MikroTik Advanced Mangle Rules for Traffic Classification

Introduction

Mangle is MikroTik's packet marking engine — it's used to mark packets and connections so they can be treated differently by queues, routing tables, and NAT. Mastering mangle is essential for advanced QoS, policy routing, and traffic engineering.

Mangle Chains

Chain	When it runs	Use case
prerouting	Before routing decision	Mark packets from LAN before routing
input	Packets destined for router	Rate-limit management access
forward	Packets through the router	Mark inter-network traffic
output	Packets generated by router	Mark router's own traffic
postrouting	After routing decision	Rarely used

Connection vs Packet Marks

Connection mark: Applied to the entire TCP/UDP connection (all packets in both directions)
Packet mark: Applied to individual packets, usually derived from connection mark

Always mark the connection first, then derive packet marks from it.

Example 1: VoIP Traffic Prioritization

Mark all SIP and RTP traffic for high-priority queue:

BASH

/ip firewall mangle

# Mark SIP signaling (port 5060)
add chain=prerouting protocol=udp dst-port=5060   action=mark-connection new-connection-mark=voip-conn passthrough=yes

# Mark RTP media (UDP port range 10000-20000)
add chain=prerouting protocol=udp dst-port=10000-20000   action=mark-connection new-connection-mark=voip-conn passthrough=yes

# Mark all packets in VoIP connections
add chain=prerouting connection-mark=voip-conn   action=mark-packet new-packet-mark=voip-pkt passthrough=no

Then reference voip-pkt in your queue tree with priority=1.

Example 2: Policy Routing by Source IP

Route specific department to a different WAN:

BASH

/routing table add name=ISP2-Table fib

/ip firewall mangle
# Marketing department (192.168.20.0/24) → ISP2
add chain=prerouting src-address=192.168.20.0/24 in-interface=bridge-LAN   action=mark-routing new-routing-mark=ISP2-Table passthrough=no

# Finance department (192.168.30.0/24) → ISP1 (default)
# No mark needed, uses main routing table

Example 3: P2P Detection and Throttling

Detect BitTorrent and limit it:

BASH

/ip firewall mangle

# Use layer7 protocol matcher for P2P detection
/ip firewall layer7-protocol
add name=bittorrent regexp="^(bittorrent protocol|azver$|get /scrape\?info_hash)"

# Mark P2P connections
add chain=prerouting layer7-protocol=bittorrent   action=mark-connection new-connection-mark=p2p passthrough=yes
add chain=prerouting connection-mark=p2p   action=mark-packet new-packet-mark=p2p-pkt passthrough=no

# Apply slow queue to P2P in /queue tree

Example 4: Bypass VPN for Specific Traffic

Send gaming traffic directly without going through VPN:

BASH

/ip firewall mangle
# Steam gaming servers direct route
add chain=prerouting dst-address-list=steam-servers   action=mark-routing new-routing-mark=direct-internet passthrough=no

/ip address-list add list=steam-servers address=103.10.124.0/23
/ip address-list add list=steam-servers address=185.25.180.0/22

Mangle Debugging

BASH

# Count packets matching a rule (add count action before main action)
/ip firewall mangle
add chain=prerouting src-address=192.168.1.100 action=passthrough

# Use torch to see real-time traffic
/tool torch interface=bridge-LAN

# Check mangle rule statistics
/ip firewall mangle print stats

Advanced: Connection State Matching

Only mark NEW connections (not established/related):

BASH

/ip firewall mangle
add chain=prerouting connection-state=new src-address=192.168.1.0/24   per-connection-classifier=both-addresses:2/0   action=mark-connection new-connection-mark=use-ISP1 passthrough=yes
add chain=prerouting connection-state=new src-address=192.168.1.0/24   per-connection-classifier=both-addresses:2/1   action=mark-connection new-connection-mark=use-ISP2 passthrough=yes

Performance Notes

Mangle runs on CPU — complex rules slow down throughput
Order matters: rules are evaluated top-to-bottom, stop at first match (with passthrough=no)
Use passthrough=yes when you want multiple rules to apply
Connection marks persist for the entire connection lifetime
print stats shows hit count — zero-hit rules should be reviewed or removed