Hello Everyone My Mikrotik router rb951g-2hnd speed is too slow after connecting to my starlink. I don’t even get 30Mbps but when I connect another router to my starlink i get more than 130Mbps download speed. Any help why this may be happening. I want to use Mikrotik router as a main router. Thanks.
hardware should be capable. maybe you want to share your configuration. Forum rules - #5 by gigabyte091
Is it configured as an ap with all interfaces bridged? Routing? Are you using the default config with ether1 as a WAN port?
Speed is over wifi or ethernet?
This is not a newsletter, nor a manual, nor even a ccr1009.
configured as AP, / using default ether1. speed is over ethernet
# mar/12/2026 11:03:04
# software id =
#
# model = 951Ui-2HnD
# serial number =
/interface bridge
add admin-mac= auto-mac=no comment=defconf name=bridge
add name="bridge1 MikroTik-StaTion 2"
/interface pppoe-client
add add-default-route=yes interface=ether1 name=pppoe-out1 password= \
use-peer-dns=yes user=keith
/interface wireless
set [ find default-name=wlan1 ] band=2ghz-b/g/n channel-width=20/40mhz-XX \
disabled=no distance=indoors frequency=auto mode=ap-bridge ssid=\
MikroTik-StaTion tx-power=28 tx-power-mode=all-rates-fixed \
wireless-protocol=802.11 wps-mode=disabled
/interface list
add comment=defconf name=WAN
add comment=defconf name=LAN
/interface wireless security-profiles
set [ find default=yes ] authentication-types=wpa2-psk comment=defconf \
disable-pmkid=yes mode=dynamic-keys supplicant-identity=MikroTik \
wpa-pre-shared-key= wpa2-pre-shared-key=
add authentication-types=wpa2-psk disable-pmkid=yes mode=dynamic-keys name=\
"MikroTik-StaTion 2" supplicant-identity=MikroTik wpa2-pre-shared-key=\
/interface wireless
add disabled=no mac-address=F6:1E:57:93:34:39 master-interface=wlan1 name=\
"MikroTik-StaTion 2" security-profile="MikroTik-StaTion 2" ssid=\
"MikroTik-StaTion 2" wps-mode=disabled
/ip pool
add name=dhcp ranges=192.168.88.10-192.168.88.254
add name=dhcp_pool2 ranges=10.10.10.2-10.10.10.254
/ip dhcp-server
add address-pool=dhcp disabled=no interface=bridge lease-time=1d10m name=\
local
add address-pool=dhcp_pool2 disabled=no interface=\
"bridge1 MikroTik-StaTion 2" lease-time=1d10m name=dhcp1
/interface bridge nat
add action=accept chain=srcnat
/interface bridge port
add bridge=bridge comment=defconf interface=ether2
add bridge=bridge comment=defconf interface=ether3
add bridge=bridge comment=defconf interface=ether4
add bridge=bridge comment=defconf interface=ether5
add bridge=bridge comment=defconf interface=wlan1
add bridge="bridge1 MikroTik-StaTion 2" interface="MikroTik-StaTion 2"
/ip neighbor discovery-settings
set discover-interface-list=LAN
/interface bridge vlan
add bridge=bridge tagged=ether3,bridge vlan-ids=20
/interface list member
add comment=defconf interface=bridge list=LAN
add comment=defconf interface=ether1 list=WAN
add interface=pppoe-out1 list=WAN
/ip address
add address=192.168.88.1/24 comment=defconf interface=bridge network=\
192.168.88.0
add address=10.10.10.1/24 interface="bridge1 MikroTik-StaTion 2" network=\
10.10.10.0
/ip dhcp-client
add disabled=no interface=ether1
/ip dhcp-server network
add address=10.10.10.0/24 dns-server=8.8.8.8,8.8.4.4,9.9.9.9 gateway=\
10.10.10.1
add address=10.20.20.0/24 gateway=10.20.20.1
add address=192.168.88.0/24 comment=defconf dns-server=192.168.88.1 gateway=\
192.168.88.1
/ip dns
set allow-remote-requests=yes servers=8.8.8.8,8.8.4.4,1.1.1.1
/ip dns static
add address=192.168.88.1 comment=defconf name=router.lan
/ip firewall filter
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" \
connection-state=established,related
add action=accept chain=input comment=\
"defconf: accept established,related,untracked" connection-state=\
established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=\
invalid
add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp
add action=accept chain=input comment=\
"defconf: accept to local loopback (for CAPsMAN)" dst-address=127.0.0.1
add action=drop chain=input comment="defconf: drop all not coming from LAN" \
in-interface-list=!LAN
add action=accept chain=forward comment="defconf: accept in ipsec policy" \
ipsec-policy=in,ipsec
add action=accept chain=forward comment="defconf: accept out ipsec policy" \
ipsec-policy=out,ipsec
add action=accept chain=forward comment=\
"defconf: accept established,related, untracked" connection-state=\
established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" \
connection-state=invalid
add action=drop chain=forward comment=\
"defconf: drop all from WAN not DSTNATed" connection-nat-state=!dstnat \
connection-state=new in-interface-list=WAN
/ip firewall nat
add action=masquerade chain=srcnat comment="defconf: masquerade" \
ipsec-policy=out,none out-interface-list=WAN
/snmp
set enabled=yes
/system clock
set time-zone-name=Africa/Accra
/system identity
set name=MikroTik-StaTion
/system ntp client
set enabled=yes primary-ntp=85.199.214.99 server-dns-names=0.pool.ntp.org
/tool mac-server
set allowed-interface-list=LAN
/tool mac-server mac-winbox
set allowed-interface-list=LAN
# mar/12/2026 11:03:04
# software id =
#
# model = 951Ui-2HnD
# serial number =
/interface bridge
add admin-mac= auto-mac=no comment=defconf name=bridge
add name="bridge1 MikroTik-StaTion 2"
/interface pppoe-client
add add-default-route=yes interface=ether1 name=pppoe-out1 password= \
use-peer-dns=yes user=keith
/interface wireless
set [ find default-name=wlan1 ] band=2ghz-b/g/n channel-width=20/40mhz-XX \
disabled=no distance=indoors frequency=auto mode=ap-bridge ssid=\
MikroTik-StaTion tx-power=28 tx-power-mode=all-rates-fixed \
wireless-protocol=802.11 wps-mode=disabled
/interface list
add comment=defconf name=WAN
add comment=defconf name=LAN
/interface wireless security-profiles
set [ find default=yes ] authentication-types=wpa2-psk comment=defconf \
disable-pmkid=yes mode=dynamic-keys supplicant-identity=MikroTik \
wpa-pre-shared-key= wpa2-pre-shared-key=
add authentication-types=wpa2-psk disable-pmkid=yes mode=dynamic-keys name=\
"MikroTik-StaTion 2" supplicant-identity=MikroTik wpa2-pre-shared-key=\
/interface wireless
add disabled=no mac-address=F6:1E:57:93:34:39 master-interface=wlan1 name=\
"MikroTik-StaTion 2" security-profile="MikroTik-StaTion 2" ssid=\
"MikroTik-StaTion 2" wps-mode=disabled
/ip pool
add name=dhcp ranges=192.168.88.10-192.168.88.254
add name=dhcp_pool2 ranges=10.10.10.2-10.10.10.254
/ip dhcp-server
add address-pool=dhcp disabled=no interface=bridge lease-time=1d10m name=\
local
add address-pool=dhcp_pool2 disabled=no interface=\
"bridge1 MikroTik-StaTion 2" lease-time=1d10m name=dhcp1
/interface bridge nat
add action=accept chain=srcnat
/interface bridge port
add bridge=bridge comment=defconf interface=ether2
add bridge=bridge comment=defconf interface=ether3
add bridge=bridge comment=defconf interface=ether4
add bridge=bridge comment=defconf interface=ether5
add bridge=bridge comment=defconf interface=wlan1
add bridge="bridge1 MikroTik-StaTion 2" interface="MikroTik-StaTion 2"
/ip neighbor discovery-settings
set discover-interface-list=LAN
/interface bridge vlan
add bridge=bridge tagged=ether3,bridge vlan-ids=20
/interface list member
add comment=defconf interface=bridge list=LAN
add comment=defconf interface=ether1 list=WAN
add interface=pppoe-out1 list=WAN
/ip address
add address=192.168.88.1/24 comment=defconf interface=bridge network=\
192.168.88.0
add address=10.10.10.1/24 interface="bridge1 MikroTik-StaTion 2" network=\
10.10.10.0
/ip dhcp-client
add disabled=no interface=ether1
/ip dhcp-server network
add address=10.10.10.0/24 dns-server=8.8.8.8,8.8.4.4,9.9.9.9 gateway=\
10.10.10.1
add address=10.20.20.0/24 gateway=10.20.20.1
add address=192.168.88.0/24 comment=defconf dns-server=192.168.88.1 gateway=\
192.168.88.1
/ip dns
set allow-remote-requests=yes servers=8.8.8.8,8.8.4.4,1.1.1.1
/ip dns static
add address=192.168.88.1 comment=defconf name=router.lan
/ip firewall filter
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" \
connection-state=established,related
add action=accept chain=input comment=\
"defconf: accept established,related,untracked" connection-state=\
established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=\
invalid
add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp
add action=accept chain=input comment=\
"defconf: accept to local loopback (for CAPsMAN)" dst-address=127.0.0.1
add action=drop chain=input comment="defconf: drop all not coming from LAN" \
in-interface-list=!LAN
add action=accept chain=forward comment="defconf: accept in ipsec policy" \
ipsec-policy=in,ipsec
add action=accept chain=forward comment="defconf: accept out ipsec policy" \
ipsec-policy=out,ipsec
add action=accept chain=forward comment=\
"defconf: accept established,related, untracked" connection-state=\
established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" \
connection-state=invalid
add action=drop chain=forward comment=\
"defconf: drop all from WAN not DSTNATed" connection-nat-state=!dstnat \
connection-state=new in-interface-list=WAN
/ip firewall nat
add action=masquerade chain=srcnat comment="defconf: masquerade" \
ipsec-policy=out,none out-interface-list=WAN
/snmp
set enabled=yes
/system clock
set time-zone-name=Africa/Accra
/system identity
set name=MikroTik-StaTion
/system ntp client
set enabled=yes primary-ntp=85.199.214.99 server-dns-names=0.pool.ntp.org
/tool mac-server
set allowed-interface-list=LAN
/tool mac-server mac-winbox
set allowed-interface-list=LAN
Thanks.
Why you need 2 bridges? Why srcnat on bridge?
Are you using starlink is some kind of bypassmode or what?
Reset your router with no defaults and start by bridging all ports, then test the speed. Make sure that both the starlink port and pc/laptop are at 1G, if not disable hw-offload on the 100M port.
Do you have an "RB951G-2HND" or as the configuration says a "951Ui-2HnD" which only has 10/100 ethernet ports?
Well done, export speaks for itself...
IT'S ONLY GOING TO 100...
951Ui-2HnD
Although this device is (to my astonishment) still being sold, it is at least a 12 year old design, and I think back then it already was a revamp of an existing model.
It should be possible to get a little more than 30Mbps routing performance, but not very much more. When you want Starlink-compatible performance it is time to buy something new, e.g. hAP ax2.