I was able to obtain IP address from my ISP, but the internet is extremely slow, does not matter if wired or wireless.
Ping that took 4ms on old router now takes about 1000ms. I have default settings and did not change anything as I do not understand pretty much anything in the settings. Cannot run bandwidth test because I dont have idea what ip to use to test.
If I ping router from computer it is below 1ms, if I ping from router some internet IP it is ~4ms as with old router, but if I ping from my computer it is ~1000ms.
But as visible on the screenshots, the ping sometimes drop even on my computer to proper values. To me it seems like if some bandwidth limit was set somewhere and my computer is using that limit most of the time with some requests.
My ISP is connected to ether1 and my computer is connected to ether2. Nothing else is connected to the router.
Would appreciate any advice or I will have to return the router back because I simple don’t have idea what is wrong.
router type: L009UiGS
Can you post your config here? There is a post by Gigabyte that explains how to do it.
Do you mean this ?
\[admin@MikroTik\] > /export hide-sensitive
> # 2026-01-02 18:06:12 by RouterOS 7.20.6
> # software id = NZ7Y-KSU3
> # model = L009UiGS-2HaxD
> # serial number = removed
> /interface bridge
> add admin-mac=04:F4:1C:0C:58:49 auto-mac=no comment=defconf max-learned-entries=unlimited name=bridge
> /interface ethernet
> set \[ find default-name=ether1 \] advertise=10M-baseT-half,10M-baseT-full,100M-baseT-half,100M-baseT-full,1G-baseT-full loop-protect=on mac-address=60:A4:B7:48:A3:28
> /interface wifi
> set \[ find default-name=wifi1 \] channel.skip-dfs-channels=10min-cac configuration.mode=ap .ssid=MikroTik-0C5851 disabled=no security.authentication-types=wpa2-psk,wpa3-psk .ft=yes .ft-over-ds=yes
> /interface list
> add comment=defconf name=WAN
> add comment=defconf name=LAN
> /ip pool
> add name=default-dhcp ranges=192.168.88.10-192.168.88.254
> /ip dhcp-server
> add address-pool=default-dhcp interface=bridge name=defconf
> /port
> set 0 name=serial0
> /disk settings
> set auto-media-interface=bridge auto-media-sharing=yes auto-smb-sharing=yes
> /interface bridge port
> add bridge=bridge comment=defconf interface=ether2
> add bridge=bridge comment=defconf interface=ether3
> add bridge=bridge comment=defconf interface=ether4
> add bridge=bridge comment=defconf interface=ether5
> add bridge=bridge comment=defconf interface=ether6
> add bridge=bridge comment=defconf interface=ether7
> add bridge=bridge comment=defconf interface=ether8
> add bridge=bridge comment=defconf interface=sfp1
> add bridge=bridge comment=defconf interface=wifi1
> /ip neighbor discovery-settings
> set discover-interface-list=LAN
> /interface list member
> add comment=defconf interface=bridge list=LAN
> add comment=defconf interface=ether1 list=WAN
> /ip address
> add address=192.168.88.1/24 comment=defconf interface=bridge network=192.168.88.0
> /ip dhcp-client
> add comment=defconf interface=ether1
> /ip dhcp-server network
> add address=192.168.88.0/24 comment=defconf dns-server=192.168.88.1 gateway=192.168.88.1
> /ip dns
> set allow-remote-requests=yes
> /ip dns static
> add address=192.168.88.1 comment=defconf name=router.lan type=A
> /ip firewall filter
> add action=accept chain=input comment="defconf: accept established,related,untracked" connection-state=established,related,untracked
> add action=drop chain=input comment="defconf: drop invalid" connection-state=invalid
> add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp
> add action=accept chain=input comment="defconf: accept to local loopback (for CAPsMAN)" dst-address=127.0.0.1
> add action=drop chain=input comment="defconf: drop all not coming from LAN" in-interface-list=!LAN
> add action=accept chain=forward comment="defconf: accept in ipsec policy" ipsec-policy=in,ipsec
> add action=accept chain=forward comment="defconf: accept out ipsec policy" ipsec-policy=out,ipsec
> add action=fasttrack-connection chain=forward comment="defconf: fasttrack" connection-state=established,related hw-offload=yes
> add action=accept chain=forward comment="defconf: accept established,related, untracked" connection-state=established,related,untracked
> add action=drop chain=forward comment="defconf: drop invalid" connection-state=invalid
> add action=drop chain=forward comment="defconf: drop all from WAN not DSTNATed" connection-nat-state=!dstnat connection-state=new in-interface-list=WAN
> /ip firewall nat
> add action=masquerade chain=srcnat comment="defconf: masquerade" ipsec-policy=out,none out-interface-list=WAN
> /ipv6 firewall address-list
> add address=::/128 comment="defconf: unspecified address" list=bad_ipv6
> add address=::1/128 comment="defconf: lo" list=bad_ipv6
> add address=fec0::/10 comment="defconf: site-local" list=bad_ipv6
> add address=::ffff:0.0.0.0/96 comment="defconf: ipv4-mapped" list=bad_ipv6
> add address=::/96 comment="defconf: ipv4 compat" list=bad_ipv6
> add address=100::/64 comment="defconf: discard only " list=bad_ipv6
> add address=2001:db8::/32 comment="defconf: documentation" list=bad_ipv6
> add address=2001:10::/28 comment="defconf: ORCHID" list=bad_ipv6
> add address=3ffe::/16 comment="defconf: 6bone" list=bad_ipv6
> /ipv6 firewall filter
> add action=accept chain=input comment="defconf: accept established,related,untracked" connection-state=established,related,untracked
> add action=drop chain=input comment="defconf: drop invalid" connection-state=invalid
> add action=accept chain=input comment="defconf: accept ICMPv6" protocol=icmpv6
> add action=accept chain=input comment="defconf: accept UDP traceroute" dst-port=33434-33534 protocol=udp
> add action=accept chain=input comment="defconf: accept DHCPv6-Client prefix delegation." dst-port=546 protocol=udp src-address=fe80::/10
> add action=accept chain=input comment="defconf: accept IKE" dst-port=500,4500 protocol=udp
> add action=accept chain=input comment="defconf: accept ipsec AH" protocol=ipsec-ah
> add action=accept chain=input comment="defconf: accept ipsec ESP" protocol=ipsec-esp
> add action=accept chain=input comment="defconf: accept all that matches ipsec policy" ipsec-policy=in,ipsec
> add action=drop chain=input comment="defconf: drop everything else not coming from LAN" in-interface-list=!LAN
> add action=fasttrack-connection chain=forward comment="defconf: fasttrack6" connection-state=established,related
> add action=accept chain=forward comment="defconf: accept established,related,untracked" connection-state=established,related,untracked
> add action=drop chain=forward comment="defconf: drop invalid" connection-state=invalid
> add action=drop chain=forward comment="defconf: drop packets with bad src ipv6" src-address-list=bad_ipv6
> add action=drop chain=forward comment="defconf: drop packets with bad dst ipv6" dst-address-list=bad_ipv6
> add action=drop chain=forward comment="defconf: rfc4890 drop hop-limit=1" hop-limit=equal:1 protocol=icmpv6
> add action=accept chain=forward comment="defconf: accept ICMPv6" protocol=icmpv6
> add action=accept chain=forward comment="defconf: accept HIP" protocol=139
> add action=accept chain=forward comment="defconf: accept IKE" dst-port=500,4500 protocol=udp
> add action=accept chain=forward comment="defconf: accept ipsec AH" protocol=ipsec-ah
> add action=accept chain=forward comment="defconf: accept ipsec ESP" protocol=ipsec-esp
> add action=accept chain=forward comment="defconf: accept all that matches ipsec policy" ipsec-policy=in,ipsec
> add action=drop chain=forward comment="defconf: drop everything else not coming from LAN" in-interface-list=!LAN
> /system clock
> set time-zone-name=Europe/Prague
> /system routerboard settings
> set enter-setup-on=delete-key
> /tool mac-server
> set allowed-interface-list=LAN
> /tool mac-server mac-winbox
> set allowed-interface-list=LAN
Use < / > button, not " one
It seems that
/ip firewall filter
disable [find action=fasttrack-connection]
significantly improved the overall speed, I dont know how, everywhere I go they write if it is low, turn on fasttrack, but in my case it is completely opposite.
Weird. Something i noticed: that rule has hw-offload=yes. I didn't see any other with the same setting but i'm on a phone.
Can you re-enable that rule and disable the hw-offloading to see if that is still slow?
That hw-offload makes little sense, the switch chip in the L009 is not L3 capable.
I found some info about fasttrack bugged together with my ROS version and firmware. Then I found out the update from webfig only updates ROS so I went to system > routerBOARD and updated firmware as well. Then I reenabled the fasttrack rule and so far it seems to be working.
1 Like
Well it is default settings done by Mikrotik. I disabled it and there is no difference. After the firmware update the fast track works but the speed is still significantly slower than before. I have only 45 mbs download from my ISP, I reach that speed with old router stable, now with mikrotik I have 18 mbs.
infabo
January 3, 2026, 12:42pm
10
hw-offload=yes is the default.
Yup, I went and checked in my Audience, which has the setting even though it definitely does NOT have L3 HW offloading. So the setting likely does nothing when the chipset doesn't support it.
The configuration is, as @somename1546 wrote, very much default so it should be capable of a a lot more than what has been reported.
@somename1546 , if you look in the logs, do you have any error message? Can you issue the following commands at the CLI and post the result here?
/interface/ethernet/print stats-detail where name=ether1
/interface/ethernet/monitor ether1 once
Today suddenly my download speed went to 40 Mbps as with the old router, the only thing I did I tried to reorder the ip > firewall rules kind of randomly but it did not have effect yesterday, today morning out of nowhere the speed is 40 Mbps as it should be.
But my upload speed is 2 Mbps while it should be 8 Mbps. I really dont understand what is happening. It feels like the router is making fun of me.
[admin@MikroTik] > /interface/ethernet/print stats-detail where name=ether1
Flags: X - disabled, R - running; S - slave
0 R name="ether1" driver-rx-byte=345 641 555 driver-rx-packet=300 735 driver-tx-byte=36 553 823 driver-tx-packet=181 782 rx-bytes=346 844 495 rx-packet=300 735 rx-too-short=0 rx-64=30 187 rx-65-127=27 169 rx-128-255=7 101 rx-256-511=4 920 rx-512-1023=5 283 rx-1024-1518=226 075 rx-too-long=0 rx-pause=0 rx-fcs-error=1 rx-align-error=0 rx-overflow=0
rx-control=0 rx-length-error=0 rx-carrier-error=0 rx-jabber=0 tx-bytes=37 797 658 tx-packet=181 782 tx-64=113 422 tx-65-127=38 379 tx-128-255=7 106 tx-256-511=3 351 tx-512-1023=3 754 tx-1024-1518=15 770 tx-too-long=0 tx-broadcast=794 tx-pause=0 tx-multicast=4 tx-underrun=0 tx-excessive-collision=0 tx-multiple-collision=0 tx-single-collision=0
tx-excessive-deferred=0 tx-deferred=0 tx-late-collision=0 tx-carrier-sense-error=0
[admin@MikroTik] > /interface/ethernet/monitor ether1 once
name: ether1
status: link-ok
auto-negotiation: done
rate: 1Gbps
full-duplex: yes
tx-flow-control: no
rx-flow-control: no
supported: 10M-baseT-half
10M-baseT-full
100M-baseT-half
100M-baseT-full
1G-baseT-half
1G-baseT-full
advertising: 100M-baseT-half
100M-baseT-full
1G-baseT-full
link-partner-advertising: 10M-baseT-half
10M-baseT-full
100M-baseT-half
100M-baseT-full
1G-baseT-full
infabo
January 4, 2026, 7:47am
13
I recommend
/system/reset-configuration
@somename1546 , can you do what @infabo suggests and reset it to default?
What was the make and brand of the old router? Something I noted: you have removed the advertising of the 10M-baseT-* and 1G-BaseT-half. If after the system reset it is slow again, can you remove the 1G-BaseT-*?
/interface/ethernet/set [find default-name=ether1] advertise=10M-baseT-full,10M-baseT-half,100M-baseT-full,100M-baseT-half
