying the per-subscriber rate limit, burst parameters, and the classifier that identifies individual subscribers:

/queue type
add name=pcq-download kind=pcq pcq-rate=10M pcq-limit=50 \
    pcq-classifier=dst-address pcq-burst-rate=20M \
    pcq-burst-threshold=8M pcq-burst-time=10s
add name=pcq-upload kind=pcq pcq-rate=5M pcq-limit=50 \
    pcq-classifier=src-address pcq-burst-rate=10M \
    pcq-burst-threshold=4M pcq-burst-time=10s

The burst configuration deserves attention because it directly affects subscriber experience. pcq-burst-rate is the speed the subscriber can reach during a burst. pcq-burst-threshold is the average rate above which burst credit stops accumulating. pcq-burst-time is the period over which burst averaging is calculated. In the example above, a subscriber on a 10 Mbps plan can burst to 20 Mbps for up to 10 seconds as long as their recent average has been below 8 Mbps. This makes short web page loads feel fast without giving subscribers sustained above-plan bandwidth.

Queue Tree Configuration

The queue tree references the interface and the PCQ type, with the packet mark connecting it to the mangle rules:

/queue tree
add name=download-shaper parent=<subscriber-interface> \
    packet-mark=subscriber-download queue=pcq-download \
    max-limit=1G priority=8
add name=upload-shaper parent=global-in \
    packet-mark=subscriber-upload queue=pcq-upload \
    max-limit=500M priority=8

The parent=global-in for upload is specific to RouterOS: upload shaping must be applied to the global-in parent rather than a specific interface to correctly intercept traffic before forwarding decisions.

Priority Queuing for Service Differentiation

If you want VoIP, DNS, and ICMP to receive priority treatment over bulk traffic, add priority markings in mangle and corresponding queue tree entries with higher priority values. RouterOS queue priority runs from 1 (highest) to 8 (lowest):

/ip firewall mangle
add chain=forward action=mark-packet new-packet-mark=voip-traffic \
    passthrough=no protocol=udp dst-port=5060,5061,10000-20000 \
    dst-address=100.64.0.0/10
/queue tree
add name=voip-priority parent=<subscriber-interface> \
    packet-mark=voip-traffic queue=pcq-download \
    max-limit=1G priority=1

Monitoring Queue Performance

Queues that are consistently full indicate that an uplink or the queue itself is the bottleneck. Monitor queue statistics in RouterOS using /queue tree print stats to see bytes and packets processed per queue, and drops. High drop counts on subscriber queues indicate that the subscriber rate limit is being enforced (expected) or that the total uplink capacity is insufficient for aggregate demand (needs investigation).

For aggregate monitoring of traffic patterns across your subscriber base, NOC Intelligence provides visibility into network-wide traffic behaviour that helps identify when uplink capacity planning is needed before subscribers start complaining. For operators who need QoS configuration designed as part of a broader network architecture, Network Design & Optimization covers traffic engineering from the access layer through the core.