Searching documentation on how to speed up our ccr1072 performance i found that http://forum.mikrotik.com/t/raw-accept-vs-ip-firewall-fasttrack-which-one-is-faster-and-light-weight/103629/1
For me this have no sense has the fasttrack need to be tagged in mangle that is after ip raw so i did some tests.
- first example:
IP raw in place without accept on last for all packets and fasttrack disable:
NAME CPU USAGE
firewall-mgmt 0%
spi 0%
ethernet 0%
console 0%
firewall 10%
networking 7.9%
winbox 0%
management 0%
routing 1.3%
profiling 1.3%
queuing 0%
bridging 0%
unclassified 1.6%
total 22.1%
IP raw rules (DNS amp rules + 1 ip blocked)
1 chain=prerouting action=accept in-interface=AMS-IX src-port=53 limit=900,100:packet log=no log-prefix="" protocol=udp
2 chain=prerouting action=drop in-interface=AMS-IX src-port=53 log=no log-prefix="" protocol=udp
3 chain=prerouting action=drop log=no log-prefix="" src-address=109.115.xx.xx dst-address=95.141.xx.xx
2nd example:
IP raw in place WITH accept on last for all packets and fasttrack disable:
NAME CPU USAGE
firewall-mgmt 0%
spi 0%
ethernet 0%
console 0%
firewall 5.3%
networking 6.7%
winbox 0%
management 0.2%
routing 1.7%
profiling 0.1%
unclassified 0.4%
total 14.4%
IP raw rules (DNS amp rules + 1 ip blocked + accept)
1 chain=prerouting action=accept in-interface=AMS-IX src-port=53 limit=900,100:packet log=no log-prefix="" protocol=udp
2 chain=prerouting action=drop in-interface=AMS-IX src-port=53 log=no log-prefix="" protocol=udp
3 chain=prerouting action=drop log=no log-prefix="" src-address=109.115.xx.xx dst-address=95.141.xx.xx
4 chain=prerouting action=accept log=no log-prefix=""
3 example:
IP raw without accept BUT with fast track
1 chain=prerouting action=accept in-interface=AMS-IX src-port=53 limit=900,100:packet log=no log-prefix="" protocol=udp
2 chain=prerouting action=drop in-interface=AMS-IX src-port=53 log=no log-prefix="" protocol=udp
3 chain=prerouting action=drop log=no log-prefix="" src-address=109.115.xx.xx dst-address=95.141.xx.xx
> /ip firewall filter print
Flags: X - disabled, I - invalid, D - dynamic
0 D ;;; special dummy rule to show fasttrack counters
chain=forward action=passthrough
1 chain=forward action=fasttrack-connection log=no log-prefix=""
2 chain=forward action=accept log=no log-prefix=""
NAME CPU USAGE
spi 0%
ethernet 0%
console 0%
firewall 2.9%
networking 7%
winbox 0%
management 0.2%
routing 1%
profiling 0.2%
unclassified 0.6%
total 11.9%
As anybody can see we can have better result filtering in raw and enabling fasttrack even the connection tracking is disabled.