Firewall Filter, NAT and Mangle · Topic 6 of 6
Mangle Advanced and Extra Conditions
Learn the advanced and extra RouterOS conditions: address lists, connection bytes, PCC, nth, time, limits, address type and layer7 matching.
- 5 min
- Includes a diagram
- Advanced and Extra conditions are ordinary parameters in the console.
- A rule matches only when all its conditions match.
- PCC hashes connection fields into groups, such as
both-addresses:2/0.
What it is
Beyond addresses and ports, firewall rules have advanced conditions that match behaviour, such as size, rate, time or a hash of the connection.
In WinBox these appear on the Advanced and Extra tabs of a rule. In the console they are ordinary parameters. They work in filter, NAT and mangle, but they are most common in mangle, where they classify and split traffic.
A rule matches only when every condition matches, so each extra condition makes a rule more specific.
How it works
Each advanced condition answers a different kind of question.
Conditions about lists, size and content
| Condition | Matches |
|---|---|
| src-address-list, dst-address-list | An address in a named list |
| connection-bytes | A connection that has transferred a given range of bytes |
| connection-rate | A connection whose speed is in a given range |
| packet-size | A packet whose size is in a given range |
| content | A packet whose data contains a given string |
| layer7-protocol | A packet whose data matches a regular expression |
| src-mac-address | The source MAC address |
| dscp, ttl, tcp-flags | A header field value |
Address lists are filled by the add-src-to-address-list and add-dst-to-address-list actions, or by hand. A single rule can then match hundreds of addresses cheaply.
connection-bytes is useful to lower the priority of long downloads. A rule matches only after a connection has moved a set number of bytes, so small web requests are untouched.
Conditions for sharing and limits
| Condition | Matches |
|---|---|
| per-connection-classifier | A share of connections, chosen by a hash |
| nth | Every nth packet |
| random | A random percentage of packets |
| limit | Packets up to a rate, with a burst |
| dst-limit | Packets up to a rate for each destination |
| connection-limit | Hosts with more than a number of connections |
| time | A time of day and days of the week |
| src-address-type, dst-address-type | The kind of address, such as local, broadcast or multicast |
Per connection classifier
PCC splits connections into groups. It hashes chosen fields and compares the result with a remainder, so each connection always lands in the same group. This is the standard way to load balance over several uplinks.
/ip firewall mangle add chain=prerouting in-interface=ether2 connection-mark=no-mark per-connection-classifier=both-addresses:2/0 action=mark-connection new-connection-mark=wan1-conn passthrough=yes
/ip firewall mangle add chain=prerouting in-interface=ether2 connection-mark=no-mark per-connection-classifier=both-addresses:2/1 action=mark-connection new-connection-mark=wan2-conn passthrough=yesThe value both-addresses:2/0 means two groups, and this rule takes group zero. The second rule takes group one. A later rule can then turn each connection mark into a routing mark, so each group uses its own uplink.
Nth, random and limit
nth=2,1 matches every second packet. It counts packets, not connections, so on its own it splits the packets of one connection across paths. PCC is the usual choice for balancing connections.
limit matches packets only up to a given rate. Combined with a drop action, it gives simple rate limiting, and combined with a log action it stops a flood of log lines.
Time
The time condition matches a window of the day and chosen days. It uses the router clock, so the system time and time zone must be correct.
Layer 7
layer7-protocol matches packet data against a regular expression stored in the layer 7 protocols menu. It looks inside the early packets of a connection. It is expensive for the CPU and easy to evade, so use it sparingly and only after cheaper conditions have narrowed the traffic.
Put cheap conditions such as address, protocol and port first, and use layer7-protocol only to confirm. Otherwise every packet pays the full cost.
Address type
dst-address-type=local matches addresses that belong to the router. broadcast and multicast match those types. These conditions save you from listing every router address by hand.
What to remember for the exam
Eight facts cover most questions on this topic.
- Advanced and Extra conditions are ordinary parameters in the console.
- A rule matches only when all its conditions match.
- PCC hashes connection fields into groups, such as
both-addresses:2/0. - PCC keeps each connection on the same uplink, so it is used for load balancing.
nthmatches every nth packet and does not follow connections.limitmatches up to a packet rate, anddst-limitdoes so per destination.layer7-protocolis costly and should follow cheaper conditions.timedepends on a correct router clock.
For load balancing over two uplinks, use PCC with connection marks first, then routing marks, instead of nth.
Common mistakes
These four mistakes appear often.
Using nth to balance connections. It counts packets, so without a connection mark the packets of one connection are split across uplinks, which breaks the session.
Putting layer7 first. The expensive match then runs for all traffic.
Forgetting connection-mark=no-mark with PCC. Packets of marked connections are classified again.
Trusting the time condition without a correct clock. The window then opens at the wrong hour.
Check yourself
Work through these three questions.
Why is PCC suitable for load balancing over two uplinks?
It hashes connection fields into groups, so every packet of one connection lands in the same group and uses the same uplink.
Why should
layer7-protocolcome after other conditions?It is costly, so cheaper conditions should narrow the traffic first.
What does
connection-bytesallow you to do?It matches a connection only after it has transferred a set range of bytes, so you can treat long downloads differently.
Topic 6 of 6 in Firewall Filter, NAT and Mangle
Test yourself on Firewall Filter, NAT and Mangle
The full MikroTik MTCTCE question bank has 479 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by MikroTik. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.