Good evening,
I am trying to set up an Internet access using a decent router and an Acer M3 5G LTE access point.
For some reasons it did not work out well with an HexS (did not recognise the Acer M3-support is looking into it. So I did buy an hAP AC3 which sees immediately the M3 obtains an IP address and install a default route. I can ping google DNS and google.com. I did install a mangle chain rule with a masquerade action and the internal hosts get out on the Internet.
So it all appears to be fine but ...
Performance are not making me particularly enthusiast.
when I set up a fast connection action for the established related connection in the forwarding chain the ping doubles up in time and the connectivity breaks down ....
Using a 5g AP that ranges between 120 to 240 Mbps and going through the Mikrotik I get no more than 18-20 Mbps. This happens bot if I connect the AP via USB or via one of the WIFI interfaces.
So it appears that the Mikrotik Router is the bottleneck. The processors stays low (less than 3%) memory stays 30% used 60% free. Anybody knows if this router has fasttrack/hardware offload? Even if the processor does not appear to be the problem.
The test is done locally (no tunnel involved, only NAT) but the router is originating a IPSEC IKEv2 tunnel and an overlaying GRE tunnel using the IPSEC endpoints as source/destination.
Is there any thing I should try to improve performance? Any setting I should enable?
Thank you in advance.
Fabio
@jaclaz thank you for your interest.
I usually do not post complete configs in forums because of security concerns.
Beside it is about 160 lines.
Any area in particular I should be looking int performance wise?
The setup works and it is functional, only slower than expected.
Regards
Fabio
But this question can be answered without seeing your configuration:
The hAP ac³ has full fasttrack support because it's a software feature. It only has hardware offload for switching (L2) not for routing (L3). The problems you see, all the issues when you enabled fasttrack, are due to:
Connections marked with fasttrack-connection are not compatible with mangle rules. If you use mangle mark-connection with mark-routing and let those connections be fasttrack-ed, you'll end up with part of the connection's packets that go through the correct routing table, while the majority of the packets use the wrong routing table. This usually results in massive packet loss (the routers on the route don't accept packets with wrong source/destination address for example), causing the delays and abysmal performance (only the few packets that are not fasttrack-ed get through).
Sorry forgot to add that in making my FW rules I referre to:
and the offending statement (which is not in the config now) was:
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" connection-state=established,related
You are in good hands, with CGG, all I will say is that go with vlans and one bridge if you can.
Multiple bridges will not be efficient.
Not sure why you have any ICMP rules on the forward chain, new one to me.
You have the required simple and effective allow ICMP on the input chain, done................
@anav thank you,
I wish you could elaborate a bit further on this.
What is the difference in using VLAN and Bridges interfaces on Mikrotik?
I did ask this question some time ago and I had the impression that if you do not need VLANs don't bother with them.
In this installation I do not need 803.1q VLANs/tagging and that is the reason why I used bridges.
I am more familiar with Cisco environments (been doing easy things on Cisco since 1994 nothing complicated) and in that environment you just add interfaces on the WAN port or ports on the Bridge Virtual Interface/bridge group .... (exactly what I did here ...).
So interfaces wlan1/2 and all ethernet ports they belong to the same broadcast domain.
Interfaces wlan 3/4 to same broadcast domain (separate from the previous)
and so wlan 5/6.
They are in separate /24 and are routed differently.
The first broadcast domain is NATted and sent directly out of the default route from the locally connected Internet interface (LTE1).
The other two (which are contiguous and constitute a /23 network in order to be efficiently matched) are routed without translation to gre tunnel1 which is laying over an IPSEC SA (out from LT1 to the central router). Further routing to the local network, firewalling Internet forwarding and NAT is handled centrally by the Cisco Router HUB in this topology.
These separate broadcast domains need to be able to communicate locally at layer 3.
If the configuration you posted is what you call simple, I don't want to know what you call complex.
I believe you will have to adapt it to the various Mikrotik peculiarities, if you want it to work efficiently and flawlessly.
I see at first glance in your configuration (not that I understand all of it) several violations of the Twelve Rules of the Mikrotik Club (and of GP & CSA), just in case:
Most are of course not really relevant/important, but the multiple bridges and the use of the "old" wireless (as opposed to the "new" wifi) drivers may - I believe - actually affect negatively performance. (but the nstreme is not an option with wifi, so if you actually need it, the wireless packet is needed).
externall BGP, LACP, load balancing between circuits, multiple redundancies, multiple external routes …. multiple internal routing protocols redistributing between them, VRF …. you name it.
This is just a router with 3 networks, one tunnel protected by ipsec and one default route. I am running OSPF to propagate the internal networks because I wont bother writing the static routes. But I could do it with static because the routes will not change are there or they are not…
I have read the rules, they make sense , I hope I am not breaking 11 … I am here to understand Mikrotik way of doing things.
I am on routeros 7.19.4, the latest stable (or release candidate according to the ‘rule book’).
Usually when I get a router, I check what it is on it, read the release note of the last release train, and if there are no issues with the technologies I need to implement update and leave it until it breaks ….
I am reading the forum to understand the quirks of Mikrotik, can you point me to discussions/docs covering the bridges/wifi issues you mentioned above?
Re: multiple bridges:
One of the things is that for Mikrotik VLAN can be HW offloaded to bridge for some devices if you use the standard VLAN way of setting up VLAN.
But only to 1 bridge.
If you have multiple, it is not always guaranteed things will work for this aspect (and you might not even know which one will get the HW offload. Usually the first, I think).
You can use switch rules (which is also needed for devices having multiple bridges like RB4011) but it is a bit different. The standard VLAN approach has the advantage it always works (but can be with or without HW offload then).
Usage of VLAN is also more or less brand agnostic. VLAN is VLAN.
Use of bridges is rather brand specific.
My view.
Thanks @holvoetn,
very useful.I did spend sometime studying today the architecture and inner working of the Mikrotiks, an tomorrow (hopefully) I will do some trials with the unsuitable hEX S.
Apparently the best way of doing this is to create multiple VLANs interfaces and a single switch, and offload the switching of the VLANs in the vlan table to the HW by adding the VLANs to the switch and making the physical interfaces members of the VLAN. This, apparently, can be done by the single switch chip for multiple VLANs/VLANs interfaces. InterVLAN communication is then sent to the CPU(routing). The switch chip inthe hAP ac^3 also support rules and traffic can be manually sent to the CPU switching port at will.
the page Switch Chip Features - RouterOS - MikroTik Documentation has alot of interesting info.
Digging I found this:
It is possible to use the built-in switch chip and the CPU at the same time to create a Switch-Router setup, where a device acts as a switch and as a router at the same time. You can find a configuration example in the Switch-Router guide.
The wiki page exists butit is empty.
Anybody knows how is it? Never created, removed?
Too many "wiki" in the url (sometimes in the past the whole stuff has been moved around causing any kind of bad links), use this (middle wiki removed) https://wiki.mikrotik.com/Manual:Switch_Router
BUT you are mixing liberally contents of the wiki (essentially related to routerOS 6.x) with content of the help pages (essentially related to routerOs 7.x), just like you are using wireless on 7.x, something coming from 6.x works, some works worse, some doesn't work at all (anymore).
besides you will have to go through BOTH of these threads:
Queues (except Queue Trees parented to interfaces), firewall filter, and mangle rules will not be applied for FastTracked traffic.
externall BGP, LACP, load balancing between circuits, multiple redundancies, multiple external routes …. multiple internal routing protocols redistributing between them, VRF …. you name it.