Hello, is it normal that one port negotiated at 100mb/s and fully utilize that link, stalls other ports negotiated at 1gb/s?
it causes other gbit ports to drop speed to sum like 100mb/s and massive drop of packets
I wonder is it config issue..
config simple, two ports as standard config for NAT
other 3 ports in separate bridge with eoip and vlan.
saturating NAT port at 100mb/s causes gbit ports in separate bridge drop packets, weird
thanks
This we will wonder, too, as long as you deny us a copy of that config.
That cannot be ruled out.
Separate bridge ? You have multiple ?
Suspicious.
Show your config please.
It can really make or break performance.
/interface list
add comment=defconf name=WAN
add comment=defconf name=LAN
/ip firewall connection tracking
set udp-timeout=10s
/ip neighbor discovery-settings
set discover-interface-list=none
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
/ip dhcp-server network
add address=192.168.88.0/24 dns-server=192.168.88.1 gateway=192.168.88.1
/ip dns static
add address=192.168.88.1 name=router.lan type=A
/ip ipsec profile
set [ find default=yes ] dpd-interval=2m dpd-maximum-failures=5
/ip pool
add name=pool1 ranges=192.168.88.11-192.168.88.99
/interface bridge
add admin-mac=74:4D:28:C9:4E:98 auto-mac=no name=bridge-wan port-cost-mode=short protocol-mode=none
add admin-mac=74:4D:28:C9:4E:99 auto-mac=no name=bridge31 port-cost-mode=short protocol-mode=none
add admin-mac=74:4D:28:C9:4E:9C auto-mac=no name=bridge39 port-cost-mode=short protocol-mode=none
add name=bridge_lan protocol-mode=none
/interface ethernet
set [ find default-name=ether1 ] name=ether1
set [ find default-name=ether2 ] advertise=10M-baseT-half,10M-baseT-full,100M-baseT-half,100M-baseT-full,1G-baseT-full name=\
ether2
set [ find default-name=ether4 ] name=ether4
set [ find default-name=ether5 ] name=ether5
/interface eoip
add mac-address=02:0B:4D:C9:CE:1A name=eoip31 remote-address=172.16.** tunnel-id=1031
add mac-address=02:0B:4D:C9:CE:1B name=eoip39 remote-address=172.16.** tunnel-id=1039
/interface vlan
add interface=ether2 loop-protect=off name=vlan31 vlan-id=1902
/interface list member
add comment=defconf interface=ether2 list=LAN
add comment=defconf interface=bridge-wan list=WAN
add interface=vlan31 list=LAN
/ip address
add address=172.17.39.209/24 interface=bridge39 network=172.17.39.0
add address=172.17.31.209/24 interface=bridge31 network=172.17.31.0
add address=192.168.88.1/24 interface=bridge_lan network=192.168.88.0
/ip dhcp-client
add comment=defconf interface=bridge-wan name=bridge-wan
/ip dhcp-server
add address-pool=pool1 interface=bridge_lan name=server1
/ip dns
set allow-remote-requests=yes
/ip firewall filter
add action=drop chain=input dst-port=53 in-interface=bridge-wan protocol=tcp
add action=drop chain=input dst-port=53 in-interface=bridge-wan protocol=udp
add action=fasttrack-connection chain=forward connection-state=established,related
/ip firewall nat
add action=masquerade chain=srcnat out-interface=bridge-wan src-address=192.168.88.0/24
/routing bfd configuration
add disabled=no interfaces=all min-rx=200ms min-tx=200ms multiplier=5
/tool graphing interface
add interface=ether1
add interface=vlan31
add interface=eoip39
/interface bridge port
add bridge=bridge_lan hw=no ingress-filtering=no interface=ether4 internal-path-cost=10 path-cost=10
add bridge=bridge_lan hw=no ingress-filtering=no interface=ether5 internal-path-cost=10 path-cost=10
add bridge=bridge-wan hw=no ingress-filtering=no interface=ether1 internal-path-cost=10 path-cost=10
add bridge=bridge39 hw=no ingress-filtering=no interface=ether2 internal-path-cost=10 path-cost=10
add bridge=bridge31 ingress-filtering=no interface=vlan31 internal-path-cost=10 path-cost=10
add bridge=bridge31 ingress-filtering=no interface=eoip31 internal-path-cost=10 path-cost=10
add bridge=bridge39 ingress-filtering=no interface=eoip39 internal-path-cost=10 path-cost=10
add bridge=bridge_lan hw=no interface=ether3
here you go, the problem starts when user on ether4 starts downloading something large.
I think it is a known problem in this device, caused by the sharing of data lanes for different ports.
It may be possible to work around it by using different ports or change some setting.
Some thoughts (many not related to the problem at hand...)
You don't appear to have much in the way of a functional firewall on this device, I will assume it is for internal use only.
It looks likely running V7 routerOS.
The following should be changed to 30S
/ip firewall connection tracking
set udp-timeout=10s
On this unit.
V7 is much slower at routing than V6,
VLAN filtering functionality is much improved in V7 (has hardware offloading).
(So it works well as a managed L2 switch)
However, you seem to be forcing all the L2 VLAN filtering to be done in software.
Apart from being slow this likely clogs up the CPU/Switch bottleneck unnecessarily.
On the WAN port, you have connected it to a bridge, this is necessary if the WAN interface is receiving
priority tagged packets, but otherwise likely just adds overhead.
There is also Ethernet flow control which can block things, I think its default is off though.
I think a configuration using a hardware offloaded VLAN filtering bridge would be better.
An approximation to yours using vlan filtering.
(I have kept the separate bridge_wan, the eoip tunnels endpoints need fixing)
# 2026-09-26 12:32:09 by RouterOS 7.24.4
#
# model = RB750Gr3
/interface bridge
add admin-mac=74:4D:28:C9:4E:98 auto-mac=no name=bridge-wan port-cost-mode=\
short protocol-mode=none
add name=bridge_lan protocol-mode=none vlan-filtering=yes
/interface ethernet
set [ find default-name=ether1 ] advertise=\
10M-baseT-half,10M-baseT-full,100M-baseT-half,100M-baseT-full
set [ find default-name=ether2 ] advertise="10M-baseT-half,10M-baseT-full,100M\
-baseT-half,100M-baseT-full,1G-baseT-full"
/interface eoip
add mac-address=02:0B:4D:C9:CE:1A name=eoip31 remote-address=172.16.31.31 \
tunnel-id=1031
add mac-address=02:0B:4D:C9:CE:1B name=eoip39 remote-address=172.16.39.39 \
tunnel-id=1039
/interface vlan
add interface=bridge_lan loop-protect=off name=vlan31 vlan-id=1902
add interface=bridge_lan name=vlan39 vlan-id=39
/interface list
add comment=defconf name=WAN
add comment=defconf name=LAN
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
/ip pool
add name=pool1 ranges=192.168.88.11-192.168.88.99
/ip dhcp-server
add address-pool=pool1 interface=bridge_lan name=server1
/interface bridge port
add bridge=bridge_lan interface=ether3
add bridge=bridge_lan ingress-filtering=no interface=ether4 \
internal-path-cost=10 path-cost=10
add bridge=bridge_lan ingress-filtering=no interface=ether5 \
internal-path-cost=10 path-cost=10
add bridge=bridge-wan hw=no ingress-filtering=no interface=ether1 \
internal-path-cost=10 path-cost=10
add bridge=bridge_lan hw=no ingress-filtering=no interface=ether2 \
internal-path-cost=10 path-cost=10 pvid=39
add bridge=bridge_lan ingress-filtering=no interface=eoip31 \
internal-path-cost=10 path-cost=10 pvid=1902
add bridge=bridge_lan ingress-filtering=no interface=eoip39 \
internal-path-cost=10 path-cost=10 pvid=39
/ip firewall connection tracking
set udp-timeout=30s
/ip neighbor discovery-settings
set discover-interface-list=LAN
/interface bridge vlan
add bridge=bridge_lan tagged=bridge_lan untagged=ether2,eoip39 vlan-ids=39
add bridge=bridge_lan tagged=ether2,bridge_lan untagged=eoip31 vlan-ids=1902
add bridge=bridge_lan untagged=ether3,ether4,ether5,bridge_lan vlan-ids=1
/interface list member
add comment=defconf interface=ether2 list=LAN
add comment=defconf interface=bridge-wan list=WAN
add interface=vlan31 list=LAN
add interface=bridge_lan list=LAN
/ip address
add address=172.17.39.209/24 interface=vlan39 network=172.17.39.0
add address=172.17.31.209/24 interface=vlan31 network=172.17.31.0
add address=192.168.88.1/24 interface=bridge_lan network=192.168.88.0
/ip dhcp-client
add comment=defconf interface=bridge-wan name=bridge-wan
/ip dhcp-server network
add address=192.168.88.0/24 dns-server=192.168.88.1 gateway=192.168.88.1
/ip dns
set allow-remote-requests=yes
/ip dns static
add address=192.168.88.1 name=router.lan type=A
/ip firewall filter
add action=drop chain=input dst-port=53 in-interface=bridge-wan protocol=tcp
add action=drop chain=input dst-port=53 in-interface=bridge-wan protocol=udp
add action=fasttrack-connection chain=forward connection-state=\
established,related
/ip firewall nat
add action=masquerade chain=srcnat out-interface=bridge-wan src-address=\
192.168.88.0/24
/ip ipsec profile
set [ find default=yes ] dpd-interval=2m dpd-maximum-failures=5
/ip service
set ftp disabled=yes
set ssh disabled=yes
set telnet disabled=yes
set www disabled=yes
set reverse-proxy disabled=yes
set api disabled=yes
set api-ssl disabled=yes
/routing bfd configuration
add disabled=no interfaces=all min-rx=200ms min-tx=200ms multiplier=5
/tool graphing interface
add interface=ether1
add interface=vlan31
add interface=eoip39
No, that isn't a complete config. you don't even have the bridge section. Edit: I now see it, it just isn't in the standard location. How did you export your config?
Where are the ports connected that "are being throttled"? And what are they talking to?
You have left out significant information, you should not post your router's serial number (or possibly the mac addresses or software id), but the ROS version and model (which you stated was RB750Gr3) should be left in the config, as well as the timestamp.
E.g. it should look similar to this at the top.
# 2026-09-26 00:50:40 by RouterOS 7.23.5
# software id = ****-****
#
# model = RB760iGS
# serial number = ************
If traffic between ether4 and ether5 is being affected (when link speeds are 1Gbps) when ether2 is saturated (at 100Mbps), that is not entirely surprising because bridge ports ether4 and ether5 have hw=no so all traffic is forwarded to the CPU for processing.
It's possible the input buffer is being overrun while waiting for the CPU. What is the procesor utilization when the problems present themselves?
In most cases 1 bridge is all that's needed.
Hello all ..
vmnx:
RB750Gr3 ---> 5x Gigabit Ethernet, Dual Core 880MHz CPU, 256MB RAM, USB, microSD, RouterOS L4
1 - Free Memory -> ?
2 - Total Memory -> ?
3 - CPU Load -> ?
4 - iPv4 Fragment Threshold Bytes: -> ? Link>>Help_MikroTik>> or >>
Key Details
• Purpose: Sets the upper bound of RAM (in bytes) that the kernel can use for all IPv4 fragment reassembly queues combined.
• Behavior: When the cache reaches this limit, the router drops newly arriving fragments to protect system memory under heavy fragmentation.
• Configuration Method: It can only be changed via the RouterOS Terminal by specifying the exact value in bytes; it cannot be modified through Winbox or Webfig.
• Default Values: Dynamically scaled based on the total RAM of the device (e.g., 512 KiB for 64 MiB RAM up to 32 MiB for 2 GiB+ of RAM).
It is possible that the problem is not configuration-related but hardware-related... Check...
PS <> or FIRMWARE Version 
Not hardware related as design problem.
I had that device as first router and never had a problem using WAN at full speed ( then it was 300/30) while all other ports operated at wirespeed.
If speed is choked at 100mbps and other ports as well, there is too much going over CPU.
Easily verified by monitoring tool profile
Config problem.
It is not what he writes. What he writes is that when one port is 100Mbps and that port is saturated, other ports that are at 1Gbps are limited to 100Mbps as well.
And that is a wellknown issue that has been discussed several times before. It happens because there are shared data lanes that cause flow control.
Maybe 1 only is not enough, but 4 do seem too many (to me):
bridge-wan ether1
bridge31 eoip31, vlan31
bridge39 ether2, eoip39
bridge_lan ether3, ether4, ether5
actually I cannot even understand what is the goal that prompted to create the above setup.
rplant, what do you suggest for eoip and NAT? V6 or V7?
Buckeye, Where are the ports connected that "are being throttled"? And what are they talking to?
problem is ether4, if it start downloading at 100mb/s every other port strugles to provide more then 100mb/s
interesting part is that if port4 dont do anything, or not reaching 50mb/s, everything relating ports1-3 works great, 300-400mb/s (no drops)
jaclaz, I cant remember why there is bridge-wan, i think it is leftover from something, I will get rid of it
setup is to separate two LANS, and NAT users
Thanks all for the help, I'll try to experiment with all suggestions, or simply replace with more powerful RB
If that the whole purpose, then that is a relatively simple configuration, especially using the config generator in this thread
What is the purpose of the EoIP and VPN? Are you extending a LAN over the internet?
yes
and vlan needed because there is only one utp cable
Only 1 bridge needed then.
how can i pair eoip and vlan without using bridge?
Who said without a bridge? You do it all on a single bridge. Bridges are VLAN aware, so zero need to use one VLAN per . . . WAN port stands alone with no bridge. Switching happens on the bridge (switch chip) and L3 routing on the CPU.
Get your VLAN config sorted, and then move on to the tunnel