Extremely poor WiFi of MacBook Pro M1 PRO

smotrov · February 13, 2023, 8:34pm

UPDATE: Majority of my devices working well with hAP ax². However, MBP keeps running on about a half of possible speed.

Couple of month ago I become a happy owner of hAP ax²
This is my first Mikrotik device.

After few weeks of juggling with it and digging through an enormous amount of various settings nothing helps.
Here is my ISP speed (patch cord plugged into hAP ->> MacBook M1 PRO)
Знімок екрана 2023-02-13 о 21.33.07.png
All I can get over WiFi a 1 meter away from the router is
Знімок екрана 2023-02-13 о 22.01.19.png

I’ve been playing with, different versions of packages, WiFi channels, other things found on this forum, however nothing helps. The maximum I can get is 400Mb/s download speed out of 800Mb/s.

Dear Guru, I will infinitely appreciate it if you’ll point me to what is wrong with my settings

[admin@MikroTik] > export hide-sensitive 
# feb/13/2023 22:32:50 by RouterOS 7.7
# software id = AHJZ-PQ1I
#
# model = C52iG-5HaxD2HaxD
# serial number = HERE_IS_MY_SERIAL
/interface bridge
add admin-mac=18:FD:74:BB:CB:C9 auto-mac=no comment=defconf name=bridge
/interface wifiwave2
set [ find default-name=wifi2 ] channel.band=2ghz-ax .frequency=2412 .skip-dfs-channels=10min-cac .width=20/40mhz \
    configuration.country=Ukraine .mode=ap .ssid="AirPort Extreme Slow" disabled=no name=Private2GHz \
    security.authentication-types=wpa2-psk,wpa3-psk .wps=push-button
set [ find default-name=wifi1 ] channel.band=5ghz-ax .frequency=5745-5805 .skip-dfs-channels=all .width=20/40/80mhz \
    configuration.country=Ukraine .mode=ap .ssid="AirPort Extreme" disabled=no name=Private5GHz \
    security.authentication-types=wpa2-psk,wpa3-psk
add configuration.chains="" .country=Ukraine .mode=ap .ssid="Glory to Ukraine app.191" disabled=no mac-address=\
    1A:FD:74:BB:CB:CE master-interface=Private2GHz name=Guest2GHz security.authentication-types="" .ft=yes
add configuration.country=Ukraine .mode=ap .ssid="Glory to Ukraine app.191" disabled=no mac-address=1A:FD:74:BB:CB:CD \
    master-interface=Private5GHz name=Guest5GHz security.ft=yes
/interface list
add comment=defconf name=WAN
add comment=defconf name=LAN
/ip pool
add name=dhcp ranges=192.168.88.10-192.168.88.254
/ip dhcp-server
add address-pool=dhcp interface=bridge lease-time=1w name=defconf
/port
set 0 name=serial0
/interface bridge filter
add action=drop chain=forward in-interface=Guest5GHz
add action=drop chain=forward out-interface=Guest5GHz
add action=drop chain=forward in-interface=Guest2GHz
add action=drop chain=forward out-interface=Guest2GHz
/interface bridge port
add bridge=bridge comment=defconf interface=ether2
add bridge=bridge comment=defconf interface=ether3
add bridge=bridge comment=defconf interface=ether4
add bridge=bridge comment=defconf interface=ether5
add bridge=bridge comment=defconf interface=Private5GHz
add bridge=bridge comment=defconf interface=Private2GHz
add bridge=bridge interface=Guest5GHz
add bridge=bridge interface=Guest2GHz
/ip neighbor discovery-settings
set discover-interface-list=LAN
/interface detect-internet
set detect-interface-list=all internet-interface-list=all lan-interface-list=all wan-interface-list=all
/interface list member
add comment=defconf interface=bridge list=LAN
add comment=defconf interface=ether1 list=WAN
/ip address
add address=192.168.88.1/24 comment=defconf interface=bridge network=192.168.88.0
/ip dhcp-client
add comment=defconf interface=ether1
/ip dhcp-server network
add address=192.168.88.0/24 comment=defconf dns-server=8.8.8.8,8.8.4.4,9.9.9.9 gateway=192.168.88.1
/ip dns
set allow-remote-requests=yes servers=8.8.8.8,8.8.8.4,9.9.9.9
/ip dns static
add address=192.168.88.1 comment=defconf name=router.lan
/ip firewall filter
add action=accept chain=input comment="defconf: accept established,related,untracked" connection-state=\
    established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=invalid
add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp
add action=accept chain=input comment="defconf: accept to local loopback (for CAPsMAN)" dst-address=127.0.0.1
add action=drop chain=input comment="defconf: drop all not coming from LAN" in-interface-list=!LAN
add action=accept chain=forward comment="defconf: accept in ipsec policy" ipsec-policy=in,ipsec
add action=accept chain=forward comment="defconf: accept out ipsec policy" ipsec-policy=out,ipsec
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" connection-state=established,related \
    hw-offload=yes
add action=accept chain=forward comment="defconf: accept established,related, untracked" connection-state=\
    established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" connection-state=invalid
add action=drop chain=forward comment="defconf: drop all from WAN not DSTNATed" connection-nat-state=!dstnat \
    connection-state=new in-interface-list=WAN
/ip firewall nat
add action=masquerade chain=srcnat comment="defconf: masquerade" ipsec-policy=out,none out-interface-list=WAN
/ip service
set www-ssl certificate=Webfig disabled=no
/ip upnp interfaces
add interface=bridge type=internal
add interface=ether1 type=external
/ipv6 firewall address-list
add address=::/128 comment="defconf: unspecified address" list=bad_ipv6
add address=::1/128 comment="defconf: lo" list=bad_ipv6
add address=fec0::/10 comment="defconf: site-local" list=bad_ipv6
add address=::ffff:0.0.0.0/96 comment="defconf: ipv4-mapped" list=bad_ipv6
add address=::/96 comment="defconf: ipv4 compat" list=bad_ipv6
add address=100::/64 comment="defconf: discard only " list=bad_ipv6
add address=2001:db8::/32 comment="defconf: documentation" list=bad_ipv6
add address=2001:10::/28 comment="defconf: ORCHID" list=bad_ipv6
add address=3ffe::/16 comment="defconf: 6bone" list=bad_ipv6
/ipv6 firewall filter
add action=accept chain=input comment="defconf: accept established,related,untracked" connection-state=\
    established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=invalid
add action=accept chain=input comment="defconf: accept ICMPv6" protocol=icmpv6
add action=accept chain=input comment="defconf: accept UDP traceroute" port=33434-33534 protocol=udp
add action=accept chain=input comment="defconf: accept DHCPv6-Client prefix delegation." dst-port=546 protocol=udp \
    src-address=fe80::/10
add action=accept chain=input comment="defconf: accept IKE" dst-port=500,4500 protocol=udp
add action=accept chain=input comment="defconf: accept ipsec AH" protocol=ipsec-ah
add action=accept chain=input comment="defconf: accept ipsec ESP" protocol=ipsec-esp
add action=accept chain=input comment="defconf: accept all that matches ipsec policy" ipsec-policy=in,ipsec
add action=drop chain=input comment="defconf: drop everything else not coming from LAN" in-interface-list=!LAN
add action=accept chain=forward comment="defconf: accept established,related,untracked" connection-state=\
    established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" connection-state=invalid
add action=drop chain=forward comment="defconf: drop packets with bad src ipv6" src-address-list=bad_ipv6
add action=drop chain=forward comment="defconf: drop packets with bad dst ipv6" dst-address-list=bad_ipv6
add action=drop chain=forward comment="defconf: rfc4890 drop hop-limit=1" hop-limit=equal:1 protocol=icmpv6
add action=accept chain=forward comment="defconf: accept ICMPv6" protocol=icmpv6
add action=accept chain=forward comment="defconf: accept HIP" protocol=139
add action=accept chain=forward comment="defconf: accept IKE" dst-port=500,4500 protocol=udp
add action=accept chain=forward comment="defconf: accept ipsec AH" protocol=ipsec-ah
add action=accept chain=forward comment="defconf: accept ipsec ESP" protocol=ipsec-esp
add action=accept chain=forward comment="defconf: accept all that matches ipsec policy" ipsec-policy=in,ipsec
add action=drop chain=forward comment="defconf: drop everything else not coming from LAN" in-interface-list=!LAN
/system clock
set time-zone-name=Europe/Kiev
/system logging
add action=disk topics=critical
add action=disk topics=error
add action=disk topics=warning
/system watchdog
set automatic-supout=no watchdog-timer=no
/tool graphing interface
add
/tool graphing queue
add
/tool graphing resource
add
/tool mac-server
set allowed-interface-list=LAN
/tool mac-server mac-winbox
set allowed-interface-list=LAN

erlinden · February 14, 2023, 7:59am

Instead of using speedtest, you better test with a tool like iPerf. That will give a better indication of the wireless speed.
I’ll check your config in the mean time…

smotrov · February 14, 2023, 11:39am

Well… It seams like the root of the problem is not hAP ax². It is my Apple MacBook Pro M1 Pro.
As far as it is my main device, I’ve used it for all tests. However it figures out that other devices (like Apple TV 4K) produces maximum ISP speed easily in the same physical condition on hAP ax².
Here is not the best example.
Apple TV.jpg
So, I believe everything OK with hAP ax².
In the meanwhile, nothing helps with Apple MacBook Pro M1 Pro.

seriquiti · February 14, 2023, 12:22pm

I have seen a few times where some devices connect to Mikrotik AP’s in reduced Channel Width and Chains.

Could be what is happening with your Macbook. As for a solution - I have yet to find one if there are any.

anav · February 14, 2023, 12:27pm

You should change the title of the thread.

Extremely poor wifi performance by my Macbook NOT the hAP ax2 !!

smotrov · February 14, 2023, 1:19pm

That’s what I’ve tried to do immediately. Unfortunately I didn’t found how to change title here, or delete post either…

anav · February 14, 2023, 1:23pm

Go to your first post and select edit. The title will be changeable there…

Amm0 · February 14, 2023, 3:36pm

I suspect the difference is how each device processes TCP packets (which is what web pages use), not the Wi-Fi per se. TCP is complex topic, but it’s likely the cause of your difference.

If you play with the length of time the speediest runs (e.g. fast.com & others let’s you do this in the settings button), you’ll start see similar results as you increase the length of time I suspect (assuming devices have similar wi-fi hardware e.g. ax, at high MCS.)

Specific your MacBook… MacOS has historically use a different TCP congestion control mechanisms than iOS. But all OSes make some choices on TCP, and in the short span of speediest.com, you’ll see the TCP choices more dramatically displayed. You can somewhat control this by using queues on the Mikrotik, but different topic.

Anyway why other recommend iPerf, which is great/simple tool. But it’s really the length of time you run the speed that matter most, at least for TCP.

k6ccc · February 14, 2023, 7:39pm

Absolutely, different devices (and operating systems) will behave differently over WiFi. Last time I tried it at home, I was able to get anywhere from 150 - about 500 Mb/s depending on which device it was. And a wired connection will essentially always do better than a WiFi connection.
That reminds me, I have not tested that on my newer devices…

theprojectgroup · February 16, 2023, 1:53pm

I have similar issues described here and I don’t think it’s a platform issue.

See my iperf3 results. It looks like it’s an issue of bridging the 2.5GbE port (ether1) with wifi1 and TCP.
http://forum.mikrotik.com/t/mikrotik-hap-ax3-poor-wifi-performance/163692/44

iperf3 TCP download via bridge & 2.5GbE is really bad
iperf3 TCP download via bridge & 1GbE is really good
iperf3 TCP upload via birdge is really good
iperf3 UDP download via bridge is really good
iperf3 TCP download via NAT is at least good enough to saturate my WAN connection (ether5)

Is your WAN port the 2.5GbE port?
Can you test with iperf3 and UDP / TCP?

Amm0 · February 16, 2023, 7:38pm

Not discounting the possibility the ether1 port could could act different/slow. And the Marvel inside is pretty complex beast, so possible But million reasons why a few tests get different results for TCP performance. A few speedtest does always paint the full picture of network performance.

Couple questions:

If you iperf between two local ethernet ports does it to get line rate with TCP? Removing the vagaries about your specific internet connection, this let your test the theory it’s the ether1 with TCP that an issue – the Marvel don’t care if the TCP traffic is going to the internet or not, still just TCP packets.

When you iperf did you try to run the test at various time intervals? To get a true since of the TCP speed, you need to let it have a chance to open the window (which how/when is certainly impacted by the OS (& network interface too, since switch/ethernet chips often do TCP offloading too). e.g. how do the iperf results vary at 30s, 1m, and 5m runtime? Default of 10s is WAY too short to get anything meaningful for TCP.

If you want to dig deeper, netserver + flent (https://flent.org) let’s to you some different traffic scenarios (and graphs the results).

normis · February 17, 2023, 11:00am

I can easily get 750Mbit over WiFi with Macbook Pro M1 Pro using the hAP ax2, so ax3 should be similar. Try other country setting, in case Ukraine has some limitations I don’t know about, try other frequencies on 5GHz

theprojectgroup · February 17, 2023, 11:15am

@normis

Is there any overview available of possible frequencies?
https://help.mikrotik.com/docs/display/ROS/WifiWave2#WifiWave2-Channelproperties

Can you please share your wireless and bridge settings?

holvoetn · February 17, 2023, 12:12pm

It used to be under submenu info country-info. This has been removed.
Extended info will become available again under /interface/wifiwave2/radio print detail (which you can already use now, except it’s not country filtered)
That’s the response I got when I asked about it.

See http://forum.mikrotik.com/t/v7-8rc-is-released/164314/48

Amm0 · February 17, 2023, 12:20pm

I’m not sure it’s even legal to change the country in same places. At least in the US, you shouldn’t do this.

Run some more test, get a better sense of speeds by using a longer test time before messing with the Wi-Fi county settings. If you have congestion, use a different channel first.

holvoetn · February 17, 2023, 12:23pm

In most countries it’s not allowed.

massinia · February 17, 2023, 2:56pm

I confirm, this is my MacBook Pro with M1 Pro and hAP ax3

I changed only: country, ssid and password.

EDIT: I have the same problem but only with wireless channels above 100, try to setting a range for the frequency.

esj · February 18, 2023, 2:51pm

Hi Normis, As per theprojectgroup’s request, would you please provide your wifi setings? I’m suffering too with the hAP ax3