Hello all you Mikrotik experts!
Im in need of some help, and Im NOT an mikrotik expert, so I really need you to guide me through as good as you can in the helping.
I have an issue with my old Mikrotik CRS125-24G-1S switch.
My internet (or LAN connection) is sometimes incredible slow! Using my ethernet connected pc is sometimes only 1-2Mbit/sec, same if I test with another computer, or through a Wireless AP.
Its so low I barely is able to get in to my router remotely to reboot it! (which is why I beleive its not the internet speed that is low, it something going on in my LAN or Router)
But as soon as I have rebooted my router, my speed is up OK again. For a while… until I need to reboot it again, and again… and so on!
Looking at Resources, it says cpu load is somewhere between 20-75% isch… Free memory is fine.
Any idea what is going on? How can I fault trace this? Maybe there is some logging I can share that someone of you experts could take a look at?
Any help or idea of what to do is really appreciated!
It’s a switch, not a router, it has a different use. Do you drink broth with a fork?
Whatever happens, you need to show the switch configuration export (not screenshot),
because it should still be able to rotate at least 100Mbps for sure, so it could be the configuration that sinks it. https://mikrotik.com/product/CRS125-24G-1S-IN#fndtn-testresults
Or maybe you’re using a hand-built configuration where half the world is using your switch as a source for DDoS attacks…
Or your provider simply doesn’t work.
You don’t wrote that you put another router and with that the internet is fast…
@crazytok; your CRS125-24G-1S has a very weak CPU, which struggles when used as a router. This device is primarily designed as a switch, meaning that when it operates in switch mode, the CPU is only used for configuration. After that, all Ethernet traffic flows directly without involving the CPU.
But when you use it as a router, the CPU has to process all traffic, which it simply isn’t powerful enough for. If you need proper routing, the best solution is to use a dedicated router and let the CRS125 handle just switching. That should fix your slow speeds!
Interesting, did not know this! But the thing is I have used it like 9years and it has been working really good! Its like the last half year it has been acting strange… Actually when you say it, Im looking at the CPU load right now… and when downloading something it goes up to 100% constantly! But still.. I have never had any issues before? Still seems strange I think.
Your “router” might be compromised, especially while running v6.43.8 and having web access publically.
Check if there are users not known to you.
What I would do in your situation (and no new users):
Close all ports from public (including the DNS server and VPN)
Upgrade RouterOS and firmware to LTS (currently v6.49.18).
From there, get some good advise on everything firewall related.
all the bridge config is obsolete for new versions, just upgrade to last v6 long term.
pptp server enabled whit blank user??? the world is not enough… open door for all the world…
/interface pptp-server server
set authentication=pap,chap,mschap1,mschap2 enabled=yes
/interface pptp-server
add name=pptp-in1 user=“”
easy hackable the pptp server…
/ppp secret
add name=jonas password=X profile=default-encryption service=pptp
add name=thomas password=X profile=default-encryption service=pptp
/ip firewall filter
add action=accept chain=input comment=“Allow PPTP Server Gre” protocol=gre
add action=accept chain=input comment=“Allow PPTP Server 1723” dst-port=1723 protocol=tcp
ovpn server enabled???..
/interface ovpn-server server
set auth=sha1 certificate=server cipher=aes256 enabled=yes require-client-certificate=yes
The address must go on the bridge, but all the bridge/port config is obsolete.
/ip address
add address=192.168.1.1/24 interface=ether01-master-local-vince network=192.168.1.0
DNS open to the world???.. DDoS a go-go…
/ip dns
set allow-remote-requests=yes servers=192.168.1.1
/ip firewall nat
add action=redirect chain=dstnat comment=“DIRECT ALL DNS REQUESTS TO MIKROTIK INTERNAL DNS SERVER” dst-port=53 protocol=udp to-addresses=192.168.1.1 to-ports=53
a space on DNS???..
/ip dns static
add address=192.168.1.32 name="airport2.local "
add address=192.168.1.33 name="airport3.local "
add address=192.168.1.34 name="airport4.local "
add address=192.168.1.35 name="airport5.local "
add address=192.168.1.202 name="shelly2.local "
add address=192.168.1.203 name="shelly3.local "
add address=192.168.1.204 name="shelly4.local "
add address=192.168.1.205 name="shelly5.local "
That’s a leftover from even older ROS versions when default setting was speed=100M-baseT-full … with not so ancient versions, default changed to speed=1G-baseT-full, but running settings never change on ROS upgrade … only export started to show that setting (due to being different than default for that particular ROS version).
Wow, a lot to fix I assume then!
Thanks for your help and time!
Unfortunately, I dont follow everything you are saying here... but I will try my best!
RouterOS
Updated to latest now!
fast-forward off???
Yepp, never heard about it before! I have now enabled it in the Bridge configuration, is that correct?
all the bridge config is obsolete for new versions, just upgrade to last v6 long term.
Not really sure what you mean about this?
pptp server enabled whit blank user???
looks like it yes, dont know why though. May be some old configurations I have used before or just tested and not fully configured it. I have now added a name, is that enough?
/ppp secret
add name=jonas password=X profile=default-encryption service=pptp
add name=thomas password=X profile=default-encryption service=pptp
/ip firewall filter
add action=accept chain=input comment="Allow PPTP Server Gre" protocol=gre
add action=accept chain=input comment="Allow PPTP Server 1723" dst-port=1723 protocol=tcp
Not sure what you want here?
ovpn server enabled???
again, probably som old settings... not using anymore anyway so I disabled it!
The address must go on the bridge, but all the bridge/port config is obsolete.
/ip address
add address=192.168.1.1/24 interface=ether01-master-local-vince network=192.168.1.0
Dont understand what to do.
DNS open to the world???
Yes, tried to change "allow remote request" to Disabled but then my internet dont work on all my devices anymore?
a space on DNS???
No, cant see this in my configurations. Also it does not exist when exporting new config file with new mikrotik os update?
Seriously?????
add address=192.168.1.120 name="Thomas iPhone"
add address=192.168.1.121 name="Sofie's iPhone"
add address=192.168.1.122 name="iPad Air"
Totaly serious! But I dont know why... again probably some old things I tested.
is www-ssl ENABLED on port 444...
winbox is enabled on default port....
/ip service
set www-ssl port=444
No? Looking into IP->Services www-ssl is disabled?
You assigned an IP address to an ether interface (ether01-master-local-vince), but then you included it in a bridge:
/interface bridge port
add bridge=bridge1 interface=ether01-master-local-vince
…
so this port is not anymore self-standing and it having an address is not needed (and void of any effect).
Overall (and mind you this is just my opiinion, man) your “needed” configuration appears to be somehow hiding below several layers of cruft deriving from leftovers from tests/old settings and what not, it is very difficult from the outside to understand (sometimes guess) which parts are needed and which parts are just leftovers (that may only represent a visual complucation or actually prevent somethign else from working correectly).
IMHO it would be much easier if you would enumerate what you actually need, then restart from a reset configuration and re-add only what is actually needed, for two reasons, the first to make sure that there is nothing compromising the working of the device, the second to make the whole stuff simpler, more readable and thus easier to mantain/change/fine tune-
Its like the last half year it has been acting strange… Actually when you say it, Im looking at the CPU load right now… and when downloading something it goes up to 100% constantly! But still.. I have never had any issues before? Still seems strange I think. 
