I have a RB951G configured as an AP. From the terminal I have internet and DNS. WiFi client connect with good signal strength. When I connect with my mobile phone, and I perform a speedtest (Ookla) I get a very low speed (< 3 mb/s). I also have TP-link deco access points for 5 Ghz, they perform really well with the speedtest. So I guess the config of my LAN and router seems ok. Can someone point the direction I have to look?
Maybe you have some mis-configuration, post the configuration of the RB951G for review, instructions here:
I now found out that there is a general networkproblem. I have 5 Mikrotik AP’s who all have te same behaviour. I have a lot of IOT clients, who connect all to WiFi en function normally. When I connect to one of te AP’s with notebook or mobile telephone en perform a speedtest, I get a very poor speed (< 5mb/s) As I described before, I also have TP-link Deco AP’s for 5 Ghz, they function very well, I get > 150 mb/s with netspeed. For a few weeks, I changed the router, but I think after that evertything was ok. The problem appeared later. I must have changed something, I guess, I changed some cabling etc. Any idee what is wrong? When I test
/tool torch bridge1
TX RX TX-PACKETS RX-PACKETS
0bps 207.9kbps 0 343 0bps 207.9kbps 0 343
on one of the AP’s I get this result, I think traffic on the network is (too) high.
/interface bridge host print count-only gives values from 70 to 100 on all AP’s.
Any idea what is wrong?
No.
And without your configuration(s) and a sketch/scheme of your network, I don't think anyone will be able to guess what the problem might be.
But you are welcome to continue posting vague and irrelevant pieces of information instead of the needed ones. 
# feb/28/2026 12:03:07 by RouterOS 6.49.19
# software id = RXFA-QJEW
#
# model = 951G-2HnD
# serial number = ***********
/interface bridge
add name=bridge1
/interface wireless
set [ find default-name=wlan1 ] country=netherlands disabled=no distance=\
indoors frequency=auto installation=indoor mode=ap-bridge ssid=\
MikroTik wireless-protocol=802.11 wps-mode=disabled
/interface list
add name=WAN
add name=LAN
/interface wireless security-profiles
set [ find default=yes ] authentication-types=wpa2-psk mode=dynamic-keys \
supplicant-identity=MikroTik
/tool user-manager customer
set admin access=\
own-routers,own-users,own-profiles,own-limits,config-payment-gw
/interface bridge port
add bridge=bridge1 interface=ether1
add bridge=bridge1 interface=ether2
add bridge=bridge1 interface=ether3
add bridge=bridge1 interface=ether4
add bridge=bridge1 interface=ether5
add bridge=bridge1 interface=wlan1
/interface list member
add interface=ether2 list=LAN
add interface=ether3 list=LAN
add interface=ether4 list=LAN
add interface=ether5 list=LAN
add interface=wlan1 list=LAN
add interface=ether1 list=WAN
/ip address
add address=192.168.1.28/24 interface=ether2 network=192.168.1.0
/ip dns
set servers=192.168.1.1
/ip route
add distance=1 gateway=192.168.1.1
/system clock
set time-zone-name=Europe/Amsterdam
/system identity
set name=MikroTik
/tool user-manager database
set db-path=user-manager
# 2026-02-28 18:27:24 by RouterOS 7.21.2
# software id = 8C0C-5XBU
#
# model = CRS109-8G-1S-2HnD
# serial number = *************
/interface bridge
add name=bridge-LAN
/interface ethernet
set [ find default-name=ether1 ] mac-address=6C:3B:6B:3C:27:74
/interface wireless
set [ find default-name=wlan1 ] band=2ghz-b/g/n country=netherlands \
frequency=2462 mode=ap-bridge multicast-helper=disabled ssid=M-SYSTEMS99 \
wireless-protocol=802.11
/interface wireguard
add listen-port=51920 mtu=1420 name=wg1
/interface list
add name=WAN
add name=LAN
/interface wireless security-profiles
set [ find default=yes ] authentication-types=wpa2-psk mode=dynamic-keys \
supplicant-identity=MikroTik
/ip pool
add name=LAN-pool ranges=192.168.1.150-192.168.1.253
/ip dhcp-server
add address-pool=LAN-pool interface=bridge-LAN name=LAN-dhcp
/interface bridge port
add bridge=bridge-LAN interface=ether2
add bridge=bridge-LAN interface=ether3
add bridge=bridge-LAN interface=ether4
add bridge=bridge-LAN interface=ether5
add bridge=bridge-LAN interface=ether6
add bridge=bridge-LAN interface=ether7
add bridge=bridge-LAN interface=ether8
add bridge=bridge-LAN interface=wlan1
/interface detect-internet
set detect-interface-list=all
/interface list member
add interface=ether1 list=WAN
add interface=bridge-LAN list=LAN
/interface wireguard peers
add allowed-address=10.10.10.2/32 client-allowed-address=::/0 comment=\
"iPhone Hans" interface=wg1 name=peer1 public-key=\
"FLbfMqvHZeU/ZdYDSeDVkhgNZ5sF3T/F5vOfVX3rvSc="
add allowed-address=10.10.10.3/32 client-allowed-address=::/0 comment=\
"iPhone Mirjam" interface=wg1 name=peer2 public-key=\
"pv5XNRAYGLbrsnNTVlJkpWElyqc9VGnrv//uYcoE1Vk="
/ip address
add address=192.168.1.1/24 interface=bridge-LAN network=192.168.1.0
add address=192.168.1.254/24 comment=\
"Nodig voor airco woonkamer, die staat nog op deze gateway." interface=\
bridge-LAN network=192.168.1.0
add address=10.10.10.1/24 interface=wg1 network=10.10.10.0
/ip dhcp-client
add interface=ether1 use-peer-ntp=no
/ip dhcp-server lease
add address=192.168.1.244 comment="Linn Sneaky DS" mac-address=\
00:50:C2:21:75:20 server=LAN-dhcp
add address=192.168.1.192 client-id=1:14:cb:19:b1:0:7a comment=Printer \
mac-address=14:CB:19:B1:00:7A server=LAN-dhcp
add address=192.168.1.226 comment="Marstek CT" mac-address=00:9B:08:A6:57:BE \
server=LAN-dhcp
add address=192.168.1.175 comment="Marstek accu" mac-address=\
00:9B:08:A7:1D:CE server=LAN-dhcp
add address=192.168.1.230 client-id=\
ff:60:4f:79:2f:0:1:0:1:24:2c:6d:e1:6c:47:60:4f:79:2f comment=\
"Google speaker" mac-address=6C:47:60:4F:79:2F server=LAN-dhcp
add address=192.168.1.153 client-id=\
ff:60:4f:78:e1:0:1:0:1:24:2c:6d:e1:6c:47:60:4f:78:e1 comment=\
"Google speaker" mac-address=6C:47:60:4F:78:E1 server=LAN-dhcp
add address=192.168.1.183 comment="Linn Majik DSM" mac-address=\
00:26:0F:21:B5:94 server=LAN-dhcp
add address=192.168.1.252 client-id=1:e8:fd:f8:c7:e3:22 comment=\
"Goodwe inverter" mac-address=E8:FD:F8:C7:E3:22 server=LAN-dhcp
add address=192.168.1.159 client-id=1:58:60:d8:af:fb:ea comment="Ziggo Next" \
mac-address=58:60:D8:AF:FB:EA server=LAN-dhcp
add address=192.168.1.172 client-id=1:24:3f:75:dd:45:3f comment=\
"Reolink camera tuin" mac-address=24:3F:75:DD:45:3F server=LAN-dhcp
add address=192.168.1.240 client-id=1:ec:71:db:b:ff:d5 comment=\
"Camera carport" mac-address=EC:71:DB:0B:FF:D5 server=LAN-dhcp
add address=192.168.1.239 comment="Google speaker" mac-address=\
44:07:0B:81:33:78 server=LAN-dhcp
add address=192.168.1.200 comment="Opentherm switch" mac-address=\
40:91:51:5A:0C:AE server=LAN-dhcp
add address=192.168.1.229 client-id=1:14:91:38:37:f9:96 comment="Fire Tablet" \
mac-address=14:91:38:37:F9:96 server=LAN-dhcp
add address=192.168.1.217 comment="RFID buiten" mac-address=48:3F:DA:7E:28:75 \
server=LAN-dhcp
add address=192.168.1.164 comment=DSMR mac-address=48:3F:DA:7F:1B:3D server=\
LAN-dhcp
add address=192.168.1.208 client-id=1:88:a9:a7:15:77:3 comment=\
"Solaredge inverter" mac-address=88:A9:A7:15:77:03 server=LAN-dhcp
add address=192.168.1.181 client-id=1:e2:31:6e:92:d0:26 comment=\
"Hans99 iPhone" mac-address=E2:31:6E:92:D0:26 server=LAN-dhcp
/ip dhcp-server network
add address=192.168.1.0/24 dns-server=192.168.1.1 gateway=192.168.1.1
/ip dns
set allow-remote-requests=yes servers=8.8.8.8,1.1.1.1
/ip firewall filter
add action=fasttrack-connection chain=forward connection-state=\
established,related
add action=accept chain=input connection-state=established,related
add action=drop chain=input connection-state=invalid
add action=drop chain=forward connection-state=invalid
add action=accept chain=forward connection-state=established,related
add action=accept chain=input in-interface=bridge-LAN
add action=accept chain=forward in-interface=bridge-LAN out-interface=ether1
add action=accept chain=forward comment="Allow port forwards" \
connection-nat-state=dstnat
add action=accept chain=input comment="Allow WireGuard" dst-port=51920 \
in-interface=ether1 protocol=udp
add action=accept chain=forward comment="VPN to LAN" in-interface=wg1 \
out-interface=bridge-LAN
add action=accept chain=forward comment="LAN to VPN" in-interface=bridge-LAN \
out-interface=wg1
add action=drop chain=input in-interface=ether1
add action=drop chain=forward
/ip firewall mangle
add action=change-mss chain=forward new-mss=clamp-to-pmtu protocol=tcp \
tcp-flags=syn
/ip firewall nat
add action=masquerade chain=srcnat out-interface=ether1
add action=dst-nat chain=dstnat comment=\
"poort 80 OPENZETTEN VOOR VERNIEUWEN CERTIFICATEN" disabled=yes dst-port=\
80 in-interface=ether1 protocol=tcp to-addresses=192.168.1.5 to-ports=80
add action=dst-nat chain=dstnat comment="Poort 443 SSL" disabled=yes \
dst-port=443 in-interface=ether1 protocol=tcp to-addresses=192.168.1.5 \
to-ports=443
add action=dst-nat chain=dstnat comment="Wireguard proxmox container" \
dst-port=51820 in-interface=ether1 protocol=udp to-addresses=192.168.1.7 \
to-ports=51820
add action=masquerade chain=srcnat comment="WG NAT uit" out-interface=ether1 \
src-address=10.10.10.0/24
/ip service
set ftp disabled=yes
set telnet disabled=yes
set winbox address=192.168.1.0/24
set api disabled=yes
set api-ssl disabled=yes
/lcd interface pages
set 0 interfaces=ether1,ether2,ether3,ether4,ether5,ether6,ether7,ether8,sfp1
/system clock
set time-zone-name=Europe/Amsterdam
/system identity
set name=Mikrotik-Router
The 951 has wrong settings for the categorization as LAN of the single ports instead of the bridge, but since the device doesn't use firewall nor Nat, It Is only philosophical, no consequences.
The CRS309 needs to be reviewed in detail, but at first sight you should before anything else try to disable detect internet, see Rule #5:
It Is a settings known to create strange issues in many cases.
I removed detect internet with
/interface detect-internet set internet-test=none
but this did not resolve the problem.
Your Speedtest attempts are always via wireless? That rb951g is some very, very, really very old device with 2.4ghz only. You're Decos use 5ghz as you already mentioned. Remote diagnosis tells me, you maybe have either very crowded 2.4 spectrum or interference on that band.
I cannot find anything evidently "wrong" on the CRS309 configuration, the firewall rules could be (only for cleanliness/readability) be re-ordered by chain, and the masquerade for the Wireguard interface seems redundant, but nothing that I believe can affect connection speed.
Also - usually - the Wg interface is categorized as LAN (and the firewall rules normally use the /interface list categorization) but it is only a matter of preferences.
As Infabo stated, the issue may be due to the interferences on the 2.4 GHz band, you have it set to "auto" on the 951, maybe it is worth experimenting, looking for the cleanest channel(s) and force the frequency to it/them.
Particularly if you have 5 (or more) AP's on the 2.4 GHz band, it is usually recommended, if possible, to use fixed channels with adequate spacing between them (the famous 1,6,11 scheme).
But you can test this theory easily, if you (temporarily disable the other AP's 2.4 GHz radio and repeat the speed test on the 951 once set to a (as clean as available) channel, speed results should change noticeably.
On the other hand to check the speed on the wired network you can try (connecting to 951 via cable) a btest against the CRS309 and see what you get.
I use my 2.4 GHz network exclusively for my IoT devices. I have quite a few. It's worked flawlessly for about 10 years now. I recently made some changes to the network, which caused this problem. I'm also suspecting interference.
Thank you for looking into this issue. I recently replaced my ZigBee adapter and was experiencing interference on the ZigBee network. It turned out that the ZigBee channel (11) was interfering heavily with Wi-Fi channel 1. I was using the 1-6-11 scheme for my APs and then switched to using only channels 6 and 11. I think that's where the problem arose. I now need to find a third Wi-Fi channel that definitely doesn't interfere with ZigBee channels 11 and 25, so I can create some “distance” between the APs.
Would it be a solution to purchase one or two more modern and powerful APs for 2.4 GHz and get rid of the current ones? What solution would MikroTik offer for this?
Not AFAIK, basically you are in a room full of people shouting at each other, replacing some people in the room with new ones capable of shouting at a louder volume won't help much.
BTW these new, better at shouting, people have usually also some better hearing, so you would be in the same (or worse) situation as before.
Unless, but it depends on how your physical layout is, you can reduce the number of AP's, I don't believe that it can better much the situation, and it has a cost.
You should actually try doing the opposite, trying to limit the power of the AP's so that they interfere less between each other (I don't think that you can lower the power emitted by the Iot devices?).
Also, you have 2ghz-b/g/n on the RB951, I would try setting a single protocol/speed only on the AP's, if all you have are iot devices on the 2.4 GHz, the b only should be enough (or g or n only) of course it depends on what the IOT devices are set (or can be set) to.
As well, the best alternative to 1, 6, 11 should be 1, 7, 13 as you are located in Europe, but again it depends on what the Iot devices you have support, and anyway this alternate scheme uses anyway channel 1.
But it is overall a try and see what happens game.
My idea was to place two APs on either side of my house (I have a fairly large house) with better specifications, instead of five APs placed relatively close together. But I understand your reasoning. I'm going to reduce the transmit power of the APs to see if that yields better results. I see the TX power is set to 17 dB by default. What would be a safe value to experiment with? I know that 3 dB less equals half the transmit power.
It all depends on the overall shape (besides size) of your house, and where you have the ethernet cables for the AP's placed, the kind of walls you have, etc., etc..
There is software (from other manufacturers, so no actual data for Mikrotik devices) that allow, to "play" with coverage of single and multiple AP's.
Example (TP-LINK):
https://www.omadanetworks.com/us/blog/2134/introducing-omada-design-hub-a-free-and-easy-network-planning-tool/
Other (Cambium):
https://www.cambiumnetworks.com/products/software/wifi-designer/
besides third party software (please read as $$$ needed).
But - with time (and patience) and a lot of experimenting - something similar can be done.
You need a plan of your house.
Then switch off/disable all your AP's but one.
Use a wi-fi analyzer on a phone walking around the house and checking signal levels in various points, this will allow you to draw a circle with center the AP of a given radius (most if not all AP's are omnidirectional, so in 2D their coverage can be represented by a circle).
Lower by 3 dB the power of the AP (yes, this is halving the transmit power) and draw the corresponding smaller circle.
Lower again by 3 dB the power of the AP (i.e. set it to 1/4th of the original) and draw yet another (smallest) circle.
Repeat for each AP you have.
At this point you should have a set of "Venn's diagrams" where you can see roughly the areas where there is overlap.
You should be able to reduce the size of these areas by lowering the power of the AP's involved and also see if these causes the loss of coverage in some other areas and - if possible - have an idea of what you can get changing the placement of the AP(s).
I would try (starting from 17 dB) with 14 or 15, but it depends, the only way to know is with experimenting.
Among Mikrotik devices, I would like to point out the relatively newish wAP Ax, that - unlike most AP's - is directional, with a theoretical beam width of 180° but more realistically between 90 and 120°.
If you want to cover a (say) 6x6 m square room the best way in theory is to have a ceiling AP (let's say a cAP Ax) in the center (cross of diagonals) of the square.
But a wAP Ax in a corner will cover it just fine (and it is much more likely that you have an ethernet cable in a corner of a room that in the center of the ceiling).
Thank you for your detailed response and for pointing me to the HAP ax, as this might be a solution for my situation. It sounds like a good plan to me; I'll give it a try!
wAp Ax, not HAP Ax: