L009 with sky

Hi All

We’re using an L009 in a home environment. All works really well except for a sky mini box (everything is connected via wired ethernet btw, no WiFi)

The issue is an extremely bad lag when pausing or switching channels on the sky mini box. The main box is a couple of rooms away. The fix is brutal but it works. Removing the L009 and fitting the original Virgin 5x router removes the issue which shows me that the issue is something to do with the L009. I’ve tried multiple fixes, connecting via wifi, changing cables, changing switches etc but the only fix is to remove the L009. The L009 blows the Virgin 5x out of the water in terms of features so I really want it back in circuit.

Just looking to gather up suggestions on what to try from the community guys.

Mrt

I’m under the impression that you live in the UK going by mention of Sky and Virgin as ISPs.

Can you export your config and attach to the post please? Remember to remove serial numbers and sensitive info.

Would you also be able to expand upon what you mean by lag? Are you talking about the picture breaking up or are you talking about the stream becoming behind “real time”?

Hi,

Yes - UK based

config below. Nothing complicated, a few minor changes from the default, that’s all.

When I say lag I mean when I (for instance) pause then the it takes around 30 secs for the screen to actually pause. When I swap out the Mikrotik the issue disappears.

just looking for advice on where to look for a fix. Its sending me nuts.

/interface bridge
add admin-mac=F4:1E:57:C8:57:6E auto-mac=no comment=defconf name=bridge
add comment="WAN Backup" name="bridge1 - WAN Backup"
/interface pppoe-client
add add-default-route=yes comment="******* connection"
default-route-distance=10 interface="bridge1 - WAN Backup" name=
"pppoe-******* connection" use-peer-dns=yes user=
1234567@***********.net.uk
/interface list
add comment=defconf name=WAN
add comment=defconf name=LAN
/ip pool
add name=default-dhcp ranges=192.168.88.150-192.168.88.254
/ip dhcp-server
add address-pool=default-dhcp interface=bridge name=defconf
/port
set 0 name=serial0
/disk settings
set auto-media-interface=bridge auto-media-sharing=yes auto-smb-sharing=yes
/interface bridge port
add bridge=bridge comment=defconf interface=ether2
add bridge=bridge comment=defconf interface=ether3
add bridge=bridge comment=defconf interface=ether4
add bridge=bridge comment=defconf interface=ether5
add bridge=bridge comment=defconf interface=ether6
add bridge="bridge1 - WAN Backup" comment=defconf interface=ether7
add bridge=bridge comment=defconf interface=ether8
add bridge=bridge comment=defconf disabled=yes interface=sfp1
add bridge=bridge interface=ether1
/ip neighbor discovery-settings
set discover-interface-list=LAN
/interface list member
add comment=defconf interface=bridge list=LAN
add comment=Virgin interface=sfp1 list=WAN
add comment=Wildcard interface="pppoe-Wildcard connection" list=WAN
/ip address
add address=192.168.88.1/24 comment=defconf interface=bridge network=
192.168.88.0
/ip cloud
set ddns-enabled=yes
/ip dhcp-client
add comment=defconf interface=sfp1
/ip dhcp-server lease
add address=192.168.88.253 client-id=1:60:a4:b7:8a:6:9d mac-address=
60:A4:B7:8A:06:9D server=defconf
/ip dhcp-server network
add address=192.168.88.0/24 comment=defconf dns-server=192.168.88.1 gateway=
192.168.88.1
/ip dns
set allow-remote-requests=yes
/ip dns static
add address=192.168.88.1 comment=defconf name=router.lan type=A
/ip firewall filter
add action=accept chain=input comment=
"defconf: accept established,related,untracked" connection-state=
established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=
invalid
add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp
add action=accept chain=input comment=
"defconf: accept to local loopback (for CAPsMAN)" dst-address=127.0.0.1
add action=drop chain=input comment="defconf: drop all not coming from LAN"
in-interface-list=!LAN
add action=accept chain=forward comment="defconf: accept in ipsec policy"
ipsec-policy=in,ipsec
add action=accept chain=forward comment="defconf: accept out ipsec policy"
ipsec-policy=out,ipsec
add action=fasttrack-connection chain=forward comment="defconf: fasttrack"
connection-state=established,related hw-offload=yes
add action=accept chain=forward comment=
"defconf: accept established,related, untracked" connection-state=
established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid"
connection-state=invalid
add action=drop chain=forward comment=
"defconf: drop all from WAN not DSTNATed" connection-nat-state=!dstnat
connection-state=new in-interface-list=WAN
/ip firewall nat
add action=masquerade chain=srcnat comment="defconf: masquerade"
ipsec-policy=out,none out-interface-list=WAN
/ipv6 firewall address-list
add address=::/128 comment="defconf: unspecified address" list=bad_ipv6
add address=::1/128 comment="defconf: lo" list=bad_ipv6
add address=fec0::/10 comment="defconf: site-local" list=bad_ipv6
add address=::ffff:0.0.0.0/96 comment="defconf: ipv4-mapped" list=bad_ipv6
add address=::/96 comment="defconf: ipv4 compat" list=bad_ipv6
add address=100::/64 comment="defconf: discard only " list=bad_ipv6
add address=2001:db8::/32 comment="defconf: documentation" list=bad_ipv6
add address=2001:10::/28 comment="defconf: ORCHID" list=bad_ipv6
add address=3ffe::/16 comment="defconf: 6bone" list=bad_ipv6
/ipv6 firewall filter
add action=accept chain=input comment=
"defconf: accept established,related,untracked" connection-state=
established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=
invalid
add action=accept chain=input comment="defconf: accept ICMPv6" protocol=
icmpv6
add action=accept chain=input comment="defconf: accept UDP traceroute"
dst-port=33434-33534 protocol=udp
add action=accept chain=input comment=
"defconf: accept DHCPv6-Client prefix delegation." dst-port=546 protocol=
udp src-address=fe80::/10
add action=accept chain=input comment="defconf: accept IKE" dst-port=500,4500
protocol=udp
add action=accept chain=input comment="defconf: accept ipsec AH" protocol=
ipsec-ah
add action=accept chain=input comment="defconf: accept ipsec ESP" protocol=
ipsec-esp
add action=accept chain=input comment=
"defconf: accept all that matches ipsec policy" ipsec-policy=in,ipsec
add action=drop chain=input comment=
"defconf: drop everything else not coming from LAN" in-interface-list=
!LAN
add action=fasttrack-connection chain=forward comment="defconf: fasttrack6"
connection-state=established,related
add action=accept chain=forward comment=
"defconf: accept established,related,untracked" connection-state=
established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid"
connection-state=invalid
add action=drop chain=forward comment=
"defconf: drop packets with bad src ipv6" src-address-list=bad_ipv6
add action=drop chain=forward comment=
"defconf: drop packets with bad dst ipv6" dst-address-list=bad_ipv6
add action=drop chain=forward comment="defconf: rfc4890 drop hop-limit=1"
hop-limit=equal:1 protocol=icmpv6
add action=accept chain=forward comment="defconf: accept ICMPv6" protocol=
icmpv6
add action=accept chain=forward comment="defconf: accept HIP" protocol=139
add action=accept chain=forward comment="defconf: accept IKE" dst-port=
500,4500 protocol=udp
add action=accept chain=forward comment="defconf: accept ipsec AH" protocol=
ipsec-ah
add action=accept chain=forward comment="defconf: accept ipsec ESP" protocol=
ipsec-esp
add action=accept chain=forward comment=
"defconf: accept all that matches ipsec policy" ipsec-policy=in,ipsec
add action=drop chain=forward comment=
"defconf: drop everything else not coming from LAN" in-interface-list=
!LAN
/system ntp client
set enabled=yes
/system ntp client servers
add address=time.euro.apple.com
/system routerboard settings
set enter-setup-on=delete-key
/tool mac-server
set allowed-interface-list=LAN
/tool mac-server mac-winbox
set allowed-interface-list=LAN
/tool netwatch
add comment="Cloudflare DNS" disabled=no down-script="" host=1.1.1.1
interval=10s name=Cloudflare record-type=A test-script="" type=icmp
up-script=""
add comment="Google DNS" disabled=no down-script="" host=8.8.4.4 interval=10s
name="Google DNS" test-script="" type=icmp up-script=""
/tool traffic-monitor
add interface="pppoe-******* connection" name=traf1 traffic=received
add interface=sfp1 name=traf2 traffic=received

Thanks for posting the config and explaining the lag issue further.

I’ve studied your config and the only thing that I’ve noticed is that it lacks a rule to clamp MSS. If there is a packet that is sent via WAN and larger than expected for the destination then some servers outright reject it. This causes some websites to completely fail (e.g: https://nationwide.co.uk I noticed recently).

In both IPv4 and IPv6 firewall set the fasttrack rule to disabled for testing and then add these rules in:

/ip firewall mangle
add action=change-mss chain=forward comment="Clamp TCP MSS for IPv4" new-mss=clamp-to-pmtu out-interface-list=WAN protocol=tcp tcp-flags=syn
/ipv6 firewall mangle
add action=change-mss chain=forward comment="Clamp TCP MSS for IPv6" new-mss=clamp-to-pmtu out-interface-list=WAN protocol=tcp tcp-flags=syn

Let me know how you get on.

Thanks Sc0tty - the sky Q box and the Sky Mini are both on the LAN however the firewall must be getting involved as replacing it makes the issue vanish.

I’ll give this a go in the next few days and report back here.

(I’d have never have spotted an issue like this btw so thanks for that)

Mrt

Updated ip firewall mangle for both ipv4 and ipv6. Fasttrack also disabled.

refitted the Mikrotik to a network that works as expected. Initially all seemed well however with 5 mins or so the sky mini started showing the lag issue again. pausing the picture takes around 20 seconds to register, same for un-pausing. Changing channels has no effect for around 15 secs, then we see a black screen for another 10 secs then the channel changes.

The issue is bizarre but only manifests with the Mikrotik in circuit.

In all other respects the network behaves perfectly. When we re-install the Virgin 5x unit (don’t laugh) the issue vanishes again.

Any other ideas gratefully received.

I promise I didn’t laugh about the Virgin 5x router.

Shame the MSS clamping didn’t work. It sorted a few strange things going wrong here.

I honestly can’t see anything wrong with your config that would be doing this kind of thing. Without taking a deep look into what’s going on (interface stats, Torch, packet capture, etc) I’m struggling to suggest anything further.

Yeah, I've not listed anywhere near everything I've tried. I posted when I ran out of ideas. Thanks for the MSS clamping suggestion (I’d have never tried that btw). I have an idea that the next move is to run up a Wireshark session and setting a monitor port on the switch that’s running the Sky Mini box.

I’ll get round to that and post again. Thing is everything’s working but I really want the sky box moved to a cupboard. Even fitted an SFP configured for Virgin’s fibre…