axotik
June 30, 2026, 6:44pm
1
Hello guys.
I am troubleshooting a CRS109-8G-1S-2HnD with RouterOS 7.23.1.
The router is connected in a building that provides internet to all the offices. They just did an overhaul of all the equipment and systems. Today a technician came to the office because the automatic DHCP function in the router was not picking up the mask and gateway, so he set things up manually in the router and now it is connected.
The problem is, he showed me the line from the building is providing about 900mbps when he connected the wire straight to his laptop, but the same wire connected to the WAN port on the mikrotik, I get about 150mbps on the connected clients with ethernet on the gigabit network.
I would like to get help on this, maybe there is something wrong with the current firewall settings or something else that may be slowing down the internet connection.
Hi!
Please run: /export file=myconfig
to export your config
On other hands, your device is not really able to handle full gigabit speed. According the Mikrotik speed test:
Routing
25 ip filter rules
56.8
689.8
in the real life it handles about 700 mbps, but it can be lower with more firewall rules and/or other tasks which consumes cpu power.
infabo
June 30, 2026, 7:02pm
3
244.1mbps is the number for 512bytes, which is the more realistic number.
Sure, here is a guide:
Hello and welcome to the Mikrotik forum
axotik
June 30, 2026, 7:14pm
4
Thanks a lot.. here is the config:
2026-06-30 14:59:10 by RouterOS 7.23.1
software id = W0PA-KWSM
model = CRS109-8G-1S-2HnD
serial number = xxxxxxxxx
/interface bridge
add arp=proxy-arp name=bridge1 port-cost-mode=short
/interface wireless
set [ find default-name=wlan1 ] band=2ghz-b/g/n disabled=no mode=ap-bridge
ssid=office wireless-protocol=802.11
/interface list
add name=WAN
add name=LAN
/interface lte apn
set [ find default=yes ] ip-type=ipv4 use-network-apn=no
/interface wireless security-profiles
set [ find default=yes ] authentication-types=wpa2-psk eap-methods="" mode=
dynamic-keys supplicant-identity=MikroTik
/ip ipsec profile
set [ find default=yes ] dh-group=modp1024 dpd-interval=2m
dpd-maximum-failures=5 enc-algorithm=aes-256,3des
add dpd-interval=2m dpd-maximum-failures=5 enc-algorithm=aes-256 name=
profile1
/ip ipsec peer
This entry is unreachable
add name=peer1 passive=yes profile=profile1
/ip ipsec proposal
set [ find default=yes ] auth-algorithms=sha512,sha256,sha1 enc-algorithms="ae
s-256-cbc,aes-256-ctr,aes-256-gcm,aes-192-ctr,aes-192-gcm,aes-128-cbc,aes-
128-ctr,aes-128-gcm" lifetime=0s pfs-group=none
/ip pool
add name=dhcp ranges=10.0.0.100-10.0.0.244
add name=l2tppool1 ranges=10.0.0.245-10.0.0.254
/ip dhcp-server
add address-pool=dhcp interface=bridge1 lease-time=10m name=dhcp1
/ip smb users
set [ find default=yes ] disabled=yes
/ppp profile
add change-tcp-mss=yes dns-server=8.8.8.8 local-address=10.0.0.1 name=
vpn-prof remote-address=l2tppool1 use-upnp=no
set *FFFFFFFE change-tcp-mss=default dns-server=8.8.8.8 local-address=
10.0.0.1 remote-address=l2tppool1
/routing bgp template
set default as=65530 disabled=no name=default output.network=bgp-networks
/routing ospf instance
add disabled=no name=default-v2
/routing ospf area
add disabled=yes instance=default-v2 name=backbone-v2
/interface bridge port
add bridge=bridge1 ingress-filtering=no interface=ether2 internal-path-cost=
10 path-cost=10
add bridge=bridge1 ingress-filtering=no interface=ether3 internal-path-cost=
10 path-cost=10
add bridge=bridge1 ingress-filtering=no interface=ether4 internal-path-cost=
10 path-cost=10
add bridge=bridge1 ingress-filtering=no interface=ether5 internal-path-cost=
10 path-cost=10
add bridge=bridge1 ingress-filtering=no interface=ether6 internal-path-cost=
10 path-cost=10
add bridge=bridge1 ingress-filtering=no interface=ether7 internal-path-cost=
10 path-cost=10
add bridge=bridge1 ingress-filtering=no interface=ether8 internal-path-cost=
10 path-cost=10
add bridge=bridge1 ingress-filtering=no interface=sfp1 internal-path-cost=10
path-cost=10
add bridge=bridge1 ingress-filtering=no interface=wlan1 internal-path-cost=10
path-cost=10
add bridge=bridge1 fast-leave=yes ingress-filtering=no interface=*D
internal-path-cost=10 path-cost=10
/ip firewall connection tracking
set udp-timeout=10s
/ip settings
set max-neighbor-entries=8192
/ipv6 settings
set disable-ipv6=yes max-neighbor-entries=8192
/interface l2tp-server server
set authentication=chap,mschap1,mschap2 default-profile=vpn-prof enabled=yes
use-ipsec=yes
/interface list member
add interface=ether1 list=WAN
add interface=bridge1 list=LAN
/interface ovpn-server server
add auth=sha1 certificate=server cipher=aes256-cbc mac-address=
FE:28:07:5B:EE:50 name=ovpn-server1 require-client-certificate=yes
/interface sstp-server server
set authentication=mschap2 certificate=SERVER pfs=yes port=4430
/ip address
add address=10.0.0.1/8 interface=bridge1 network=10.0.0.0
add address=64.xx.xx.xx/27 interface=ether1 network=64.xx.xx.xx
/ip cloud
set ddns-enabled=yes ddns-update-interval=10h10m
/ip dhcp-client
add disabled=yes interface=ether1 name=client1
/ip dhcp-server lease
add address=10.0.0.15 client-id=1:fc:aa:14:58:e8:4b comment=
"red-devil server" mac-address=FC:AA:14:58:E8:4B server=dhcp1
add address=10.0.0.30 comment="DAN PC" mac-address=D8:5E:D3:86:FA:CF server=
dhcp1
/ip dhcp-server network
add address=10.0.0.0/8 gateway=10.0.0.1 netmask=8
/ip dns
set servers=1.1.1.1
/ip firewall address-list
add address=10.0.0.0/8 list=LAN
add address=xxxxxxx.sn.mynetname.net list=WAN
/ip firewall filter
add action=accept chain=input comment=
"defconf: accept established,related,untracked" connection-state=
established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=
invalid
add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp
add action=accept chain=input dst-port=8291 in-interface-list=WAN protocol=
tcp
add action=accept chain=input comment="SSTP server mary 4430" disabled=yes
dst-port=4430 in-interface-list=WAN protocol=tcp
add action=accept chain=input dst-port=1701,500,4500 in-interface-list=WAN
protocol=udp
add action=accept chain=input in-interface-list=WAN protocol=ipsec-esp
add action=accept chain=input comment=
"defconf: accept to local loopback (for CAPsMAN)" dst-address=127.0.0.1
add action=accept chain=input comment="RDP red devil" dst-address=10.0.0.15
dst-port=4000 protocol=tcp src-port=4000
add action=accept chain=input comment="Wireguard red devil" disabled=yes
dst-address=10.0.0.15 dst-port=51001 protocol=udp src-port=51001
add action=drop chain=input comment="defconf: drop all not coming from LAN"
in-interface-list=!LAN
add action=accept chain=forward comment="defconf: accept in ipsec policy"
ipsec-policy=in,ipsec
add action=accept chain=forward comment="defconf: accept out ipsec policy"
ipsec-policy=out,ipsec
add action=fasttrack-connection chain=forward comment="defconf: fasttrack"
connection-state=established,related disabled=yes
add action=accept chain=forward comment=
"defconf: accept established,related, untracked" connection-state=
established,related,untracked
add action=drop chain=forward comment=
"defconf: drop all from WAN not DSTNATed" connection-nat-state=!dstnat
connection-state=new in-interface-list=WAN
add action=drop chain=forward disabled=yes in-interface-list=WAN
src-address-list=CountryIPBlocks
add action=accept chain=input disabled=yes dst-port=443 in-interface-list=WAN
protocol=tcp
/ip firewall mangle
add action=mark-connection chain=prerouting dst-address-list=WAN
new-connection-mark=Hairpin_NAT src-address-list=LAN
/ip firewall nat
add action=masquerade chain=srcnat comment="Hairpin NAT" connection-mark=
Hairpin_NAT
add action=masquerade chain=srcnat comment="defconf: masquerade"
ipsec-policy=out,none out-interface-list=WAN
add action=dst-nat chain=dstnat comment="SSH Red devil" dst-address-list=WAN
dst-port=4022 protocol=tcp src-address-list="" to-addresses=10.0.0.15
to-ports=4022
add action=dst-nat chain=dstnat comment="Wireguard Red devil"
dst-address-list=WAN dst-port=51001 protocol=udp src-address-list=""
to-addresses=10.0.0.15 to-ports=51001
add action=dst-nat chain=dstnat comment="Outline Access Key UDP"
dst-address-list=WAN dst-port=45355 protocol=udp src-address-list=""
to-addresses=10.0.0.15 to-ports=45355
add action=dst-nat chain=dstnat comment="Outline Access Key TCP"
dst-address-list=WAN dst-port=45355 protocol=tcp src-address-list=""
to-addresses=10.0.0.15 to-ports=45355
add action=dst-nat chain=dstnat comment="NoMachine Red devil"
dst-address-list=WAN dst-port=4100 protocol=tcp src-address-list=""
to-addresses=10.0.0.15 to-ports=4100
add action=dst-nat chain=dstnat comment="Outline management"
dst-address-list=WAN dst-port=31347 protocol=tcp src-address-list=""
to-addresses=10.0.0.15 to-ports=31347
add action=dst-nat chain=dstnat comment="NoMachine Red devil UDP"
dst-address-list=WAN dst-port=4100 protocol=udp src-address-list=""
to-addresses=10.0.0.15 to-ports=4100
add action=dst-nat chain=dstnat disabled=yes dst-address-list=WAN dst-port=80
protocol=tcp to-addresses=10.0.0.15 to-ports=80
add action=dst-nat chain=dstnat comment="ShadowSocks Red-Devil"
dst-address-list=WAN dst-port=443 protocol=tcp to-addresses=10.0.0.15
to-ports=443
add action=dst-nat chain=dstnat disabled=yes dst-address-list=WAN dst-port=
3478 protocol=tcp to-addresses=10.0.0.15 to-ports=3478
add action=dst-nat chain=dstnat disabled=yes dst-address-list=WAN dst-port=
8443 protocol=tcp to-addresses=10.0.0.15 to-ports=8443
add action=dst-nat chain=dstnat comment="RDP Red devil" disabled=yes
dst-port=4000 protocol=tcp src-address-list=WAN to-addresses=10.0.0.15
to-ports=4000
add action=dst-nat chain=dstnat disabled=yes dst-address-list=WAN dst-port=
3478 protocol=udp to-addresses=10.0.0.15 to-ports=3478
add action=dst-nat chain=dstnat comment=WEB disabled=yes dst-port=80
in-interface-list=WAN protocol=tcp to-addresses=10.0.0.10 to-ports=80
/ip route
add disabled=no dst-address=0.0.0.0/0 gateway=64.xx.xx.xx
/ip service
set ftp disabled=yes
set ssh disabled=yes
set telnet disabled=yes
/ppp secret
add local-address=10.0.0.1 name=ncvpn profile=vpn-prof remote-address=
10.0.0.252 service=l2tp
add name=axtest profile=vpn-prof service=l2tp
add local-address=10.0.0.1 name=nctunelaxo remote-address=10.0.0.2 routes=
"192.168.88.0/24 10.0.0.2 1" service=sstp
add local-address=10.0.0.1 name=nctunelmary remote-address=10.0.0.3 routes=
"192.168.90.0/24 10.0.0.3 1" service=sstp
add name=mario profile=vpn-prof service=l2tp
add name=ipad-mary profile=vpn-prof service=l2tp
add name=ipad-mario profile=vpn-prof service=l2tp
add name=ipad-dan profile=vpn-prof service=l2tp
add name=macbook-mario profile=vpn-prof service=l2tp
/routing bfd configuration
add disabled=no interfaces=all min-rx=200ms min-tx=200ms multiplier=5
/system clock
set time-zone-name=America/New_York
/system identity
set name=office
/system ntp client
set enabled=yes
/system ntp client servers
add address=129.6.15.28
add address=129.6.15.29
The other commenters have given you the appropriate clues: most of the CRS series devices, including yours, is primarily a switch. It has router functions and it can be used as one, but the performance won't be good. This is what you're seeing.
No doubt some optimization is possible, but it will never perform as it should. Either use it as it is (if it's adequate), use it as a switch or buy a device that's meant to be used as a router. You can start looking from the hEX Refresh or hAP ax S.
axotik
June 30, 2026, 9:02pm
6
Ok I see...
Excuse my ignorance... I definitely had no clue this device was not meant to be a router, I believe it has been in the office over 6 years or more and never paid attention to the label "cloud router switch"
So no problem, we can get a new Mikrotik.C53UiG+5HPaxD2HPaxD ) around $150 bucksC52iG-5HaxD2HaxD-TC-US ) going for $92
The office has 3 workstations, a small NAS and a server doing backups daily and hosting a VPN server, then the router allows ipads and a few other remote computers to access the local NAS with the L2TP VPN.
Looking at the test results on the linked Mikrotik pages, I can see the difference VS the current device we have. So any of these should be fine for the gigabit internet connection right? Before making another mistake, which one of those 2 options should I get? Or should I look for something else?
Thanks again for the tips.
Yep. Both the ax2 and ax3 are very happy at gigabit speeds. Actually they are the same platform, with the ax3 being the souped up version: added sfp, a 2.5G port, external antennas (but the same chip) and an increased clock with the accompanying larger heatsink.
Funnily enough, routing performance is only increased by roughly 35%.
Again, both are good devices. I'm personally partial to the ax2, but both of them will do the job.
An alternative, if you are happy with what you have as just an AP, you could get a separate router (although a full update seems like a pretty good idea as well).
anav
June 30, 2026, 11:50pm
9
I would look at your requirements for the next 5 years to consider when making a purchase. Will you have multiple WANs, will you have higher ISP throughputs etc.........