Dear Folks,
I just set up my new CCR2216 and everything works so far, except l3hw offload for one specific port: SFP28-4. Behind this port is my home server called “Tycho Station”. He is the target of my NAT rules. Do I have to exclude this port from l3hw offloading like my uplink portSFP28-1 too?
Please find my configuration below. I am not a Mikrotik specialist and may oversee something. Any help is appreciated.
\[admin@MikroTik\] > /export
# 2025-12-13 13:21:19 by RouterOS 7.20.6
# software id = NIIY-ZP86
#
# model = CCR2216-1G-12XS-2XQ
# serial number = HK****
/interface bridge
add name=bridge vlan-filtering=yes
/interface ethernet
set \[ find **default-name**=qsfp28-1-1 \] l2mtu=9570 mtu=9000
set \[ find **default-name**=qsfp28-1-2 \] l2mtu=9570 mtu=9000
set \[ find **default-name**=qsfp28-1-3 \] l2mtu=9570 mtu=9000
set \[ find **default-name**=qsfp28-1-4 \] l2mtu=9570 mtu=9000
set \[ find **default-name**=qsfp28-2-1 \] l2mtu=9570 mtu=9000
set \[ find **default-name**=qsfp28-2-2 \] l2mtu=9570 mtu=9000
set \[ find **default-name**=qsfp28-2-3 \] l2mtu=9570 mtu=9000
set \[ find **default-name**=qsfp28-2-4 \] l2mtu=9570 mtu=9000
set \[ find **default-name**=sfp28-1 \] fec-mode=fec91
set \[ find **default-name**=sfp28-2 \] l2mtu=9570 mtu=9000
set \[ find **default-name**=sfp28-3 \] l2mtu=9570 mtu=9000
set \[ find **default-name**=sfp28-4 \] l2mtu=9570 mtu=9000
set \[ find **default-name**=sfp28-5 \] l2mtu=9570 mtu=9000
set \[ find **default-name**=sfp28-6 \] l2mtu=9570 mtu=9000
set \[ find **default-name**=sfp28-7 \] l2mtu=9570 mtu=9000
set \[ find **default-name**=sfp28-8 \] l2mtu=9570 mtu=9000
set \[ find **default-name**=sfp28-9 \] l2mtu=9570 mtu=9000
set \[ find **default-name**=sfp28-10 \] l2mtu=9570 mtu=9000
set \[ find **default-name**=sfp28-11 \] l2mtu=9570 mtu=9000
set \[ find **default-name**=sfp28-12 \] l2mtu=9570 mtu=9000
/interface wireguard
add listen-port=13231 mtu=1420 name=wg1
/interface vlan
add interface=bridge mtu=9000 name=vlan10 vlan-id=10
add interface=bridge mtu=9000 name=vlan20 vlan-id=20
add interface=bridge mtu=9000 name=vlan99 vlan-id=99
add interface=bridge mtu=9000 name=vlan666 vlan-id=666
/interface ethernet switch port
set 8 l3-hw-offloading=no
/interface list
add name=WAN
add name=MGT
add name=LAN
add name=DMZ
add name=IOT
add name=GST
add name=VPN
/ip pool
add name=dhcp_pool666 ranges=10.66.6.101-10.66.6.200
add name=dhcp_pool1 ranges=10.20.0.2-10.20.0.254
/ip dhcp-server
add address-pool=dhcp_pool666 interface=vlan666 name=dhcp666
add address-pool=dhcp_pool1 interface=vlan20 name=dhcp1
/port
set 0 name=serial0
/interface bridge port
add bridge=bridge interface=sfp28-2 pvid=666
add bridge=bridge interface=sfp28-3 pvid=666
add bridge=bridge comment=Tycho interface=sfp28-4 pvid=10
add bridge=bridge comment="PC B**\\C3\\BC**ro" interface=sfp28-5 pvid=666
add bridge=bridge interface=sfp28-6 pvid=666
add bridge=bridge interface=sfp28-7 pvid=666
add bridge=bridge interface=sfp28-8 pvid=666
add bridge=bridge interface=sfp28-9 pvid=666
add bridge=bridge interface=sfp28-10 pvid=666
add bridge=bridge comment=TV interface=sfp28-11 pvid=666
add bridge=bridge comment=Accesspoint frame-types=admit-only-vlan-tagged interface=sfp28-12 pvid=99
add bridge=bridge interface=qsfp28-1-1 pvid=666
add bridge=bridge interface=qsfp28-1-2 pvid=666
add bridge=bridge interface=qsfp28-1-3 pvid=666
add bridge=bridge interface=qsfp28-1-4 pvid=666
add bridge=bridge interface=qsfp28-2-1 pvid=666
add bridge=bridge interface=qsfp28-2-2 pvid=666
add bridge=bridge interface=qsfp28-2-3 pvid=666
add bridge=bridge interface=qsfp28-2-4 pvid=666
/interface ethernet switch l3hw-settings
set ipv6-hw=yes
/interface bridge vlan
add bridge=bridge tagged=bridge,sfp28-12 untagged="sfp28-2,sfp28-3,sfp28-5,sfp28-6,sfp28-7,sfp28-8,sfp28-9,sfp28-10,sfp28-11,qsfp28-1-1,qsfp28-1-2,qsfp28-**\\**
1-3,qsfp28-1-4,qsfp28-2-1,qsfp28-2-2,qsfp28-2-3,qsfp28-2-4" vlan-ids=666
add bridge=bridge tagged=bridge,sfp28-12 vlan-ids=99
add bridge=bridge tagged=bridge untagged=sfp28-4 vlan-ids=10
/interface list member
add interface=sfp28-1 list=WAN
add interface=sfp28-2 list=LAN
add interface=sfp28-3 list=LAN
add interface=sfp28-4 list=DMZ
add interface=sfp28-5 list=LAN
add interface=sfp28-6 list=LAN
add interface=sfp28-7 list=LAN
add interface=sfp28-8 list=LAN
add interface=sfp28-9 list=LAN
add interface=sfp28-10 list=LAN
add interface=sfp28-11 list=LAN
add interface=sfp28-12 list=LAN
add interface=qsfp28-1-1 list=LAN
add interface=qsfp28-1-2 list=LAN
add interface=qsfp28-1-3 list=LAN
add interface=qsfp28-1-4 list=LAN
add interface=qsfp28-2-4 list=LAN
add interface=qsfp28-2-3 list=LAN
add interface=qsfp28-2-2 list=LAN
add interface=qsfp28-2-1 list=LAN
add interface=ether1 list=MGT
/interface wireguard peers
add allowed-address=10.254.0.4/24 endpoint-address="" interface=wg1 name=peer1 public-key="SNIP"
add allowed-address=10.254.0.2/24 endpoint-address="" interface=wg1 name=peer2 public-key="SNIP"
add allowed-address=10.254.0.3/24 endpoint-address="" interface=wg1 name=peer3 public-key="SNIP"
/ip address
add address=192.168.88.1/24 comment=defconf interface=ether1 network=192.168.88.0
add address=10.66.6.1/24 interface=vlan666 network=10.66.6.0
add address=10.10.1.1/24 interface=vlan10 network=10.10.1.0
add address=10.20.0.1/24 interface=vlan20 network=10.20.0.0
/ip dhcp-client
add interface=sfp28-1
/ip dhcp-server network
add address=10.20.0.0/24 dns-server=SNIP gateway=10.20.0.1
add address=10.66.6.0/24 dns-server=SNIP gateway=10.66.6.1
/ip firewall filter
add action=fasttrack-connection chain=forward connection-state=established,related hw-offload=yes
add action=accept chain=forward connection-state=established,related
add action=accept chain=input comment="allow WireGuard" dst-port=13231 protocol=udp
add action=accept chain=input comment="allow SNMP to Router" dst-address=10.10.1.1 dst-port=161 log=yes log-prefix=SNMP protocol=udp src-address=**\\**
10.10.1.0/24
add action=accept chain=input comment="allow Mgmt" dst-address=10.10.1.1 protocol=tcp src-address=10.10.1.0/24
add action=drop chain=input comment="Drop Invalid connections" connection-state=invalid
add action=drop chain=input in-interface=sfp28-1
/ip firewall nat
add action=masquerade chain=srcnat out-interface=sfp28-1
add action=dst-nat chain=dstnat comment="NAT to Tycho" disabled=yes dst-address=77.109.170.61 dst-port=666 protocol=tcp to-addresses=10.10.1.40 to-ports=**\\**
32400
add action=dst-nat chain=dstnat dst-address=77.109.170.61 dst-port=443 protocol=tcp to-addresses=10.10.1.40 to-ports=8443
add action=dst-nat chain=dstnat dst-address=77.109.170.61 dst-port=80 protocol=tcp to-addresses=10.10.1.40 to-ports=8080
add action=dst-nat chain=dstnat dst-address=77.109.170.61 dst-port=50051 protocol=tcp to-addresses=10.10.1.40 to-ports=50051
/ipv6 address
add from-pool=v6pool interface=vlan666
add from-pool=v6pool interface=vlan10
/ipv6 dhcp-client
add add-default-route=yes interface=sfp28-1 pool-name=v6pool pool-prefix-length=56 request=address,prefix
/ipv6 dhcp-server
add address-pool=v6pool interface=vlan666 name=v6server666
/ipv6 firewall filter
add action=accept chain=forward connection-state=established,related in-interface-list=WAN out-interface-list=LAN
add action=drop chain=forward in-interface-list=WAN out-interface-list=LAN
/ipv6 nd
set \[ find **default**=yes \] interface=vlan666 managed-address-configuration=yes mtu=9000 other-configuration=yes
/system clock
set time-zone-name=Europe/Zurich
/system ntp client
set enabled=yes
/system ntp client servers
add address=ntp.metas.ch
/system routerboard settings
set enter-setup-on=delete-key
Best regards and in hope for WiFi7 AP from Mikrotik soon
ei8ht
Removed serial number from the listing. Not need to share it.