Marking each packet is quite resource expensive especially if rule has to match against many parameters from IP header or address list containing hundreds of entries.
Lets say we want to
- mark all tcp packets except tcp/80 and match these packets against first address list
- mark all udp packets and match them against second address list.
/ip firewall mangle
add chain=forward protocol=tcp port=!80 dst-address-list=first action=mark-packet new-packet-mark=first
add chain=forward protocol=udp dst-address-list=second action=mark-packet new-packet-mark=second
Setup looks quite simple and probably will work without problems in small networks. Now multiply count of rules by 10, add few hundred entries in address list, run 100Mbit of traffic over this router and you will see how rapidly CPU usage is increasing. The reason for such behavior is that each rule reads IP header of every packet and tries to match collected data against parameters specified in firewall rule.
Fortunately if connection tracking is enabled, we can use connection marks to optimize our setup.
/ip firewall mangle
add chain=forward protocol=tcp port=!80 dst-address-list=first connection-state=new action=mark-connection \
new-connection-mark=first
add chain=forward connection-mark=first action=mark-packet new-packet-mark=first passthrough=no
add chain=forward protocol=udp dst-address-list=second connection-state=new action=mark-connection \
new-connection-mark=second
add chain=forward connection-mark=second action=mark-packet new-packet-mark=second passthrough=no
Now first rule will try to match data from IP header only from first packet of new connection and add connection mark. Next rule will no longer check IP header for each packet, it will just compare connection marks resulting in lower CPU consumption. Additionally passthrough=no was added that helps to reduce CPU consumption even more.
sumber: mikrotik.com