Just when I thought I had my setup completed, I have come up against something is a big stumbling block.
I have an Unraid server that runs sabNZBd in a docker, and it is on it’s own Server VLAN 99.
Whenever I try and download anything via Usenet, my speed peaks at 5MBps and then drops to under 2MBps, whereas it should reach 10-13MBps, and has in the past until a week ago.
If I reset the configuration of the RB5009 to defaults, my speeds are fine again.
As there should be no inter-vlan routing or anything going I can’t see where there would be any bottle necks, and it’s only a 100Mb WAN connection anyway. CPU usage rarely gets over 5-7%.
What is strange is that it is ONLY Usenet, normal HTTP downloads and speedtests are fine and max out my connection.
# 2024-07-03 17:53:21 by RouterOS 7.15.1
#
# model = RB5009UG+S+
/interface bridge
add admin-mac=78:9A:18:D9:17:FF auto-mac=no comment=defconf name=bridge \
port-cost-mode=short vlan-filtering=yes
/interface ethernet
set [ find default-name=ether2 ] auto-negotiation=no
set [ find default-name=ether3 ] auto-negotiation=no
set [ find default-name=ether4 ] auto-negotiation=no
set [ find default-name=ether6 ] auto-negotiation=no
/interface veth
add address=10.0.53.53/24 gateway=10.0.53.1 gateway6="" name=veth-adguard
add address=10.0.200.200/24 gateway=10.0.200.1 gateway6="" name=veth-mDNS
/interface wireguard
add listen-port=13231 mtu=1420 name=wireguard1
/interface vlan
add interface=bridge name=guest_vlan_20 vlan-id=20
add interface=bridge name=home_vlan_11 vlan-id=11
add interface=bridge name=iot_vlan_30 vlan-id=30
add interface=bridge name=mgmt_vlan_10 vlan-id=10
add interface=bridge name=servers_vlan_99 vlan-id=99
/container mounts
add dst=/opt/adguardhome name=agh_conf src=/usb1/conf/adguard
/disk
set usb1 media-interface=none media-sharing=no
/interface list
add comment=defconf name=WAN
add comment=defconf name=LAN
add name=VLAN
add comment=Management name=MGMT
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
/ip pool
add name=dhcp_pool1 ranges=192.168.99.199-192.168.99.254
add name=Guest_Pool ranges=10.0.20.199-10.0.20.254
add name=Server_Pool ranges=192.168.0.199-192.168.0.254
add name=MGMT_Pool ranges=10.0.10.199-10.0.10.254
add name=IOT_Pool ranges=10.0.30.2-10.0.30.254
add name=Home_Pool ranges=10.0.11.199-10.0.11.254
/ip dhcp-server
add address-pool=dhcp_pool1 interface=bridge lease-time=10m name=dhcp1
add address-pool=Guest_Pool interface=guest_vlan_20 name=Guest_DHCP
add address-pool=Server_Pool interface=servers_vlan_99 name=Management_DHCP
add address-pool=MGMT_Pool interface=mgmt_vlan_10 name=Server_DHCP
add address-pool=IOT_Pool interface=iot_vlan_30 name=IOT_DHCP
add address-pool=Home_Pool interface=home_vlan_11 name=Home_DHCP
/ip smb users
set [ find default=yes ] disabled=yes
/container
add envlist=repeater_envs interface=veth-mDNS root-dir=usb1/conf/mdns
add interface=veth-adguard logging=yes root-dir=usb1/adguard start-on-boot=\
yes
/container config
set registry-url=https://registry-1.docker.io tmpdir=usb1/pull
/container envs
add comment="mdns-repeater (FLO-254)" key=REPEATER_INTERFACES name=\
repeater_envs value="eth0.11 eth0.30"
/interface bridge port
add bridge=bridge comment=defconf frame-types=\
admit-only-untagged-and-priority-tagged interface=ether2 \
internal-path-cost=10 path-cost=10 pvid=11
add bridge=bridge comment=defconf frame-types=\
admit-only-untagged-and-priority-tagged interface=ether3 \
internal-path-cost=10 path-cost=10 pvid=10
add bridge=bridge comment=defconf frame-types=\
admit-only-untagged-and-priority-tagged interface=ether4 \
internal-path-cost=10 path-cost=10 pvid=99
add bridge=bridge comment=defconf frame-types=\
admit-only-untagged-and-priority-tagged interface=ether5 \
internal-path-cost=10 path-cost=10 pvid=99
add bridge=bridge comment=defconf frame-types=\
admit-only-untagged-and-priority-tagged interface=ether6 \
internal-path-cost=10 path-cost=10 pvid=99
add bridge=bridge comment=defconf interface=ether7 internal-path-cost=10 \
path-cost=10 pvid=10
add bridge=bridge comment=defconf interface=sfp-sfpplus1 internal-path-cost=\
10 path-cost=10
add bridge=bridge interface=ether1 internal-path-cost=10 path-cost=10 pvid=99
add bridge=bridge interface=veth-mDNS
add bridge=bridge interface=veth-adguard
/ip firewall connection tracking
set udp-timeout=10s
/ip neighbor discovery-settings
set discover-interface-list=MGMT
/ipv6 settings
set disable-ipv6=yes
/interface bridge vlan
add bridge=bridge comment=Servers_VLAN tagged=bridge untagged=ether1,ether4 \
vlan-ids=99
add bridge=bridge comment=Guest_VLAN tagged=bridge,ether7 vlan-ids=20
add bridge=bridge comment=IOT_VLAN tagged=bridge,ether7,veth-mDNS vlan-ids=30
add bridge=bridge comment=MGMT_VLAN tagged=bridge untagged=ether3,ether7 \
vlan-ids=10
add bridge=bridge comment=Home_VLAN tagged=bridge,ether7,veth-mDNS untagged=\
ether2,ether5,ether6 vlan-ids=11
/interface list member
add comment=defconf interface=ether8 list=WAN
add interface=servers_vlan_99 list=LAN
add interface=guest_vlan_20 list=LAN
add interface=iot_vlan_30 list=LAN
add interface=mgmt_vlan_10 list=LAN
add comment=Wireguard interface=wireguard1 list=LAN
add comment="Servers VLAN" interface=servers_vlan_99 list=MGMT
add comment="Management WG" interface=wireguard1 list=MGMT
add comment="Management VLAN" interface=mgmt_vlan_10 list=MGMT
add interface=home_vlan_11 list=LAN
add interface=veth-adguard list=LAN
/ip address
add address=192.168.99.1/24 comment=defconf interface=bridge network=\
192.168.99.0
add address=192.168.69.1/24 interface=wireguard1 network=192.168.69.0
add address=192.168.0.1/24 interface=servers_vlan_99 network=192.168.0.0
add address=10.0.20.1/24 interface=guest_vlan_20 network=10.0.20.0
add address=10.0.30.1/24 interface=iot_vlan_30 network=10.0.30.0
add address=10.0.10.1/24 interface=mgmt_vlan_10 network=10.0.10.0
add address=10.0.11.1/24 interface=home_vlan_11 network=10.0.11.0
add address=10.0.53.1/24 interface=veth-adguard network=10.0.53.0
/ip cloud
set ddns-enabled=yes
/ip dhcp-client
add comment=defconf interface=ether8
/ip dhcp-server network
add address=10.0.10.0/24 dns-server=192.168.0.69 gateway=10.0.10.1
add address=10.0.11.0/24 dns-server=192.168.0.69 gateway=10.0.11.1
add address=10.0.20.0/24 gateway=10.0.20.1
add address=10.0.30.0/24 gateway=10.0.30.1
add address=10.0.40.0/24 gateway=10.0.40.1
add address=192.168.0.0/24 gateway=192.168.0.1
/ip dns
set allow-remote-requests=yes
/ip firewall address-list
add address=10.0.20.0/24 comment="Guest VLAN" list=Guest_List
add address=10.0.10.0/24 comment="Management VLAN" list=MGMT_List
add address=192.168.0.0/24 comment="Servers VLAN" list=Servers_List
add address=10.0.30.0/24 comment="IOT VLAN" list=IOT_List
add address=192.168.0.10 comment="HTPC PC" list=admin_ips
add address=10.10.10.0/24 comment="All VLANs" list=vlans
add address=10.10.20.0/24 comment="All VLANs" list=vlans
add address=10.10.30.0/24 comment="All VLANs" list=vlans
add address=192.168.0.0/24 comment="All VLANs" list=vlans
add address=192.168.0.2 comment="Josh PC" list=admin_ips
add address=192.168.69.7 comment="Work PC - WG" list=admin_ips
add address=192.168.69.2 comment="Phone - WG" list=admin_ips
add address=10.0.10.10 comment="Josh PC" list=admin_ips
add address=10.0.11.0/24 comment="All VLANs" list=vlans
add address=10.0.11.0/24 comment="Home VLAN" list=Home_List
/ip firewall filter
add action=accept chain=input comment=\
"defconf: accept established,related,untracked" connection-state=\
established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=\
invalid
add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp
add action=accept chain=input comment=\
"defconf: accept to local loopback (for CAPsMAN)" dst-address=127.0.0.1
add action=accept chain=input comment=\
"Allow incoming traffic to the wireguard service" dst-port=13231 \
protocol=udp
add action=accept chain=input comment="Allow DNS from Wireguard Users" \
disabled=yes dst-port=53 in-interface=wireguard1 protocol=udp
add action=accept chain=input comment="Allow DNS from Wireguard Users" \
disabled=yes dst-port=53 in-interface=wireguard1 protocol=tcp
add action=accept chain=input comment=letsencrypt dst-port=80 \
in-interface-list=WAN protocol=tcp
add action=accept chain=input comment="adguard access to router services" \
dst-port=53 protocol=udp src-address=10.0.53.53
add action=accept chain=input comment="adguard access to router services" \
dst-port=53 protocol=tcp src-address=10.0.53.53
add action=accept chain=input comment="Allow admin IPs to Access Router" \
in-interface-list=LAN src-address-list=admin_ips
add action=drop chain=input comment="Drop Everything Else"
add action=accept chain=forward comment="defconf: accept in ipsec policy" \
ipsec-policy=in,ipsec
add action=accept chain=forward comment="defconf: accept out ipsec policy" \
ipsec-policy=out,ipsec
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" \
connection-state=established,related hw-offload=yes
add action=accept chain=forward comment=\
"defconf: accept established,related, untracked" connection-state=\
established,related,untracked
add action=accept chain=forward comment="Allow Management VLAN access to ALL" \
connection-state=new in-interface-list=MGMT out-interface-list=LAN
add action=accept chain=forward comment="Allow MGMT to Adguard" dst-address=\
10.0.53.53 dst-port=80,3000 in-interface-list=MGMT protocol=tcp
add action=accept chain=forward comment="VLAN Internet Access only" \
connection-state=new in-interface-list=LAN out-interface-list=WAN
add action=accept chain=forward comment="Allow LAN access to Adguard" \
dst-address=10.0.53.53 dst-port=53 in-interface-list=LAN protocol=tcp
add action=accept chain=forward comment="Allow LAN access to Adguard" \
dst-address=10.0.53.53 dst-port=53 in-interface-list=LAN protocol=udp
add action=accept chain=forward comment="Allow Home LAN to LAN" \
connection-state=new out-interface-list=LAN src-address-list=Home_List
add action=accept chain=forward comment="Allow TV access to Jellyfin" \
dst-address=192.168.0.69 dst-port=8096 protocol=tcp src-address=\
10.0.30.10
add action=accept chain=forward comment="Allow Forwarded Ports" \
connection-nat-state=dstnat
add action=accept chain=forward comment="Allow Adguard container WAN Access" \
out-interface-list=WAN src-address=10.0.53.53
add action=drop chain=forward comment="Drop Everything Else" \
connection-state=""
/ip firewall nat
add action=masquerade chain=srcnat comment=\
"HairPin NAT @ LAN to Server on LAN" disabled=yes dst-address=\
192.168.0.0/25 src-address=192.168.0.0/25
add action=masquerade chain=srcnat comment="defconf: masquerade" \
ipsec-policy=out,none out-interface-list=WAN
add action=dst-nat chain=dstnat comment="Port Forward 80 to HTPC" dst-port=80 \
in-interface-list=WAN protocol=tcp to-addresses=192.168.0.10 to-ports=80
add action=dst-nat chain=dstnat comment="Port Forward 443 to HTPC" dst-port=\
443 in-interface-list=WAN protocol=tcp to-addresses=192.168.0.10 \
to-ports=443
add action=dst-nat chain=dstnat comment="Wireguard Unraid" dst-port=51820 \
in-interface-list=WAN protocol=udp to-addresses=192.168.0.69 to-ports=\
51820
add action=dst-nat chain=dstnat comment="Wireguard HTPC" dst-port=51822 \
in-interface-list=WAN protocol=udp to-addresses=192.168.0.10 to-ports=\
51822
/ip service
set telnet disabled=yes
set ftp disabled=yes
set ssh disabled=yes
set api disabled=yes
set api-ssl disabled=yes
/ip smb shares
set [ find default=yes ] directory=/pub
/system clock
set time-zone-name=Australia/Melbourne
/system leds settings
set all-leds-off=after-1min
/system note
set show-at-login=no
/tool mac-server
set allowed-interface-list=none
/tool mac-server mac-winbox
set allowed-interface-list=MGMT