Mikrotik Hex S slow speeds on LAN interface only.

The device is a Mikrotik Hex S. I have a 1Gbps up/down fiber connection that is connected to an ONT and the Mikrotik is connected to this ONT. The connection is a static WAN connection not PPPoE. Port eth2 is set up as the WAN interface with the static IP configured. When I run a network test using the public btest server from the Mikrotik directly, I get speeds of about 900Mbps up and down, as expected.

Now, eth3 is configured as the LAN port on the Mikrotik, when I connect a laptop/computer to this eth3 port and do an iper3 test or normal speedtest, I am unable to go beyond 600Mbps. What could be causing this? I have fasttrack enabled on the LAN traffic, barely any firewall rules, no QoS nothing, and still this.

Config is as below.

[admin@MikroTik] > export hide-sensitive  
# nov/03/2021 23:38:32 by RouterOS 6.49
# software id = M78Y-G31Y
#
# model = RB760iGS
# serial number = D4500F55A0D0
/interface bridge
add name=bridge1
/interface ethernet
set [ find default-name=ether3 ] name=LAN1-Orbi-eth3
set [ find default-name=ether1 ] disabled=yes name=WAN1-BSNL-eth1
set [ find default-name=ether2 ] name=WAN2-Airtel-eth2
set [ find default-name=ether4 ] disabled=yes
set [ find default-name=ether5 ] disabled=yes
set [ find default-name=sfp1 ] disabled=yes
/interface pppoe-client
add add-default-route=yes interface=WAN1-BSNL-eth1 keepalive-timeout=disabled name=pppoe-bsnl user=ra2029707177_wid@ftth.bsnl.in
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
/ip pool
add name=LAN-Pool1 ranges=192.168.88.10-192.168.88.254
/ip dhcp-server
add address-pool=LAN-Pool1 disabled=no interface=bridge1 name=LAN-DHCP
/interface bridge port
add bridge=bridge1 interface=ether4
add bridge=bridge1 interface=ether5
add bridge=bridge1 interface=LAN1-Orbi-eth3
/ip address
add address=192.168.88.1/24 interface=LAN1-Orbi-eth3 network=192.168.88.0
add address=182.70.126.226/24 interface=WAN2-Airtel-eth2 network=182.70.126.0
/ip dhcp-client
add comment=defconf disabled=no
/ip dhcp-server network
add address=192.168.88.0/24 dns-server=65.1.35.223 gateway=192.168.88.1
/ip dns
set servers=1.1.1.1
/ip firewall address-list
add address=192.168.88.2-192.168.88.254 list=allowed_to_router
add address=0.0.0.0/8 comment=RFC6890 list=not_in_internet
add address=172.16.0.0/12 comment=RFC6890 list=not_in_internet
add address=192.168.0.0/16 comment=RFC6890 list=not_in_internet
add address=10.0.0.0/8 comment=RFC6890 list=not_in_internet
add address=169.254.0.0/16 comment=RFC6890 list=not_in_internet
add address=127.0.0.0/8 comment=RFC6890 list=not_in_internet
add address=224.0.0.0/4 comment=Multicast list=not_in_internet
add address=198.18.0.0/15 comment=RFC6890 list=not_in_internet
add address=192.0.0.0/24 comment=RFC6890 list=not_in_internet
add address=192.0.2.0/24 comment=RFC6890 list=not_in_internet
add address=198.51.100.0/24 comment=RFC6890 list=not_in_internet
add address=203.0.113.0/24 comment=RFC6890 list=not_in_internet
add address=100.64.0.0/10 comment=RFC6890 list=not_in_internet
add address=240.0.0.0/4 comment=RFC6890 list=not_in_internet
add address=192.88.99.0/24 comment="6to4 relay Anycast [RFC 3068]" list=not_in_internet
/ip firewall filter
add action=fasttrack-connection chain=forward connection-state=established,related
add action=accept chain=forward connection-state=established,related
/ip firewall nat
add action=masquerade chain=srcnat out-interface=WAN2-Airtel-eth2
/ip route
add check-gateway=ping distance=1 gateway=182.70.126.1
/system clock
set time-zone-name=Asia/Kolkata

Two things:

  1. Move LAN IP address to bridge
  2. remove (or disable) DHCP client

And note that device has no firewall (default action is accept).

Thanks. LAN IP range moved to bridge and DHCP client was removed. However, neither of these resolved the problem, unfortunately. Tried different physical cables already for the LAN connection.

Give this topic a good read http://forum.mikrotik.com/t/hex-block-diagram/114819/1

Many thanks. That looks like what I needed. Moved WAN to ether1 and bridged 2,3,4,5 and connected LAN to 4. Do see an improvement.

Note the last post in that thread as well: if you’re using VLANs, upgrading to the latest 7.1rc5 might be advisable since there are specific improvements for the hEX S in that release for hardware VLAN offloading.