RB750Gr3: Slow internet connection - do I need another router

stitch84ac · December 24, 2023, 11:41am

Hi,

I am a total newbie in RouterOS but have at least managed to get a PPPoE connection to my ISP.
The RB750Gr3 is connected to the ONT on eth1. eth4 is the trunk port to my CRS328. In general I am very happy with my setup. VLAN is working, my access points are working fine.
But compared the router provided by my ISP, the speed of my internet connection is slow and somehow disappointing for me. I get 500 downstream with the router provided by my ISP. With the RB750Gr3 doing the PPPoE connection, I just get 160. Is this device to weak for my scenario? Do I need to buy another one? I am doing VLAN filtering and just have few firewall rules.

# dec/24/2023 12:36:48 by RouterOS 7.6
# software id = Q9KE-EAK5
#
# model = RB750Gr3
/interface bridge
add ingress-filtering=no name=vlan-bridge vlan-filtering=yes
/interface vlan
add interface=vlan-bridge name=vlan30-house-blue vlan-id=30
add interface=vlan-bridge name=vlan40-children-yellow vlan-id=40
add interface=vlan-bridge name=vlan43-mgmt vlan-id=43
add interface=vlan-bridge name=vlan50-iot-red vlan-id=50
add interface=vlan-bridge name=vlan60-guest-green vlan-id=60
add interface=ether1 name=wan-na-vlan10 vlan-id=10
/interface pppoe-client
add add-default-route=yes allow=pap,chap,mschap2 disabled=no interface=\
    wan-na-vlan10 name=pppoe-out1 use-peer-dns=yes user=xxx
/interface list
add name=WAN
add name=VLAN
add name=MGMT
/interface lte apn
set [ find default=yes ] ip-type=ipv4 use-network-apn=no
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
/ip pool
add name=dhcp_vlan30_home ranges=10.0.30.100-10.0.30.254
add name=dhcp_vlan40_children ranges=10.0.40.100-10.0.40.254
add name=dhcp_vlan50_iot ranges=10.0.50.100-10.0.50.254
add name=dhcp_vlan60_guest ranges=10.0.60.2-10.0.60.254
add name=dhcp_vlan43_mgmt ranges=10.0.43.100-10.0.43.254
/ip dhcp-server
add address-pool=dhcp_vlan30_home interface=vlan30-house-blue name=\
    dhcp_server_vlan30_house
add address-pool=dhcp_vlan40_children interface=vlan40-children-yellow name=\
    dhcp_server_vlan40_children
add address-pool=dhcp_vlan50_iot interface=vlan50-iot-red name=\
    dhcp_server_vlan50_iot
add address-pool=dhcp_vlan60_guest interface=vlan60-guest-green name=\
    dhcp_server_vlan60_guest
add address-pool=dhcp_vlan43_mgmt interface=vlan43-mgmt name=\
    dhcp_server_vlan43_mgmt
/port
set 0 name=serial0
/routing bgp template
set default disabled=no output.network=bgp-networks
/routing ospf instance
add disabled=no name=default-v2
/routing ospf area
add disabled=yes instance=default-v2 name=backbone-v2
/interface bridge port
add bridge=vlan-bridge frame-types=admit-only-untagged-and-priority-tagged \
    ingress-filtering=no interface=ether2 pvid=30
add bridge=vlan-bridge frame-types=admit-only-untagged-and-priority-tagged \
    ingress-filtering=no interface=ether3 pvid=30
add bridge=vlan-bridge frame-types=admit-only-untagged-and-priority-tagged \
    ingress-filtering=no interface=ether4 pvid=43
add bridge=vlan-bridge ingress-filtering=no interface=ether5
/ipv6 settings
set disable-ipv6=yes max-neighbor-entries=8192
/interface bridge vlan
add bridge=vlan-bridge tagged=vlan-bridge,ether5 vlan-ids=30
add bridge=vlan-bridge tagged=vlan-bridge,ether5 vlan-ids=40
add bridge=vlan-bridge tagged=vlan-bridge,ether5 vlan-ids=43
add bridge=vlan-bridge tagged=vlan-bridge,ether5 vlan-ids=50
add bridge=vlan-bridge tagged=vlan-bridge,ether5 vlan-ids=60
/interface list member
add interface=wan-na-vlan10 list=WAN
add interface=vlan30-house-blue list=VLAN
add interface=vlan40-children-yellow list=VLAN
add interface=vlan43-mgmt list=VLAN
add interface=vlan50-iot-red list=VLAN
add interface=vlan60-guest-green list=VLAN
add interface=vlan43-mgmt list=MGMT
add interface=pppoe-out1 list=WAN
add interface=ether1 list=WAN
/interface ovpn-server server
set auth=sha1,md5
/ip address
add address=10.0.30.1/24 interface=vlan30-house-blue network=10.0.30.0
add address=10.0.40.1/24 interface=vlan40-children-yellow network=10.0.40.0
add address=10.0.50.1/24 interface=vlan50-iot-red network=10.0.50.0
add address=10.0.60.1/24 interface=vlan60-guest-green network=10.0.60.0
add address=10.0.43.1/24 interface=vlan43-mgmt network=10.0.43.0
/ip dhcp-server network
add address=10.0.30.0/24 dns-server=8.8.8.8 gateway=10.0.30.1
add address=10.0.40.0/24 dns-server=10.0.30.17,8.8.8.8 gateway=10.0.40.1
add address=10.0.43.0/24 gateway=10.0.43.1
add address=10.0.50.0/24 gateway=10.0.50.1
add address=10.0.60.0/24 gateway=10.0.60.1
/ip dns
set allow-remote-requests=yes
/ip firewall filter
add action=fasttrack-connection chain=forward connection-state=\
    established,related disabled=yes hw-offload=yes
add action=accept chain=input comment="Allow Estab & Related" \
    connection-state=established,related
add action=accept chain=input comment="Allow VLAN" in-interface-list=VLAN \
    log=yes log-prefix=vlan_log
add action=accept chain=input comment="Allow Base_Vlan Full Access" \
    in-interface=vlan43-mgmt
add action=drop chain=input comment=Drop
add action=accept chain=forward in-interface=vlan30-house-blue out-interface=\
    vlan43-mgmt
add action=accept chain=forward comment="DNS Parental Control" dst-address=\
    10.0.30.17 dst-port=53 in-interface=vlan40-children-yellow protocol=udp
add action=accept chain=forward dst-address=10.0.30.17 dst-port=53 \
    in-interface=vlan40-children-yellow protocol=tcp
add action=accept chain=forward comment="Allow Estab & Related" \
    connection-state=established,related
add action=accept chain=forward comment="VLAN Internet Access only" \
    connection-state=new in-interface-list=VLAN out-interface-list=WAN
add action=drop chain=forward comment=Drop log-prefix=drop_forward
/ip firewall nat
add action=masquerade chain=srcnat comment="Default masquerade" \
    out-interface-list=WAN
/system clock
set time-zone-name=Europe/Berlin
/system identity
set name=home

erlinden · December 24, 2023, 2:21pm

From the config I would remove:

/interface list member
add interface=wan-na-vlan10 list=WAN
add interface=ether1 list=WAN

The pppoe is the only interface that has to be on the WAN addresslist.

Are you using HW offload on the bridge?

/interface/bridge/port print

What is the CPU usage while performing a speedtest?

anav · December 25, 2023, 3:43pm

Concur with erlindens observation.
Firewall rules are a bit disorganized and after review, my big issues is the ridiculousness of allowing all vlans to the router and then after attempting to only alllow managment vlan to config router… had a good chuckle,

I also removed this rule awaiting clarification, it makes no sense to allow an entire subnet to access management vlan…???
add action=accept chain=forward in-interface=vlan30-house-blue out-interface=
vlan43-mgmt

One should be on the management vlan already, but okay if not then I suggest that its one or two IP addressess that should access it not the whole subnet.
So temporarily put the rule back in but with the authorized list…

should look like…
/ip firewall address-list ( using mostly static DHCP leases )
add address=admin-IP1 list=Authorized comment=“Admin desktop”
add address=admin-IP1 list=Authorized comment=“Admin laptop”
add address=admin-IP1 list=Authorized comment=“Admin ipad/smartphone”
add address=admin-IP4 list=Authorized comment=“Admin remote wireguard IP”
/ip firewall filter
{ Input Chain }
(default rules to keep)
add action=accept chain=input comment=“Allow Estab & Related & Untracked”
connection-state=established,related,untracked
add action=drop chain=input comment=“defconf: drop invalid” connection-state=invalid
add action=accept chain=input comment=“defconf: accept ICMP” protocol=icmp
add action=accept chain=input comment=“defconf: accept to local loopback (for CAPsMAN)” dst-address=127.0.0.1
(user rules)
add action=accept chain=input src-address-list=Authorized comment=“Config Access”
add action=accept chain=input comment=“Allow LAN DNS queries-UDP” \ {and NTP *** services if required etc}
dst-port=53 in-interface-list=VLAN protocol=udp
add action=accept chain=input comment=“Allow LAN DNS queries - TCP”
dst-port=53 in-interface-list=VLAN protocol=tcp
add action=drop chain=input comment=Drop
{Forward Chain}
(default rules to keep)
add action=fasttrack-connection chain=forward connection-state=
established,related disabled=yes hw-offload=yes
add action=accept chain=forward comment=“Allow Estab & Related & Untracked”
connection-state=established,related,untracked
add action=drop chain=forward comment=“defconf: drop invalid” connection-state=invalid
(user rules)
add action=accept chain=forward comment=“VLAN Internet Access only”
in-interface-list=VLAN out-interface-list=WAN
add action=accept chain=forward src-address-list=Authorized out-interface=
vlan43-mgmt
add action=accept chain=forward comment=“DNS Parental Control” dst-address=
10.0.30.17 dst-port=53 in-interface=vlan40-children-yellow protocol=udp
add action=accept chain=forward dst-address=10.0.30.17 dst-port=53
in-interface=vlan40-children-yellow protocol=tcp
add action=drop chain=forward comment=Drop log-prefix=drop_forward

anav · December 25, 2023, 3:47pm

Although one cannot stop smart kids from bypassing your DNS, you can make it a bit better/stronger with some additional rules.

add chain=dst-nat action=dstnat in-interface=VLAN40 dst-port=53 protocol=udp to-addresss=10.0.30.17
add chain=dst-nat action=dstnat in-interface=VLAN40 dst-port=53 protocol=tcp to-addresss=10.0.30.17