Forwarding traffic from Virtual AP to VPN: performance issues

RouterOS General
1

I am trying to forward all traffic from my Virtual AP to a VPN client connection, but am getting a very poor throughput till no at all.

What I have:

  • a good working VPN connection: bandwidth tests (from Routerboard to Routerboard) give me ~50 MBits:
 9  R  test-vpn                            l2tp-out         1450
  • can connect to the Virtual AP named ‘ap-test’:
5     test-ap                                wlan             1500  1600       2290 E6:8D:8C:CD:EB:49
  • DHCP pool with range 10.26.31.10-10.26.31.254:
 1 dhcp-pool-test                                                                            10.26.31.10-10.26.31.254
  • IP address assigned to the ‘ap-test’ interface:
1   10.26.31.1/24      10.26.31.0      ap-test
  • A DHCP server assigned to the ‘ap-test’ interface:
1 I dhcp-server-test                   ap-test                                       dhcp-pool-test                     10m
  • A firewall mangle rule to mark all traffic from ap-test:
 3    chain=prerouting action=mark-routing new-routing-mark=mark-ap-test passthrough=yes in-interface=ap-test log=no 
      log-prefix=""
  • A NAT rule to masquerade all outgoing traffic to the VPN connection:
1    chain=srcnat action=masquerade out-interface=test-vpn log=no log-prefix=""
  • An ip route to direct all traffic marked as ‘mark-ap-test’ to the test-vpn interface:
 0 A S  dst-address=0.0.0.0/0 gateway=test-vpn gateway-status=test-vpn reachable distance=1 scope=30 target-scope=10 
        routing-mark=mark-ap-test

As said, above setup gives me a connection to the VPN using the Virtual AP, but with a very poor performance (~1 MBit/sec) or sometimes no throughput at all.
When I enable Torch performance increases till ~13 MBit/sec, but still nowhere the tested ~50 MBit/sec. I have the feeling that something is wrong with my routing configuration, but have no clue what. Disabling firewall rules doesn’t improve anything.

What am I missing here?

2

You can try to add new bridge interface and put there VirtualAP ! Put ip and dhcp on this bridge and change in-interface respectively in the mangle rule . I have this setup and works fine !
VPN srcnat is 1st rule in the nat section with defined src addresses/network/ !

3

Thank you.

That improves the performance a little, up to ~3 Mbps, but still nowhere near the bandwidth test results.
When I have the Torch tool enabled performance goes up?!

Could you post your settings?

4

If enabling Torch improves things, it would seem to indicate that hardware offload is breaking somewhere (fastpath / fasttrack).

5

Which settings you are interested in? I use 5GHz for vAP , because there is much interference at 2.4 and can not achieve high speeds !
some settings on my bord:

/interface bridge
add comment="== LAN ==" name=bridge1
add admin-mac=4C:1F:CC:80:FB:06 arp=proxy-arp auto-mac=no comment=\
    "== VPN LAN ==" fast-forward=no igmp-snooping=no name=bridge2
/interface ethernet
set [ find default-name=ether1 ] comment=
set [ find default-name=ether2 ] comment=
set [ find default-name=ether3 ] comment=
/interface l2tp-client
add allow=mschap1,mschap2 connect-to=XXX.XXX.XXX.XXX disabled=no name=\
    l2tp-out1 use-ipsec=yes user=home_conn
/interface wireless
set [ find default-name=wlan1 ] band=2ghz-b/g/n channel-width=20/40mhz-Ce \
    comment="AP 2.4 GHz" country=debug default-authentication=no \
    default-forwarding=no disabled=no distance=indoors mac-address=\
    00:10:FA:CC:53:80 max-station-count=5 mode=ap-bridge radio-name="" \
    rx-chains=0,1 ssid=XXXX tx-chains=0,1 wds-default-bridge=\
    bridge1 wireless-protocol=802.11 wmm-support=enabled wps-mode=disabled
set [ find default-name=wlan2 ] band=5ghz-a/n channel-width=20/40mhz-Ce \
    comment="AP 5 GHz" country=canada default-authentication=no \
    default-forwarding=no disabled=no distance=indoors mac-address=\
    00:10:FA:85:2C:37 max-station-count=10 mode=ap-bridge radio-name="" \
    rx-chains=0,1 ssid=XXXXX tx-chains=0,1 wireless-protocol=802.11 \
    wmm-support=enabled wps-mode=disabled
/interface vlan
add comment= interface=ether3 name=vlan1 vlan-id=101
/ip ipsec proposal
set [ find default=yes ] pfs-group=modp2048
/ip dhcp-server
add address-pool=dhcp_pool0 disabled=no interface=bridge1 lease-time=1d name=dhcp1
add address-pool=dhcp_pool1 disabled=no interface=bridge2 lease-time=1d name=dhcp2
/interface bridge port
add bridge=bridge1 hw=no interface=wlan1
add bridge=bridge1 hw=no interface=wlan2
add bridge=bridge2 hw=no interface=wlan3
/ip address
add address=172.16.222.254/28 interface=bridge1 network=172.16.222.240
add address=192.168.100.2/30 interface=ether3 network=192.168.100.0
add address=172.16.3.2/27 interface=ether2 network=172.16.3.0
add address=192.168.101.2/27 interface=ether1 network=192.168.101.0
add address=172.16.2.2/27 interface=vlan1 network=172.16.2.0
add address=172.16.22.1/29 interface=bridge2 network=172.16.22.0
/ip dhcp-server network
add address=172.16.22.0/29 dns-server=192.168.99.1 gateway=172.16.22.1
add address=172.16.222.240/28 dns-server=172.16.222.254 gateway=172.16.222.254
/ip dns
set allow-remote-requests=yes servers=8.8.8.8,208.67.220.220
/ip firewall mangle
add action=mark-routing chain=prerouting in-interface=bridge2 new-routing-mark=VPNmark passthrough=yes src-address=172.16.22.0/29
/ip firewall nat
add action=masquerade chain=srcnat out-interface=l2tp-out1 src-address=172.16.22.0/29
add action=masquerade chain=srcnat out-interface=ether1 to-addresses=172.16.1.2
add action=masquerade chain=srcnat out-interface=ether2 to-addresses=172.16.3.2
add action=masquerade chain=srcnat out-interface=ether3 to-addresses=192.168.100.2
add action=masquerade chain=srcnat out-interface=vlan1 to-addresses=192.168.1.2
/ip route
add distance=1 gateway=l2tp-out1 routing-mark=VPNmark
add check-gateway=ping distance=1 gateway=4.2.2.1
add check-gateway=ping distance=2 gateway=4.2.2.3
add check-gateway=ping distance=3 gateway=4.2.2.4
add check-gateway=ping distance=4 gateway=4.2.2.2
add distance=1 dst-address=4.2.2.1/32 gateway=192.168.101.1 scope=10
add distance=1 dst-address=4.2.2.2/32 gateway=192.168.100.1 scope=10
add distance=1 dst-address=4.2.2.3/32 gateway=172.16.3.1 scope=10
add distance=1 dst-address=4.2.2.4/32 gateway=172.16.2.1 scope=10

I achieve about 15-20 mbps with AES128 CBC encryption full cpu load /AR7161@680MHz/

6

Thanks John.

I applied the same settings, but my throughput is still very low: nothing changed.

I am thinking of contacting Mikrotik support about, seems to be very strange this poor performance.

7

Solved thanks to support!

I disabled fasttrack in the firewall filter rules, as traffic can’t be policy based routed and fasttrack-ed at the same time.