Can limiting be done at the tunnel level?

• A. No
• B. Only on the physical link
• C. Yes
• D. Only on the client side

Answer: (C)

Limiting can be applied to the tunnel interface because in RouterOS a tunnel is a virtual interface just like any other. Traffic control (queues) is attached to interfaces, so you can create a queue on the tunnel (for example, a VPN or GRE/IPsec tunnel) to cap the total bandwidth that traverses that tunnel. This means the combined traffic across that tunnel is limited to the set rate, regardless of the physical link beneath it or how many clients' packets ride through it. It’s a practical way to ensure a VPN link doesn’t hog all the bandwidth on a shared edge, while you can still add additional per-client or per-device controls if finer granularity is needed.