MikroTik VoIP/SIP QoS
Queue Configuration
Step-by-step guide to configure Quality of Service for VoIP and SIP traffic on MikroTik routers using mangle rules and queue trees.
What this does
VoIP traffic doesn't use much bandwidth, but it's extremely sensitive to latency and jitter. This configuration marks SIP signalling and RTP voice packets using firewall mangle rules, then uses queue trees to guarantee those packets always get priority over general traffic, even when the connection is fully saturated.
Values to customise per site
Check and adjust these values before pasting any commands. Getting these wrong will either break the QoS or have no effect.
| Setting | Example | Notes |
|---|---|---|
| WAN interface (queue parent) | ether1 | The physical or logical interface facing the ISP |
| LAN interface (queue parent) | bridge | The bridge or interface facing the LAN |
| WAN interface list name | WAN | Must already exist with WAN interface as a member |
| Upload speed | 9M | Set to ~90% of actual upload (e.g. 10 Mbps = 9M) |
| Download speed | 48M | Set to ~95% of actual download (e.g. 50 Mbps = 48M) |
| RTP port range | 10000-20000 | Check phone system docs, 10000-20000 covers most |
Step-by-step commands
Disable FastTrack
FastTrack bypasses mangle and queue processing entirely. It must be disabled or VoIP packets will never hit the queues.
/ip firewall filter disable [find action=fasttrack-connection]
Create mangle rules (packet marking)
These rules identify SIP signalling and RTP voice traffic and mark them with directional packet marks for the queue tree.
# SIP Signalling (port 5060 UDP) /ip firewall mangle add action=mark-connection chain=forward protocol=udp dst-port=5060 out-interface-list=WAN new-connection-mark=SIP_Connection_Up passthrough=yes comment="Mark SIP connections upload" add action=mark-connection chain=forward protocol=udp dst-port=5060 in-interface-list=WAN new-connection-mark=SIP_Connection_Down passthrough=yes comment="Mark SIP connections download" add action=mark-packet chain=forward connection-mark=SIP_Connection_Up new-packet-mark=SIP_Packet_Up passthrough=no comment="Mark SIP packets upload" add action=mark-packet chain=forward connection-mark=SIP_Connection_Down new-packet-mark=SIP_Packet_Down passthrough=no comment="Mark SIP packets download" # RTP Voice (ports 10000-20000 UDP) add action=mark-connection chain=forward protocol=udp port=10000-20000 out-interface-list=WAN new-connection-mark=RTP_Connection_Up passthrough=yes comment="Mark RTP connections upload" add action=mark-connection chain=forward protocol=udp port=10000-20000 in-interface-list=WAN new-connection-mark=RTP_Connection_Down passthrough=yes comment="Mark RTP connections download" add action=mark-packet chain=forward connection-mark=RTP_Connection_Up new-packet-mark=RTP_Packet_Up passthrough=no comment="Mark RTP packets upload" add action=mark-packet chain=forward connection-mark=RTP_Connection_Down new-packet-mark=RTP_Packet_Down passthrough=no comment="Mark RTP packets download"
Create queue trees
RTP (voice audio) gets priority 1, SIP signalling gets priority 2, and all other traffic sits at priority 8. Adjust max-limit on parent queues and limit-at on VoIP children to suit the site's connection speed.
# Upload queues (parent = WAN interface) /queue tree add name=Upload parent=ether1 max-limit=9M queue=default comment="Upload parent" add name=VoIP-RTP-Up parent=Upload packet-mark=RTP_Packet_Up priority=1 limit-at=2M max-limit=4M queue=default comment="RTP upload priority 1" add name=VoIP-SIP-Up parent=Upload packet-mark=SIP_Packet_Up priority=2 limit-at=256k max-limit=512k queue=default comment="SIP upload priority 2" add name=Other-Up parent=Upload packet-mark=no-mark priority=8 max-limit=9M queue=default comment="Everything else upload" # Download queues (parent = LAN interface/bridge) add name=Download parent=bridge max-limit=48M queue=default comment="Download parent" add name=VoIP-RTP-Down parent=Download packet-mark=RTP_Packet_Down priority=1 limit-at=2M max-limit=4M queue=default comment="RTP download priority 1" add name=VoIP-SIP-Down parent=Download packet-mark=SIP_Packet_Down priority=2 limit-at=256k max-limit=512k queue=default comment="SIP download priority 2" add name=Other-Down parent=Download packet-mark=no-mark priority=8 max-limit=48M queue=default comment="Everything else download"
Confirm it's working
Run these checks while a VoIP call is active to confirm packets are being matched and queued correctly.
Check mangle rules are matching
Make a call, then run this. Bytes and Packets columns should be incrementing on the RTP and SIP rules.
/ip firewall mangle print stats
Check queue tree stats
VoIP queues should show traffic. The Dropped column should be zero or very low. Use interval=1 to watch live.
/queue tree print stats /queue tree print stats interval=1
Stress test
Make a call, then saturate the connection with a speed test or large file transfer. If QoS is working, the call should remain clear with no dropouts, choppy audio, or one-way audio.
Common issues
Mangle counters showing zero
FastTrack may still be active, or the interface list name doesn't match. Verify FastTrack is disabled and check the WAN interface list has the correct member interface. Also confirm phone traffic is actually traversing the router.
VoIP queues showing high drops
The limit-at (guaranteed bandwidth) may be too low. Each G.711 call uses roughly 90 kbps each direction. Multiply by the number of concurrent calls expected and add headroom.
Simple queues interfering
Simple queues are processed before queue tree rules and can grab traffic first. Check with /queue simple print and remove or adjust any catch-all simple queues covering the same interfaces.
Audio still choppy under load
Ensure parent queue max-limit is set below actual line speed. If it matches or exceeds real throughput, the ISP's gear shapes traffic before the MikroTik can. Try reducing the parent limit further (e.g. 85% of line speed).