I’m wondering if this is to be expected or not. The RB450G is connected to my Gigabit ISP, in a static IP mode, not PPPoE. When I run a Bandwidth Test on the Mikrotik router itself using the Public Btest server, UI gets an aggregate speed of ~800Mbps. However, the speed on the switch port is ~300Mbps. I disabled bridge and configured just an ethernet port as the LAN port and then connected my laptop to it using a Cat 6a cable and it maxes out at ~300Mbps.
My firewall rules are the simple 1 NAT and 1 Mangle rule, nothing fancy. Is this basically a limitation of the R450G? I did notice that the CPU goes up to about 65-70% when I do this test.
Config:
# oct/30/2021 18:39:44 by RouterOS 6.49
# software id = VB38-KITB
#
# model = 450G
# serial number = 72520798A472
/interface bridge
add disabled=yes fast-forward=no name=bridge1-lan
/interface ethernet
set [ find default-name=ether3 ] mtu=1492 name=LAN-To-Orbi-eth3
set [ find default-name=ether1 ] disabled=yes mac-address=B0:B9:8A:73:8E:59 mtu=1450 name=WAN-1 speed=100Mbps
set [ find default-name=ether5 ] advertise=10M-half,10M-full,100M-half,100M-full disabled=yes name=WAN-2 speed=100Mbps
set [ find default-name=ether4 ] name=eth4 speed=100Mbps
set [ find default-name=ether2 ] name=wan-airtel-eth2 speed=100Mbps
/interface pppoe-client
add interface=wan-airtel-eth2 keepalive-timeout=disabled name=pppoe-airtel user=020103006378_mh@airtelbroadband.in
add interface=WAN-1 keepalive-timeout=disabled name=pppoe-out1-bsnl user=ra2029707177_wid@ftth.bsnl.in
add interface=WAN-2 keepalive-timeout=disabled name=pppoe-out2-Airlink use-peer-dns=yes user=abil1804
/interface 6to4
add comment="Hurricane Electric IPv6 Tunnel Broker" disabled=yes !keepalive local-address=117.247.92.118 mtu=1280 name=sit1 remote-address=216.218.221.42
/interface list
add name=WAN
add name=LAN
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
/ip pool
add name=pool1-LAN ranges=192.168.88.10-192.168.88.250
/ip dhcp-server
add address-pool=pool1-LAN disabled=no interface=eth4 lease-time=8h name=server1
/queue simple
add disabled=yes max-limit=4M/4M name=Apple-TV target=192.168.88.208/32
add disabled=yes limit-at=2M/2M max-limit=2M/2M name=amit-throttle target=192.168.88.14/32
/snmp community
set [ find default=yes ] read-access=no
add addresses=192.168.88.0/24 name=geekn0c
/user group
set full policy=local,telnet,ssh,ftp,reboot,read,write,policy,test,winbox,password,web,sniff,sensitive,api,romon,dude,tikapp
/interface bridge port
add bridge=bridge1-lan interface=LAN-To-Orbi-eth3
/ip neighbor discovery-settings
set discover-interface-list=!dynamic
/interface list member
add interface=wan-airtel-eth2 list=WAN
add interface=LAN-To-Orbi-eth3 list=LAN
/ip address
add address=192.168.88.1/24 interface=eth4 network=192.168.88.0
add address=182.70.126.226/24 interface=wan-airtel-eth2 network=182.70.126.0
/ip arp
add address=192.168.88.2 interface=bridge1-lan mac-address=B8:27:EB:C8:AB:0C
add address=192.168.88.3 interface=bridge1-lan mac-address=00:11:32:74:8C:F0
add address=192.168.88.4 interface=bridge1-lan mac-address=B0:B9:8A:73:8E:58
/ip dhcp-server network
add address=192.168.88.0/24 dns-server=1.1.1.1 domain=local gateway=192.168.88.1 netmask=24
/ip dns
set allow-remote-requests=yes servers=1.1.1.1
/ip firewall address-list
add address=192.168.88.2-192.168.88.254 list=allowed_to_router
add address=0.0.0.0/8 comment=RFC6890 list=not_in_internet
add address=172.16.0.0/12 comment=RFC6890 list=not_in_internet
add address=192.168.0.0/16 comment=RFC6890 list=not_in_internet
add address=10.0.0.0/8 comment=RFC6890 list=not_in_internet
add address=169.254.0.0/16 comment=RFC6890 list=not_in_internet
add address=127.0.0.0/8 comment=RFC6890 list=not_in_internet
add address=224.0.0.0/4 comment=Multicast list=not_in_internet
add address=198.18.0.0/15 comment=RFC6890 list=not_in_internet
add address=192.0.0.0/24 comment=RFC6890 list=not_in_internet
add address=192.0.2.0/24 comment=RFC6890 list=not_in_internet
add address=198.51.100.0/24 comment=RFC6890 list=not_in_internet
add address=203.0.113.0/24 comment=RFC6890 list=not_in_internet
add address=100.64.0.0/10 comment=RFC6890 list=not_in_internet
add address=240.0.0.0/4 comment=RFC6890 list=not_in_internet
add address=192.88.99.0/24 comment="6to4 relay Anycast [RFC 3068]" list=not_in_internet
add address=192.168.88.11 list=Airlink-Only
add address=192.168.88.33 list=Airlink-Only
add address=192.168.88.16 list=Airlink-Only
/ip firewall filter
add action=accept chain=input comment="default configuration" connection-state=established,related
add action=accept chain=input src-address-list=allowed_to_router
add action=accept chain=input protocol=icmp
add action=drop chain=input
add action=fasttrack-connection chain=forward comment=FastTrack connection-state=established,related
add action=accept chain=forward comment="Established, Related" connection-state=established,related
add action=drop chain=forward comment="Drop invalid" connection-state=invalid log=yes log-prefix=invalid
add action=drop chain=forward comment="Drop incoming packets that are not NATted" connection-nat-state=!dstnat connection-state=new in-interface=WAN-1 log=yes log-prefix=!NAT
add action=drop chain=forward comment="Drop packets from LAN that do not have LAN IP" disabled=yes in-interface=bridge1-lan log=yes log-prefix=LAN_!LAN src-address=!192.168.88.0/24
add action=reject chain=forward disabled=yes dst-address=117.254.84.212 protocol=tcp reject-with=tcp-reset src-address=192.168.88.0/24
add action=reject chain=input disabled=yes dst-address=192.168.88.0/24 reject-with=icmp-network-unreachable src-address=117.254.84.212
/ip firewall mangle
add action=accept chain=prerouting disabled=yes in-interface=pppoe-out1-bsnl
add action=accept chain=prerouting in-interface=wan-airtel-eth2
add action=mark-connection chain=prerouting connection-state="" disabled=yes dst-address-type=!local new-connection-mark=wan1_conn passthrough=yes per-connection-classifier=\
both-addresses-and-ports:2/0 src-address=192.168.88.0/24
add action=mark-connection chain=prerouting disabled=yes dst-address-type=!local new-connection-mark=wan2_conn passthrough=yes per-connection-classifier=both-addresses-and-ports:2/1 src-address=\
192.168.88.0/24
add action=mark-routing chain=prerouting connection-mark=wan1_conn disabled=yes new-routing-mark=to_wan1 passthrough=yes src-address=192.168.88.0/24
add action=mark-routing chain=prerouting connection-mark=wan2_conn disabled=yes new-routing-mark=to_wan2 passthrough=yes src-address=192.168.88.0/24
/ip firewall nat
add action=masquerade chain=srcnat disabled=yes out-interface=pppoe-out1-bsnl
add action=masquerade chain=srcnat out-interface=wan-airtel-eth2
/ip route
add distance=1 gateway=182.70.126.1
add check-gateway=ping disabled=yes distance=1 gateway=pppoe-out1-bsnl
add check-gateway=ping disabled=yes distance=2 gateway=pppoe-out2-Airlink
/ip service
set telnet disabled=yes
set ftp disabled=yes
set ssh port=2222
set api disabled=yes
set api-ssl disabled=yes
/ip ssh
set forwarding-enabled=remote strong-crypto=yes
/ip upnp
set enabled=yes
/ipv6 address
add address=2001:470:35:2c1::2 advertise=no disabled=yes interface=sit1
add address=2001:470:36:2c2:: disabled=yes interface=bridge1-lan
/ipv6 route
add disabled=yes distance=1 dst-address=2000::/3 gateway=2001:470:35:2c1::1
/snmp
set contact=me@kushalraha.com enabled=yes trap-community=geekn0c
/system clock
set time-zone-name=Asia/Kolkata
/system identity
set name=MikroTik-Core
/system logging
set 0 disabled=yes
set 2 disabled=yes
/system ntp client
set enabled=yes primary-ntp=216.239.35.0 secondary-ntp=216.239.35.4
/system script
add dont-require-permissions=no name=failover owner=admin policy=ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon source="# ------------------- header -------------------\
\n# Script by Tomas Kirnak, version 1.0.7\
\n# If you use this script, or edit and\
\n# re-use it, please keep the header intact.\
\n#\
\n# For more information and details about\
\n# this script please visit the wiki page at\
\n# http://wiki.mikrotik.com/wiki/Failover_Scripting\
\n# ------------------- header -------------------\
\n\
\n\
\n\
\n# ------------- start editing here -------------\
\n# Edit the variables below to suit your needs\
\n\
\n# Please fill the WAN interface names\
\n:local InterfaceISP1 WAN-1\
\n:local InterfaceISP2 WAN-2\
\n\
\n# Please fill the gateway IPs (or interface names in case of PPP)\
\n:local GatewayISP1 pppoe-out1-bsnl\
\n:local GatewayISP2 pppoe-out2-airlink\
\n\
\n# Please fill the ping check host - currently: resolver1.opendns.com\
\n:local PingTarget 8.8.8.8\
\n\
\n# Please fill how many ping failures are allowed before fail-over happends\
\n:local FailTreshold 3\
\n\
\n# Define the distance increase of a route when it fails\
\n:local DistanceIncrease 2\
\n\
\n# Editing the script after this point may break it\
\n# -------------- stop editing here --------------\
\n\
\n\
\n\
\n# Declare the global variables\
\n:global PingFailCountISP1\
\n:global PingFailCountISP2\
\n\
\n# This inicializes the PingFailCount variables, in case this is the 1st time the script has ran\
\n:if ([:typeof \$PingFailCountISP1] = \"nothing\") do={:set PingFailCountISP1 0}\
\n:if ([:typeof \$PingFailCountISP2] = \"nothing\") do={:set PingFailCountISP2 0}\
\n\
\n# This variable will be used to keep results of individual ping attempts\
\n:local PingResult\
\n\
\n\
\n\
\n# Check ISP1\
\n:set PingResult [ping \$PingTarget count=1 interface=\$InterfaceISP1]\
\n:put \$PingResult\
\n\
\n:if (\$PingResult = 0) do={\
\n\t:if (\$PingFailCountISP1 < (\$FailTreshold+2)) do={\
\n\t\t:set PingFailCountISP1 (\$PingFailCountISP1 + 1)\
\n\t\t\
\n\t\t:if (\$PingFailCountISP1 = \$FailTreshold) do={\
\n\t\t\t:log warning \"ISP1 has a problem en route to \$PingTarget - increasing distance of routes.\"\
\n\t\t\t:foreach i in=[/ip route find gateway=\$GatewayISP1 && static] do=\\\
\n\t\t\t\t{/ip route set \$i distance=([/ip route get \$i distance] + \$DistanceIncrease)}\
\n\t\t\t:log warning \"Route distance increase finished.\"\
\n\t\t}\
\n\t}\
\n}\
\n:if (\$PingResult = 1) do={\
\n\t:if (\$PingFailCountISP1 > 0) do={\
\n\t\t:set PingFailCountISP1 (\$PingFailCountISP1 - 1)\
\n\t\t\
\n\t\t:if (\$PingFailCountISP1 = (\$FailTreshold -1)) do={\
\n\t\t\t:log warning \"ISP1 can reach \$PingTarget again - bringing back original distance of routes.\"\
\n\t\t\t:foreach i in=[/ip route find gateway=\$GatewayISP1 && static] do=\\\
\n\t\t\t\t{/ip route set \$i distance=([/ip route get \$i distance] - \$DistanceIncrease)}\
\n\t\t\t:log warning \"Route distance decrease finished.\"\
\n\t\t}\
\n\t}\
\n}\
\n\
\n\
\n\
\n# Check ISP2\
\n:set PingResult [ping \$PingTarget count=1 interface=\$InterfaceISP2]\
\n:put \$PingResult\
\n\
\n:if (\$PingResult = 0) do={\
\n\t:if (\$PingFailCountISP2 < (\$FailTreshold+2)) do={\
\n\t\t:set PingFailCountISP2 (\$PingFailCountISP2 + 1)\
\n\t\t\
\n\t\t:if (\$PingFailCountISP2 = \$FailTreshold) do={\
\n\t\t\t:log warning \"ISP2 has a problem en route to \$PingTarget - increasing distance of routes.\"\
\n\t\t\t:foreach i in=[/ip route find gateway=\$GatewayISP2 && static] do=\\\
\n\t\t\t\t{/ip route set \$i distance=([/ip route get \$i distance] + \$DistanceIncrease)}\
\n\t\t\t:log warning \"Route distance increase finished.\"\
\n\t\t}\
\n\t}\
\n}\
\n:if (\$PingResult = 1) do={\
\n\t:if (\$PingFailCountISP2 > 0) do={\
\n\t\t:set PingFailCountISP2 (\$PingFailCountISP2 - 1)\
\n\t\t\
\n\t\t:if (\$PingFailCountISP2 = (\$FailTreshold -1)) do={\
\n\t\t\t:log warning \"ISP2 can reach \$PingTarget again - bringing back original distance of routes.\"\
\n\t\t\t:foreach i in=[/ip route find gateway=\$GatewayISP2 && static] do=\\\
\n\t\t\t\t{/ip route set \$i distance=([/ip route get \$i distance] - \$DistanceIncrease)}\
\n\t\t\t:log warning \"Route distance decrease finished.\"\
\n\t\t}\
\n\t}\
\n}"
/tool bandwidth-server
set enabled=no
/tool graphing interface
add interface=WAN-1
add interface=WAN-2
/tool netwatch
add down-script="/ip route set [find comment=\"Default Route\"] distance=3}\
\n" host=8.8.8.8 up-script="/ip route set [find comment=\"Default Route\"] distance=1}"
[admin@MikroTik-Core] >