I just switch provider. My provider delivers an pre-configured and very limited mediaconverter/router/access point. It is an Genexis Platinum 7840. They give no support using own hardware. At the moment i have it working, but i’am not happy with the current solution. I have connected my RB2011iL to the Genexis as an exposed host/DMZ. But now i have to NAT two times and i do like this solution in general.
I have bought an mediaconverter KTI Networks Model: KGC-300 with an SC SFP BiD.
When i connect the RB2011iL to the mediaconverter i get an IP address on ether1. This is een 10.45.0.0 /16 address and not the public IP address i expect. I have used the torch function and discoverd that i have two VLAN’s 100 and 101. I’m almost certain that VLAN 100 is internet and 101 IPTV.
I added an VLAN interface, WAN-INTERNET-100 with VLAN 100 to ether1 and made an extra DHCP client on this interface. I get an public IP address in the correct network.
Interfaces ether2 to ether8 are added to the bridge: BRIDGE-LOCAL, my LAN, and ether1 and WAN-INTERNET-100 are added to the interface-list: WAN
The problem at the moment is that i’m not able to get from my LAN to internet. I was not able to test of incoming connections worked, because i have some NAT and firewall rules active to internal devices.
Can somebody help me? Do i have to add an extra route or do i have to make changes to my firewall rules or NAT MASQUERADE rule?
Only problem i have now is that my TV starts stuttering when downloading at full speed (speedtest.net for example).
ether6 says it uses Hardware offloading. But i'm not able to enable it on the VLAN interface WAN-IPTV-101. When downloading the CPU goes to 90 to 99% usage.
There are quite a few things that prevent you from having HW offload properly:
Only single bridge per switch port group can have HW offload. Your RM2011iL has two switch chips, one spanning ether1-ether5 and the other spanning ether6-ether10.
VLANs, handled by bridges, can’t be HW offloaded
high CPU load while you’re downloading is not due to lack of HW offload for VLAN 101, but due to lack of HW offload overall
high CPU load might be due to setting /interface bridge settings set use-ip-firewall=yes … are you really sure you want to force all LAN traffic and IPTV through IP firewall?
I guess LAN traffic can be trusted while you might not want to care about IPTV (it’s just the set-top box that might get hit by hackers which would hack IPTV provider’s network beforehand). Internet traffic if being firewalled without this setting as that’s L3 traffic which doesn’t pass just through bridge, it’s shuffled across IP interfaces.
In addition to that, you should be aware that ether6-ether10 are only 100Mbps. If your internet link is up to 100Mbps, you might want to connect it to one of ether6-ether10 ports and free ether1 for LAN connection with high-speed switching.
In any case, RB2011 is not a beast when it comes to routing speed, I doubt it could handle much more than 200Mbps with all those firewall filter rules.
For this post to be complete: there’s nothing wrong with the way you’re dealing with IPTV VLAN. However, since RouterOS version 6.42 the idea is to have single bridge per device and configure VLAN stuff on bridge. However, on most devices (but CRS3xx and CCR?) HW offload is lost when VLANs are configured on bridge. This particular case I’d advise to stick to 2-bridge scenario.
I suggest you to make the following changes to your setup:
move WAN connection to ether10. Move specific config (i.e. vlan interfaces) with it.
don’t set hw=no to ports members of bridge-local (in /interface bridge port.
don’t set /interface bridge settings set use-ip-firewall=yes
router’s IP config should go to bridge, not to ether2 (that’s in /ip address
use interface-list in firewall filter rules (instead of interface). And firewall nat rules as well. E.g. use in-interface-list=WAN instead of in-interface=ether1. Makes firewall filter rules more readable and easier to make topology changes (i.e. change WAN interface from ether1 to ether10 … firewall filter rules would stay unchanged, only change in /interface list member would be necessary).
reconsider firewall filter rules allowing all UDP traffic in any direction (comment=IGMP protocol=udp) as they might be a tad too liberal. Try to make it more specific by adding some more checks (e.g. in-interface=ether6 or ports=xxxx-yyyy).
the second-to-last and third-to-last filter rules are exactly the same … either one can be removed (according to suggestion #5 above I’d remove third-to-last rule).
why do you have second src-nat rule? If it’s to allow SSTP connected clients to access internet, then already the first rule (more general one) does the trick. If it’s to masquerade SSTP clients when accessing normal LAN, then … well, I wouldn’t do it, this should be already possible without it. In any case, reconsider this rule to assess security implications.
Thanks mkx. You’re advise is great and very welcome. Maybe i should replace my router with an new one, one with an SFP, thus eliminating the need for a mediavonverter. Could the: RB960PGS do the job? This because you’re stated that the device could possible have problems with routing at speeds higher than 200mbps.
I have resetted the router and started from scratch.
I have a 300 Mbit/s internet connection therefor i prefer to use ether1 as my WAN interface. I have tried to implement as much as possible of your advise. It feels ast it works a little bit better. By i have still have some stuttering when downloading at full speed or performing speedtest.net tests. On the IPTV bridge and the assigned interface ether6 HW offloading is not active. On the interface in the default bridge HW offloading is active.
Any good reason for having both ether1 (untagged) and WAN-INTERNET-100 (tagged VID=100) active as WAN interfaces? Both have DHCP-client attached … check which one is actually active (/ip address print) and remove config of the other one (remove dhcp-client bound to unused interface ad remove unused interface from WAN interface list).
Not that the cange would mean much with regard to your problem (IPTV not performing optimally).
Other than that I don’t see anything wrong with your current config. The only solution while keeping RB2011 as router would be to reconfigure whole VLAN stuff (to use switch chip functionality), which would probably help with IPTV but would probably still not unleash full internet speed …
As I already said, RB2011 is not a beast, neither is RB960PGS. Both feature old single-core CPUs. I guess the best solution (practically replacement for your RB2011) would be RB4011 … it has lots of CPU power (capable of gigabit routing), it features SFP+ port and (wireless model) also dual-band wifi. The price is still reasonable (though quite much higher than RB960PGS).
Thanks again. I have also implemented this tips, for now it works fine. I have ordered an RB4011 as an replacement for my current RB2011.
I was just thinking there are two most known solutions for IPTV with the router i have. The bridged solution i used now and the routed. Wich one should be better and has the least impact on the router?
Most of the times routed is better, this because the tv receiver can also use other internet related services like Netflix or YouTube.
At least that is the case with KPN in Holland.
It really depends on implementation of how IPTV streams get delivered to set-top boxes. For example, my ISP delivers IPTV multicast streams in separate VLAN and their set-top boxes expect to receive IPTV through VLAN as well. Which allows to have IPTV switched and still have internet part (for those set-top boxes that feature internet functions) routed through all the security engine. As my ISP also manages set-top boxes via TR-069 through the same VLAN interface, it would be quite a challenge to set things up in routed IPTV solution not to break things in this aspect.
You might want to verify setup with your ISP (or some user forum dedicated to your ISP) whether set-top boxes are actually supposed to use VLANs as well but just survive without them as it is now in your case. You could deduct that from the set-up recommended by your ISP as well.
Internet is delivered over VLAN 100 and IPTV over 101. The STP expects the streams untagd. The VLAN is untagged on the LAN side. On the original router from my ISP the STP is on the same network as my regular devices.
I think it possible to use the igmp-proxy (multicast package), but i dot know if this would be a better solution than de bridge i use now. I have found some articles from users who uses the routed mode with my provider. But mosty with ubiquiti routers and no Mikrotik.
I cannot find and clear answer what has the least impact on the router (CPU utilisation). Maybe i should just test it
