FastTrack - New feature in 6.29

[tron]

I run it on RB2011UAS-2HnD and it works.
fasttrack-works.png

[visalink]

@tron

visalink: How does/do your firewall rule/rules look like?

or

Did you use CCR device? FastTrack will work properly on CCR devices starting from 6.29rc14 version.

ip/firewall/filter
chain=forward action=fasttrack-connection connection-state=established,related log=no log-prefix=“”
chain=forward action=accept connection-state=established,related log=no log-prefix=“”

Only a test in RB750g, no result…

[KBV]

I feel there is some kind of trick

[Ulypka]

On rb333 don’t work.
ip fi filter print stats
1 forward fasttrack-connection 282 362 923 317 144
2 input accept 6 086 144 43 102
ip settings pr
ip-forward: yes
send-redirects: yes
accept-source-route: no
accept-redirects: no
secure-redirects: yes
rp-filter: no
tcp-syncookies: no
max-arp-entries: 8192
arp-timeout: 30s
icmp-rate-limit: 10
icmp-rate-mask: 0x1818
allow-fast-path: yes
ipv4-fast-path-active: no
ipv4-fast-path-packets: 0
ipv4-fast-path-bytes: 0
ipv4-fasttrack-active: yes
ipv4-fasttrack-packets: 0
ipv4-fasttrack-bytes: 0

[105547111]

It won’t work unless there is some NAT, Bridges involved in your traffic, plus 6.29B13 upwards, plus of course accepting the fast-track in the filter rules..

For example Ive got 4 more MTs downstream in my network, but its only the one using NAT that it works on as its masquerading.

Ive not put in a single mangle rule for this, I have mangle rules for other routing, but merely putting in the filter rule to accept fast-track and its gone nuts - this in a great way. Yes I have noticed a throughput increase and BIG CPU drop in high use.

[kez]

Tested on my old and good RB333, but it seens it is not working.
I have a PPPoE client connection, so a dynamic mangle rule to “change MSS” to 1452.
Does it matter?
And yes, the counters are running for all filter rules.

[admin@RB333] > ip fi fi pri
Flags: X - disabled, I - invalid, D - dynamic 
 0    chain=forward action=fasttrack-connection connection-state=established,related log=no log-prefix="" 
 1    chain=forward action=accept connection-state=established,related log=no log-prefix="" 
 2    chain=forward action=drop connection-state=invalid log=no log-prefix="" 
 [admin@NALTECSAT] > ip set pri  
ip-forward: yes
send-redirects: yes
accept-source-route: no
accept-redirects: no
secure-redirects: yes
rp-filter: no
tcp-syncookies: no
max-arp-entries: 8192
arp-timeout: 30s
icmp-rate-limit: 10
icmp-rate-mask: 0x1818
allow-fast-path: yes
ipv4-fast-path-active: no
ipv4-fast-path-packets: 0
ipv4-fast-path-bytes: 0
ipv4-fasttrack-active: yes
ipv4-fasttrack-packets: 0
ipv4-fasttrack-bytes: 0

[macgaiver]

@KBV

@macgaiver

It is not about filter rules, it is also about NAT. Basically it is fastpath solution when connection tracking is necessary

Connection tracking can operate without NAT, It is rather a function of the “Full State Firewall”
If the FS firewall and NAT is not necessary, tracking is better forcibly disable

i think you misunderstood me - RB75x, RB95x, RB2011, hAP, mAP, cAP - most common setups on these boards includes masquerade rule and some firewall filters. So with this FastTrack feature you “magically” make them much faster. So i expect that default configuration (from factory), will have it enabled by default.

I did some testing, on FastTrack, I have 500Mbps connection at the office, sitting on CCR1009, for a test purpose i replaced it with RB2011, and run some “linux distribution” torrent download this morning.

Without FastTrack - 220-240Mbps download with CPU 100%
With FastTrack - 460-500Mbps (full pipe) download with CPU 56-84%

As i need queues and IPsec i switched back to CCR1009, but this opens lots of possibilities..

[macgaiver]

@kez

Tested on my old and good RB333, but it seens it is not working.
I have a PPPoE client connection, so a dynamic mangle rule to “change MSS” to 1452.
Does it matter?
And yes, the counters are running for all filter rules.

This is just a theory..

1. FastTrack is a Conntrack extension of FastPath,
2. FastPath requires in and out interface support to work
3. pppoe-client doesn’t have FastPath support

Result:
fasttrack doesn’t work on pppoe-clients

[CyberTod]

These results sound very promising. But can only be used in some configurations. The typical home router can benefit a lot.
But for example I want to somehow use this on ptp wireless connections, because i have a mangle rule to set nv2 priority from dscp for QoS. And as this changes header of all packets I guess fasttrack is not possible in this scenario ?

[macgaiver]

@CyberTod

These results sound very promising. But can only be used in some configurations. The typical home router can benefit a lot.
But for example I want to somehow use this on ptp wireless connections, because i have a mangle rule to set nv2 priority from dscp for QoS. And as this changes header of all packets I guess fasttrack is not possible in this scenario ?

I do not think it is possible, only changes made by ConnTrack is supported, in your case those are custom changes.

But it is a firewall action, so you can basically use it in any place where you have “accept everything else” logic just add “fasttrack everything else” rule before the accept.

[fposavec]

I tryed 6.29rc14 today, no joy
RB951G, cpu on 100%, routing take all cpu .
fast-track counting packages, but on ip settings no counter

I use VPLS/MPLS on this router

[strods]

At this moment FastTrack is not working on PowerPC devices, but with latest rc14 version it works on other platforms.

[jarda]

@macgaiver

@CyberTod

These results sound very promising. But can only be used in some configurations. The typical home router can benefit a lot.
But for example I want to somehow use this on ptp wireless connections, because i have a mangle rule to set nv2 priority from dscp for QoS. And as this changes header of all packets I guess fasttrack is not possible in this scenario ?

I do not think it is possible, only changes made by ConnTrack is supported, in your case those are custom changes.

But it is a firewall action, so you can basically use it in any place where you have “accept everything else” logic just add “fasttrack everything else” rule before the accept.

Unfortunately I am dropping everything else, not accepting that…

[jarda]

But at least established and related could be fasttracked, hopefully. Had not time to make own tests so far…

[ffernandes]

playing with new feature with an rb411ar
had to enable wireless-fp to work?!?!
ip-forward: yes
send-redirects: yes
accept-source-route: no
accept-redirects: no
secure-redirects: yes
rp-filter: no
tcp-syncookies: no
max-arp-entries: 8192
arp-timeout: 30s
icmp-rate-limit: 10
icmp-rate-mask: 0x1818
allow-fast-path: yes
ipv4-fast-path-active: no
ipv4-fast-path-packets: 0
ipv4-fast-path-bytes: 0
ipv4-fasttrack-active: yes
ipv4-fasttrack-packets: 189561
ipv4-fasttrack-bytes: 14324143

[InoX]

Is working for me with these rules:

@macgaiver

/ip firewall filter
add chain=forward action=fasttrack-connection connection-state=established,related
add chain=forward action=accept connection-state=established,related
add chain=forward action=drop connection-state=invalid

[buckthis]

Any chance RCs could include the ‘wireless-cm2’ package?
At least for mipsbe…

Thanks

[vortex]

It is the first time I want to upgrade RouterOS to get some feature.

I might not need to upgrade my RB2011 to take full advantage of my new pipe after all.

[cheeze]

Mikrotik, please PLEASE take your time. I don’t think most of us care if you take 3 months. Take the time to perfect 6.29, or at least make it as good as possible.

Also, awesome

[Chupaka]

@macgaiver

Note, that all packets that goes fasttrack, will not be visible in firewall and you will not be able to limit them in queue global.

I wonder whether those packets will be accounted by Traffic Flow…