Recently I upgraded my network from 50/3 Mbps to 300/20 Mbps (just to increase upload performance). The issue is, I can observe huge difference in speed.
I tried measurement directly connected to ISP modem, I can measure ~ 300/20 Mbps, but once I connect behind my Mikrotik, speed is around 200/20 Mbps (!!!).
Topology is: ISP << coax >> Modem (bridge) << CAT 6a >> RB2011 << CAT 6a >> LAN (/WLAN)
Eth1 is main (to ISP modem), Eth2+ are in bridge.
OS: 6.42.3 (stable)
I run only few services on my Mikrotik, 4 firewall rules and one NAT (masquerade):
[xxx@MT2011] /ip firewall filter> print
Flags: X - disabled, I - invalid, D - dynamic
0 ;;; SSH
chain=input action=drop protocol=tcp in-interface=ether1 dst-port=22 log=no log-prefix=""
1 ;;; HTTP
chain=input action=drop protocol=tcp in-interface=ether1 dst-port=80 log=no log-prefix=""
2 ;;; DNS (TCP)
chain=input action=drop protocol=tcp in-interface=ether1 dst-port=53 log=no log-prefix=""
3 ;;; DNS (UDP)
chain=input action=drop protocol=udp in-interface=ether1 dst-port=53 log=no log-prefix=""
/ip firewall nat> print
Flags: X - disabled, I - invalid, D - dynamic
0 chain=srcnat action=masquerade src-address=10.0.80.0/24 log=no log-prefix=""
//UPDATE: Once I turn off all firewall rules, the performance is the same! CPU is utilized to max 60 - 70 %.
Do you have any advice how to increase performance over the LAN?
Or do I have to upgrade to something better?
Over WLAN I can measure ~30/20 Mbps, which is slow but it’s 2.4 GHz, so OK.
Keep in mind though, that 300Mbit line speed can result in ~290 Mbps in speed test because of tcp/ip overhead.
@Note, there is no mention of mangle rules in this case, you are just guessing (repeatedly).
Fasttrack is a fine solution with limitations outlined in the linked document (yes, including mangle rules).
You have some orphaned vlans on bridge, but what is worse.. no adequate firewalling (accepting all but http, ssh and dns to router and internal network).
Better take a look at the firewall from default configuration, it contains firewall list based protection and srcnat, allows dstnat (port forwarding) and enables fasttrack with correct ipsec exemptions.
From /system default-configuration print:
/ip firewall nat add chain=srcnat out-interface-list=WAN ipsec-policy=out,none action=masquerade comment="defconf: masquerade"
/ip firewall {
filter add chain=input action=accept connection-state=established,related,untracked comment="defconf: accept established,related,untracked"
filter add chain=input action=drop connection-state=invalid comment="defconf: drop invalid"
filter add chain=input action=accept protocol=icmp comment="defconf: accept ICMP"
filter add chain=input action=drop in-interface-list=!LAN comment="defconf: drop all not coming from LAN"
filter add chain=forward action=accept ipsec-policy=in,ipsec comment="defconf: accept in ipsec policy"
filter add chain=forward action=accept ipsec-policy=out,ipsec comment="defconf: accept out ipsec policy"
filter add chain=forward action=fasttrack-connection connection-state=established,related comment="defconf: fasttrack"
filter add chain=forward action=accept connection-state=established,related,untracked comment="defconf: accept established,related, untracked"
filter add chain=forward action=drop connection-state=invalid comment="defconf: drop invalid"
filter add chain=forward action=drop connection-state=new connection-nat-state=!dstnat in-interface-list=WAN comment="defconf: drop all from WAN not DSTNATed"
}
