RadiusNest › Guides

MikroTik speed limit not working: FastTrack and other causes

Last updated: 2 October 2026

You set a limit and the customer still gets full speed. On a router with the default configuration the cause is nearly always FastTrack. This page shows how to confirm that, two ways to fix it, and the other causes to check when FastTrack is not to blame.

Before you change a live router: take a backup (how) and turn on Safe Mode in Winbox, so a mistake that locks you out is undone by itself.

What FastTrack does

FastTrack is a firewall rule that lets packets of established connections take a short cut through the router. It saves a lot of processor, and it skips queues, most firewall rules and traffic counters on the way. A queue cannot slow down traffic it never sees.

Check for it

/ip firewall filter print where action=fasttrack-connection
/ip firewall filter print stats where action=fasttrack-connection

If a rule is listed, is not disabled, and its packet counter is climbing, FastTrack is active. A second sign: your queue shows almost no bytes while the customer is clearly downloading.

/queue simple print stats

Fix 1: disable FastTrack

/ip firewall filter disable [find action=fasttrack-connection]

All traffic now passes the queues. Connections that were already on the short cut stay there until they end, so test with a new download, or wait a minute. The cost is processor: on a small router with a fast line, watch the load afterwards.

/system resource print

Fix 2: keep FastTrack, but not for limited addresses

If only part of the network is limited, leave FastTrack on for the rest. Put the limited addresses in a list and tell the FastTrack rule to skip them in both directions:

/ip firewall address-list add list=limited address=192.168.88.0/24
/ip firewall filter set [find action=fasttrack-connection] src-address-list=!limited dst-address-list=!limited

Packets from or to a limited address no longer match the rule and pass the queues. Everything else, such as your own office network, keeps the short cut. Add your hotspot and PPPoE customer ranges to the list as well if those customers have speed limits.

If it is not FastTrack

  • Queue order. Simple queues are read from the top and the first match wins. A network-wide queue above a single-address queue hides it. Move the specific one up. See simple queue vs queue tree.
  • Wrong target. The target must be the customer's own address or network, not the router's address and not the public address. If the device's address changed, the queue points at nothing: give it a static lease.
  • Limits the wrong way round. max-limit=2M/5M is upload/download for the target. Swapped figures give a slow download and a fast upload.
  • The traffic does not pass through the router. Two devices on the same switch or bridge talk to each other directly. A copy between two computers in one network is not limited by an address-based queue.
  • The queue is disabled or invalid. It shows X or I in the list, often after an interface was renamed or removed.
  • A queue tree with no marks. If the mangle rule that marks the packets is missing, disabled or below a rule that stops processing, the tree has nothing to limit.
  • The customer bursts. A short test shows the burst speed, not the plan. See burst explained.
/queue simple print
/queue tree print stats
/ip firewall mangle print stats

Test it properly

  1. Start a long download on the limited device, not a five-second speed test.
  2. Watch the queue: its rate should sit at the limit and its byte counter should climb.
  3. Check upload separately.

For measuring what the line itself delivers, see testing real speed.

Hotspot and PPPoE customers

The dynamic queues the router makes for logged-in customers are simple queues like any other, and FastTrack skips them the same way. If customers on a profile with a rate-limit get full speed, use fix 1 or fix 2.

Where RadiusNest fits

RadiusNest sends each customer's package speed to the router at login, and the router does the limiting with its own queues. That means a FastTrack rule can make the limits appear not to work, exactly as with profiles on the router. The check and the two fixes above apply unchanged.

Start the free trial See pricing

Questions and answers

How do I know if FastTrack is on?

Run /ip firewall filter print where action=fasttrack-connection. An enabled rule with a rising packet counter means it is active.

Will disabling FastTrack slow my router down?

It raises processor use, because every packet takes the full path. Most routers cope at ordinary line speeds; check the load after the change.

Why does the limit work for new downloads but not the one already running?

A connection that was already fasttracked keeps its short cut until it ends. New connections follow the changed rule.

Related guides

Start the free trial See pricing