How to stabilize streaming: traffic prioritization on MikroTik

Dropped frames on a stream often occur not because the computer is weak, but because the link is saturated: someone on the network watches 4K video or starts a large upload, and the stream’s outbound traffic begins competing with other traffic. On MikroTik this is solved by prioritization: the router marks stream traffic and gives bandwidth to it first.

Below is a working scheme for RouterOS 7: marking in mangle, a Queue Tree, and verification. General router settings are in the complete MikroTik guide, an overview of capabilities is in the article “MikroTik: what kind of router is this”.

Initial data

• The computer that sends the stream is 192.168.0.100.
• The internet comes in via the pppoe1 interface.
• Outbound speed per the plan is 50 Mbps.

The computer’s address must be static. Fix it in IP → DHCP Server → Leases (button Make Static) or set it manually, otherwise after a reboot the rules will no longer match.

Step 1. Marking connections and packets

MikroTik documentation recommends marking the connection first, then the packets within it: checking each packet header is more expensive for the CPU than marking the connection once.

/ip firewall mangle
add chain=forward src-address=192.168.0.100 out-interface=pppoe1 \
    connection-state=new action=mark-connection \
    new-connection-mark=stream_conn passthrough=yes comment="stream: conn"
add chain=forward connection-mark=stream_conn out-interface=pppoe1 \
    action=mark-packet new-packet-mark=stream_up passthrough=no comment="stream: packets"

The first rule marks new connections from the computer to the stream, the second sets the stream_up mark on outgoing packets of those connections.

If this computer does more than just streaming, select the traffic more precisely. Classic RTMP works on TCP port 1935; add protocol=tcp dst-port=1935 to the first rule. If the program sends the stream over RTMPS (port 443), a port filter will also catch regular HTTPS, and then it is more reliable to mark all traffic from the computer.

Step 2. Queue Tree

/queue tree
add name=UP-TOTAL parent=pppoe1 max-limit=45M
add name=UP-STREAM parent=UP-TOTAL packet-mark=stream_up \
    limit-at=8M max-limit=45M priority=1
add name=UP-OTHER parent=UP-TOTAL packet-mark=no-mark \
    limit-at=5M max-limit=45M priority=8

What the parameters mean:

• max-limit of the parent queue — slightly below the real link speed, about 90% of the plan. The queue must be formed on the MikroTik, not on the provider’s equipment: only then does the router decide which packets to send first.
• limit-at — guaranteed bandwidth. The stream is allocated 8 Mbps: this is enough for a 1080p stream with some headroom. Substitute the bitrate from OBS settings plus 20–30%.
• priority — from 1 (highest) to 8 (lowest). According to the documentation, priority works only between child queues: after each has received its limit-at, the free bandwidth is given first to the queue with higher priority. Priority does not apply to the parent queue.
• max-limit of child queues must not exceed the parent’s.
• packet-mark=no-mark — all other traffic that has no mark.

The sum of limit-at values of child queues must not exceed the parent max-limit.

Step 3. FastTrack

FastTrack is enabled in the default RouterOS configuration: it speeds up processing of established connections by skipping parts of the chains. The documentation explicitly warns that such traffic bypasses queues, and they do not work.

The simplest way is to exclude marked connections from the FastTrack rule. Find it in IP → Firewall → Filter Rules (action fasttrack-connection) and add the condition connection-mark=no-mark:

/ip firewall filter
set [find action=fasttrack-connection] connection-mark=no-mark

Now stream connections go the normal path and are put into the queue, while all other traffic is still accelerated by FastTrack. If the UP-OTHER queue also must work, FastTrack will have to be disabled completely. This significantly increases CPU load, especially on lower-end models.

Step 4. Verification

1. Start the stream and open Queues → Queue Tree. The UP-STREAM queue should show increasing byte and packet counters.

2. Check that the mangle rules are triggering:

   bash Copy

   /ip firewall mangle print stats where comment~"stream"

3. Load the link: start a large upload to the cloud from another device. OBS statistics should show no dropped frames, and the UP-OTHER queue should show the limitation.

Typical errors

• Queues do not trigger. Most often traffic goes through FastTrack or the marks do not match: check the counters of the mangle rules.
• max-limit is higher than the link speed. The queue is formed at the provider, and router priorities do not affect anything.
• A child queue has max-limit greater than the parent. Such a setting does not provide extra bandwidth and only confuses the configuration.
• The wrong address is marked. The computer received a different address via DHCP, and the rules no longer match.
• Only incoming traffic is configured. For streaming, the outgoing channel is important: the queue is attached to the external interface, not to the local network.

Other tools

RouterOS 7 also has other queue types, such as CAKE and FQ-CoDel: they reduce latency for all traffic at once, without manual marking. For a home network this is a good alternative if you need to reduce latency when the link is loaded overall, rather than to give priority to a single device. How to reserve the link itself is covered in the series “Channel redundancy”.