Kernaali ToolsIf a queue or routing policy works only with FastTrack disabled, first check whether that connection needs a processing stage that FastTrack bypasses. Exclude the required traffic from FastTrack while preserving the existing rules that authorize new connections.
Applies to: RouterOS 7 IPv4 TCP/UDP software FastTrack, simple queues, global queue trees and policy routing outside the main table. Hardware-specific offload is covered separately. IPv6 and interface-parent queue designs need their own path review.
Validation: documentation-checked on . No device or lab test is claimed. Version references identify the documentation checked, not a firmware upgrade recommendation.
Establish which feature the connection needs
| Observation | Interpretation | Next check |
|---|---|---|
| Simple queue counts a few packets but does not enforce the rate | Some packets still take the slow path; a nonzero counter is insufficient | Compare the sustained test rate and FastTrack rule counters |
| A marked connection uses the main-table WAN | FastTrack supports the main routing table and performs its lookup before routing marks | Exclude the intended non-main-table traffic |
| Interface queue exists but its marked classes remain empty | Interface-parent exceptions do not preserve mangle packet marks | Check whether class selection depends on bypassed marking |
| Throughput changes while Torch runs | The diagnostic tool may suppress FastTrack | Stop the tool before the final comparison |
The official FastTrack packet-flow section lists bypassed facilities, including simple queues, global queue trees, IPsec and VRF assignment. Do not infer complete processing from occasional slow-path packets.
Inspect rule order and one test connection
/ip/firewall/filter/print stats where chain=forward
/ip/firewall/mangle/print stats
/queue/simple/print stats
/routing/rule/print detailUse a single authorized client and destination with a known protocol and rate. Record the matching filter, mangle, queue and routing rules. Identify every FastTrack action that could see this connection, and check whether an earlier accept already ends processing. Do not add a second generic FastTrack rule to fix a queue problem.
Exclude the smallest required set of established flows
For a synthetic client 192.0.2.10 whose traffic must always be shaped, an existing established/related accept exception before FastTrack can keep both directions in the normal path. Review the real rule identifiers and placement before using this template; <fasttrack-rule-id> is a placeholder for one verified rule, not a runnable value.
/ip/firewall/filter
add chain=forward action=accept connection-state=established,related src-address=192.0.2.10 place-before=<fasttrack-rule-id> comment="example-client slow path outbound"
add chain=forward action=accept connection-state=established,related dst-address=192.0.2.10 place-before=<fasttrack-rule-id> comment="example-client slow path return"This bypasses FastTrack for established/related traffic involving that host; it does not grant new connections. Keep the original new-connection policy. For policy routing, choose a precise subnet or connection-mark match representing the affected flows instead of exempting the entire LAN. Review an established accept against any deliberate later restrictions in your existing design.
Use a new session and retain a rollback
An already FastTracked connection can remain in that state until it closes or times out. Close the test application and establish a genuinely new connection; do not clear all connection tracking. Verify the actual application uses the intended WAN and that a sustained transfer obeys the queue, while unrelated clients retain their expected behavior.
Watch CPU use because removing acceleration increases processing load. Record the two added rule IDs and remove only those exceptions to roll back; restore any other deliberately edited match exactly. Stop diagnostic tools after collecting the bounded evidence. A reboot is not needed to prove the configuration path.
Check model-specific offload support · Review input and forward policy
Technical references
Found an issue? Send a correction with a reproducible example.