Hi,
i have a HEX S configured with one wireless provider (20Mbit down 2Mbit up), eth1 is my lan (for poe in) and eth2 is WAN.
RouterOS 6.44.5
Very simple configuration, pppoe and masquerade, i have a strange problem, if i enable fasttrack and i download one file, it start and after some seconds speed go to 0
and hung.
Speedtest give me very very slow performance (100/200kbit in download, 2Mbit upload)
With normal browsing all is ok (many small files)
I have try to change mtu, enable and disable adj-mss, put a rules in mangle do adj-mss with no success…
I paste my current config, now i have two vpn and some nat/fw rules, but with a simple masquerade and no rules i have same issue…
Can help me?
Thanks
/interface bridge
add admin-mac=x:x:x:x:x:x auto-mac=no comment=defconf name=bridge
/interface ethernet
set [ find default-name=ether2 ] advertise=100M-full
/interface pppoe-client
add add-default-route=yes disabled=no interface=ether2 keepalive-timeout=disabled max-mru=1480 max-mtu=1480 name=pppoe-out user=xxx
/interface list
add comment=defconf name=WAN
add comment=defconf name=LAN
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
/ip hotspot profile
set [ find default=yes ] html-directory=flash/hotspot
/ip ipsec mode-config
set [ find default=yes ] src-address-list=local
/ip ipsec profile
add dh-group=modp1024 enc-algorithm=aes-256,aes-192,aes-128 name=xxx proposal-check=claim
/ip ipsec peer
add address=x.x.x.x/32 exchange-mode=aggressive name=xxx-INET profile=xxx
add address=x.x.x.x/32 exchange-mode=aggressive name=xxx profile=xxx
/ip ipsec proposal
set [ find default=yes ] pfs-group=modp2048
add auth-algorithms=sha256,sha1 name=xxx pfs-group=none
/interface bridge port
add bridge=bridge comment=defconf interface=ether1
add bridge=bridge comment=defconf interface=ether3
add bridge=bridge comment=defconf interface=ether4
add bridge=bridge comment=defconf interface=ether5
add bridge=bridge comment=defconf interface=sfp1
/ip neighbor discovery-settings
set discover-interface-list=LAN
/interface list member
add comment=defconf interface=bridge list=LAN
add comment=defconf interface=pppoe-out list=WAN
/ip address
add address=192.168.210.1/24 comment=defconf interface=bridge network=192.168.210.0
/ip dns
set allow-remote-requests=yes servers=8.8.8.8,8.8.4.4
/ip firewall address-list
add address=192.168.210.0/24 list=local
/ip firewall filter
add action=accept chain=input comment=“defconf: accept established,related,untracked” connection-state=established,related,untracked
add action=drop chain=input comment=“defconf: drop invalid” connection-state=invalid
add action=accept chain=input comment=“defconf: accept ICMP” protocol=icmp
add action=accept chain=input comment=“defconf: accept to local loopback (for CAPsMAN)” dst-address=127.0.0.1
add action=drop chain=input comment=“defconf: drop all not coming from LAN” in-interface-list=!LAN
add action=accept chain=forward comment=“defconf: accept in ipsec policy” ipsec-policy=in,ipsec
add action=accept chain=forward comment=“defconf: accept out ipsec policy” ipsec-policy=out,ipsec
add action=fasttrack-connection chain=forward comment=“defconf: fasttrack” connection-mark=!ipsec connection-state=established,related disabled=yes
add action=accept chain=forward comment=“defconf: accept established,related, untracked” connection-state=established,related,untracked
add action=drop chain=forward comment=“defconf: drop invalid” connection-state=invalid
add action=drop chain=forward comment=“defconf: drop all from WAN not DSTNATed” connection-nat-state=!dstnat connection-state=new in-interface-list=WAN
/ip firewall mangle
add action=mark-connection chain=forward comment=“mark ipsec connections to exclude them from fasttrack” ipsec-policy=out,ipsec new-connection-mark=ipsec
add action=mark-connection chain=forward comment=“mark ipsec connections to exclude them from fasttrack” ipsec-policy=in,ipsec new-connection-mark=ipsec
/ip firewall nat
add action=dst-nat chain=dstnat dst-port=80 in-interface=pppoe-out protocol=tcp to-addresses=192.168.210.10
add action=dst-nat chain=dstnat dst-port=443 in-interface=pppoe-out protocol=tcp to-addresses=192.168.210.10
add action=dst-nat chain=dstnat dst-port=222 in-interface=pppoe-out protocol=tcp to-addresses=192.168.210.10 to-ports=22
add action=masquerade chain=srcnat comment=“defconf: masquerade” ipsec-policy=out,none out-interface-list=WAN
/ip ipsec identity
add auth-method=pre-shared-key-xauth generate-policy=port-override mode-config=request-only my-id=user-fqdn:VpnClient peer=xxx xauth-login=c.mauro
add auth-method=pre-shared-key-xauth generate-policy=port-override mode-config=request-only my-id=fqdn:xxx peer=xxx-INET xauth-login=xxxVpn1
/ip ipsec policy
set 0 proposal=xxx
/system clock
set time-zone-name=Europe/Rome
/system package update
set channel=long-term
/system scheduler
add interval=30s name=Restart-pppoe on-event=“:if ([/ping 8.8.8.8 count=3] = 0) do={
\n/interface disable pppoe-out
\ndelay delay-time=2;
\n/interface enable pppoe-out
\n}” policy=ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon start-date=oct/22/2019 start-time=09:40:10
/tool graphing interface
add interface=bridge
add interface=pppoe-out
/tool mac-server
set allowed-interface-list=LAN
/tool mac-server mac-winbox
set allowed-interface-list=LAN
/tool netwatch
add down-script=“/interface disable pppoe-out;/interface enable pppoe-out” host=8.8.8.8
/tool sniffer
set filter-interface=bridge filter-ip-address=192.168.200.20/32