/ip firewall filter
add action=accept chain=input comment="defconf: accept established,related,untracked" connection-state=established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=invalid
add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp
add action=accept chain=input comment="Admin page" dst-port=80 protocol=tcp
add action=drop chain=input comment="defconf: drop all not coming from LAN" in-interface-list=!LAN
add action=accept chain=forward comment="defconf: accept in ipsec policy" ipsec-policy=in,ipsec
add action=accept chain=forward comment="defconf: accept out ipsec policy" ipsec-policy=out,ipsec
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" connection-state=established,related
add action=accept chain=forward comment="defconf: accept established,related, untracked" connection-state=established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" connection-state=invalid
add action=drop chain=forward comment="defconf: drop all from WAN not DSTNATed" connection-nat-state=!dstnat connection-state=new in-interface-list=WAN
/ip firewall nat
add action=masquerade chain=srcnat comment="defconf: masquerade" ipsec-policy=out,none out-interface-list=WAN
Is there anything I can do better?
@Van9018: I tried playing with the MTU and I set DisableBandwidthThrottling on the windows client, which at least stabilizes the speed to 20 Mbps. With FTP I get 39 Mbps. Do you have any suggestions for me on how tu tune that SMB performance?
I changed my initial vpn configuration to a GRE Tunnel (Interface) with IPSec secret and set up a IP Route, like I wrote some posts ago. And yes ping and SMB is working. Just too slow.
Without IPSec I get slightly better performance, but it is just a plus of about 1 Mbps at peak. For testing I copy a file from a SMB share of a QNAP NAS to my computer.
Concerning WAN limits: I have a download of 50 MBit/s and on the other site I have a upload of 40 MBit/s. So the FTP speed I measured of 39 MBit/s is the bandwidth limit.
I just had a chance to configure two RB750Gr3 with ipsec. No firewall at all on both routers, uplinks allow 100mbps between routers. IPSec uses AES128 for encryption algorithm and SHA1 for authentication algorithm. ~10Mbps ipsec traffic, CPU gets ~38%. One of the CPU reaches to 60% among 4 CPUs. Estimating IPsec max throughput will be not more than 30Mbps in this setup. That is quite slow performance considering 880MHz x 2 CPUs and plus hardware offloading enabled. Even RB450G (single core, no hardware offload on ipsec) can reach to similar performance. On top of slow throughput, RB750Gr3 adds notable delays on IPSec traffic even in case of very tiny traffic usage. In some cases, I see ICMP loss on ipsec packets while there is no packet loss between WAN addresses of two routers.
Quite upset. Seems like this is the capability of RB750gr3.
Forgot to mention that brigde settings enable between ether2-ether5. But this should be offloaded to switch chip. So I don`t think this affects to overall performance that much.
I have a noob question about hardware encryption in hEX S;
My VPN Provider (ExpressVPN) supports AES-256-CBC, and I see that hEX S support this kind of hardware encryption.
But the problem might be in RSA certificate identification by the hashing algorithm SHA-512 when hEX S supports only SHA-256.
My question is will it be anyhow hardware encrypted if I select in IPSEC settings SHA512 and if someone has those combination (hEX S and ExpressVPN), which VPN performance could I expect and is it hardware encryption possible with ExpressVPN?
I’m still seeing similar performance limitations on 6.47.1 with SMB over an L2TP IPsec tunnel via Windows clients, so the tunnel is SHA-1 & AES-128 which are fully supported by the Hex’s Mediatek offloading / fasttrack. Disabling fasttrack from the firewall rules has no effect on the performance levels, so this is not a fasttrack bug.
With these Mikrotiks, web traffic will scale up to 71-75Mb over the tunnel (90Mb fiber), if I cfg the tunnel to allow use of the remote gateway and test via Speedtest.net. SMB bottlenecks at 10-11 Mb when tested with Totusoft’s Lan Speed Test. I did some prior testing with a lower end RB951G and it scaled up to around 15Mb, which has no fasttrack involved as it is a simpler Atheros platform with no IPsec offloading support. So this issue does appear to be more of a problem on the Mediatek vs Atheros platform.
This is definitely strange behavior, as the Ubiquiti Edgerouter X’s I am upgrading from bottleneck both protocols at the same ~32Mb due to their broken (for years) L2TP IPsec offloading. The Edgerouter Lite (Cavium, with functional L2TP IPSec offloading) scales up to around 40Mb for web traffic and bottlenecks at a similar 30-35Mb for SMB using identical VPN cfgs on 600/100Mb connections from the same cable ISP.
All of my testing is to SMB test targets on up to date Synology NAS units, and with optimized MTU’s of 1400 specified in the Ubiquiti & Mikrotik L2TP server cfgs.
I’ve also confirmed identical WAN MTU’s of 1500 for the different ISP’s involved, 600/100 on the Edgerouter X & Lite being cable and the 90/90 being fiber.
In case it wasn’t clear in those two prior posts, all interfaces involved have optimized / confirmed non-fragmenting MTUs for both the L2TP VPN tunnels and WAN interfaces.
