New HAP ac2 as ATT Bridge (slow, sites not loading)

[Zorb]

I was wondering if the modem was polled to keep the connection alive once it receives a WAN ip - I would have tried it because some users alluded to this being possible, but like I said earlier, I don’t have an Arris…

Regardless, you have 5 options to get a WAN ip:

1. You connect the HAP behind the modem using the IP passthrough option in the modem (many step by step guides available from ATT users) which requires entering the router’s MAC into the modem. Some users report having speed issues, some don’t. It’s not clear to me why this doesn’t work for you as this is by far the easiest option. Without the IP passthrough, like you said, you have a router behind a router, which is a terrible idea, double NAT being the number one reason.
2. You lease a static IP block which will let you setup your devices as you wish by having more than one device connected to the WAN.
3. You bypass the modem using a script, as you are doing now. Maybe anav or another advanced user can explain it better than I can, but all the issues you are having are caused by an invalid configuration: the double bridge being problematic since the small HAP AC2 has only one switch chip which support 1 bridge with HW offloading (you may use multiple VLANs).
4. You use the supplicant method which requires you to root the modem to retrieve the security certificate and install it on the router.
5. You use pfSense before the modem to bypass it in a similar way as the script you’re using now.

The HAP AC2 is capable of routing at much higher speeds than what you are getting with reasonable firewall rules and queues, but testing should be done wired to the router, not over wifi.

So it’s not a QOS issue - your HAP is using a clever script that was designed for a router with 2 switch chips (please look at the diagrams for both routers and the Mikrotik Wiki). Once this is resolved, bufferbloat protection takes less than a minute to setup with a single SFQ queue (no mangle rules) and I can guide you for a more advanced config using fasttrack. IMO, trying to setup QOS before you can get close to wire speed with a basic config on the router is a big waste of time…

Well everything was actually solved except i haven’t figured out the QoS stuff yet, speeds are lower than expected since I was maxing the CPU out on the Edgerouter X with smart queue on and getting about 250 Mb and 5-10 ms bufferbloat.
Now I have 225 Mb and 100-500 ms bufferbloat.
I tried the walkthrough on QoS from PCUNITE but I assume I missed something cause it had no effect, I’m probably missing the part where I mark the traffic.


I tried option 1 first, speeds were low, bufferbloat was too high, and I don’t really have room for the Arris in my lan closet.
Option 2 would be my next choice.
In my case I’ve had the arris unplugged for several days now and no issues.

[Moba]

I was wondering if the modem was polled to keep the connection alive once it receives a WAN ip - I would have tried it because some users alluded to this being possible, but like I said earlier, I don’t have an Arris…

Regardless, you have 5 options to get a WAN ip:

1. You connect the HAP behind the modem using the IP passthrough option in the modem (many step by step guides available from ATT users) which requires entering the router’s MAC into the modem. Some users report having speed issues, some don’t. It’s not clear to me why this doesn’t work for you as this is by far the easiest option. Without the IP passthrough, like you said, you have a router behind a router, which is a terrible idea, double NAT being the number one reason.
2. You lease a static IP block which will let you setup your devices as you wish by having more than one device connected to the WAN.
3. You bypass the modem using a script, as you are doing now. Maybe anav or another advanced user can explain it better than I can, but all the issues you are having are caused by an invalid configuration: the double bridge being problematic since the small HAP AC2 has only one switch chip which support 1 bridge with HW offloading (you may use multiple VLANs).
4. You use the supplicant method which requires you to root the modem to retrieve the security certificate and install it on the router.
5. You use pfSense before the modem to bypass it in a similar way as the script you’re using now.

The HAP AC2 is capable of routing at much higher speeds than what you are getting with reasonable firewall rules and queues, but testing should be done wired to the router, not over wifi.

So it’s not a QOS issue - your HAP is using a clever script that was designed for a router with 2 switch chips (please look at the diagrams for both routers and the Mikrotik Wiki). Once this is resolved, bufferbloat protection takes less than a minute to setup with a single SFQ queue (no mangle rules) and I can guide you for a more advanced config using fasttrack. IMO, trying to setup QOS before you can get close to wire speed with a basic config on the router is a big waste of time…

Well everything was actually solved except i haven’t figured out the QoS stuff yet, speeds are lower than expected since I was maxing the CPU out on the Edgerouter X with smart queue on and getting about 250 Mb and 5-10 ms bufferbloat.
Now I have 225 Mb and 100-500 ms bufferbloat.
I tried the walkthrough on QoS from PCUNITE but I assume I missed something cause it had no effect, I’m probably missing the part where I mark the traffic.


I tried option 1 first, speeds were low, bufferbloat was too high, and I don’t really have room for the Arris in my lan closet.
Option 2 would be my next choice.
In my case I’ve had the arris unplugged for several days now and no issues.

So you removed the Ariss and connected the HAP directly to the ONT with ether1 as I suggested?

In this case, reset the default configuration from the system menu or type “/system reset-configuration” from the terminal. This should enable fasttrack on the bridge. You can now connect a laptop to any remaining ether port and run a few speed tests while monitoring the CPU cores from System/Resources/CPU.

Run cmd in Windows and type:

ping 8.8.8.8 -t

What is the average speed, ping and cpu usage? What is the speed you are paying for?

This is an important baseline, because fasttrack bypasses most of the firewall stack and once it is disabled for QOS, cpu will increase by at least 30%, and thus affect overall bandwidth. Furthermore, any rules we set for QOS must limit your WAN connection even further to be effective.

Keep the cmd prompt running…

[Moba]

Once you have a baseline (best case scenario), we can experiment with queues. The first solution to bufferbloat is a simple queue. It’s a lazy hack, but it works with one major caveat: it’s resource intensive on a small HAP.

1. You must add a new queue type for SFQ in the terminal:
   
   
   

/queue type
add kind=sfq name=sfq-default sfq-perturb=10

2. You create a simple queue to control all traffic:
   
   
   

/queue simple
add max-limit=200M/200M name=sfq-default queue=sfq-default/sfq-default target=192.168.88.0/24

The max limit of the queue must be less than the max speed with fasttrack.

3. You disable the default fasttrack rule from the firewall - don’t delete it, it’s useful for testing.

This should solve any bufferbloat issues quickly since it sets a hard limit for all your WAN bandwidth and it dynamically divides it equally among each client connected to the router as required (fair queuing).

Speed test again…

[Moba]

Using Fasttrack for gaming traffic

COD is used here, but any other port specific traffic can be marked.

1. The connections need to be marked:
   
   
   

/ip firewall mangle
add action=mark-connection chain=forward comment=fasttrack-udp-dw-con dst-port=“” new-connection-mark=fasttrack-udp-dw-con passthrough=no port=3074-3078,27000-27059 protocol=udp

2. A rule is created in the firewall for each connection:
   
   
   

/ip firewall filter
add action=fasttrack-connection chain=forward comment=“Fasttrack udp dw games” connection-mark=fasttrack-udp-dw-con

These rules will let COD traffic bypass the QOS queue and prioritize this traffic over everything else, thus minimizing latency.

Make sure you move those rules up to were the default Fasttrack rules are with Winbox.

[JeffLo]

can i add which wan to use with this? i would like to use wan2 instead of wan1,

Using Fasttrack for gaming traffic

COD is used here, but any other port specific traffic can be marked.

1. The connections need to be marked:
   
   
   

/ip firewall mangle
add action=mark-connection chain=forward comment=fasttrack-udp-dw-con dst-port=“” new-connection-mark=fasttrack-udp-dw-con passthrough=no port=3074-3078,27000-27059 protocol=udp
add action=mark-connection chain=prerouting comment=fasttrack-udp-up-con dst-port=“” new-connection-mark=fasttrack-udp-up-con passthrough=no port=3074-3078,27000-27059 protocol=udp

2. A rule is created in the firewall for each connection:
   
   
   

/ip firewall filter
add action=fasttrack-connection chain=forward comment=“Fasttrack udp dw games” connection-mark=fasttrack-udp-dw-con
add action=fasttrack-connection chain=input comment=“Fasttrack udp up games” connection-mark=fasttrack-udp-up-con

These rules will let COD traffic bypass the QOS queue and prioritize this traffic over everything else, thus minimizing latency.

Make sure you move those rules up to were the default Fasttrack rules are with Winbox. Additionally, you may wish to fasttrack DNS queries by adding them to the prerouting chain.

[Moba]

You can change the in. interface in /ip firewall mangle or /ip firewall filter (clearly accessible in Winbox). You can also fasttrack the ports directly without marking the connections first - 1 step instead of 2, so it should save a little CPU - a dev would need to confirm if this is the case or not.