Slow ethernet directly from rb750Gr3 port 2

[Okietim]

I upgraded my internet speed to 1Gbit from 300Mbit and didn’t see any change
using speedtest.net. It still was running around 300Mbit.

To isolate the problem, I connected rb ethernet port 2 directly to a single pc and ran speedtest
with same result 300Mbit performance.

Then I disconnected rb ethernet port 2 cable and plugged it into cable router ( Netgear CM1000 ).
Speedtest.net now showing over 900Mbit performance.

Then to confirm where problem was I connected a spare Netgear GS108Tv2 vanilla switch to
cable modem ethernet cable and attached pc with same cable as previous test into port 2 of
Netgear switch.

Again I ran speedtest.net from same pc and also ran at over 900Mbit performance.

Reconnected cable from cable modem to rb ethernet port 1 and pc cable to rb ethernet port 2.

Again I ran speedtest.net and once more speed is no more than 300Mbit performance.

I’ve confirmed cpu load max is 45% with mostly in mid 30% range while running speedtest.net.

I believe the rb ethernet ports are all set to 1Gbit full duplex.

Anyone have any ideas what might need to be looked at?

Attached is current export.
ethspd2.rsc (86.1 KB)

[Sob]

There are some hw limits, you won’t get 1Gbit between all interfaces, see block diagrams on product page. But in this case it shouldn’t be it.

Next, low cpu usage across all cores means nothing if there would be something limited by single thread. I don’t know details about inner workings of RouterOS, so I can’t say if that’s it or not, but it’s a possibility. Look for more details in Tools->Profile

You have not very small blacklist, but it doesn’t seem to be used at all, so that’s not it either.

Try to move fasttrack rule to be the first one in chain, because it doesn’t do anything useful at the end.

[Okietim]

There are some hw limits, you won’t get 1Gbit between all interfaces, see block diagrams on product page. But in this case it shouldn’t be it.

Next, low cpu usage across all cores means nothing if there would be something limited by single thread. I don’t know details about inner workings of RouterOS, so I can’t say if that’s it or not, but it’s a possibility. Look for more details in Tools->Profile

You have not very small blacklist, but it doesn’t seem to be used at all, so that’s not it either.

Try to move fasttrack rule to be the first one in chain, because it doesn’t do anything useful at the end.

Thanks Sob!
I’ll move fasttrack to first and see if that helps.
I was wondering if setting up a bridge might improve the performance but have no experience with it.

[Sob]

Bridge = switch. So it depends whether you need another router or not and can live with just cable router.

[Okietim]

There are some hw limits, you won’t get 1Gbit between all interfaces, see block diagrams on product page. But in this case it shouldn’t be it.

Next, low cpu usage across all cores means nothing if there would be something limited by single thread. I don’t know details about inner workings of RouterOS, so I can’t say if that’s it or not, but it’s a possibility. Look for more details in Tools->Profile

You have not very small blacklist, but it doesn’t seem to be used at all, so that’s not it either.

Try to move fasttrack rule to be the first one in chain, because it doesn’t do anything useful at the end.

Thanks Sob!
I’ll move fasttrack to first and see if that helps.
I was wondering if setting up a bridge might improve the performance but have no experience with it.

This made significant difference! Now getting around 700Mbit performance!
So I guess I need to look into a more robust routerboard beyond the rv750Gr3… any suggestions?

[Sob]

I suppose something bigger and more expensive will do, but I don’t have enough experience with those devices, to give specific recommendation.

I’m just a little surprised about RB750Gr3, based on official test results, I expected more. Just 700Mbit with fasttrack doesn’t look like much. But I guess it might be my misinterpretation of test numbers.

Btw, your firewall for forward is only three active rules:

/ip firewall filter
add action=fasttrack-connection chain=forward connection-state=established,related
add action=accept chain=forward connection-state=established,related
add action=accept chain=forward connection-state=new src-address-list=PrivateIPs

and since default action is accept, it makes it wide open for anything. You might want do to something about that.

[Okietim]

I suppose something bigger and more expensive will do, but I don’t have enough experience with those devices, to give specific recommendation.

I’m just a little surprised about RB750Gr3, based on official test results, I expected more. Just 700Mbit with fasttrack doesn’t look like much. But I guess it might be my misinterpretation of test numbers.

Btw, your firewall for forward is only three active rules:

/ip firewall filter
add action=fasttrack-connection chain=forward connection-state=established,related
add action=accept chain=forward connection-state=established,related
add action=accept chain=forward connection-state=new src-address-list=PrivateIPs

and since default action is accept, it makes it wide open for anything. You might want do to something about that.

Thanks again for your help!

I would appreciate any suggestions on best way to improve rules.

[R1CH]

I would suggest removing those blacklist downloads, they pose a huge security risk. If someone is able to MITM your connection or the web host is compromised, your router is compromised since it’s essentially executing arbitrary commands from a remote host (!).

[Okietim]

I would suggest removing those blacklist downloads, they pose a huge security risk. If someone is able to MITM your connection or the web host is compromised, your router is compromised since it’s essentially executing arbitrary commands from a remote host (!).

Thanks R1CH,

I will do that right away!

[Okietim]

I would suggest removing those blacklist downloads, they pose a huge security risk. If someone is able to MITM your connection or the web host is compromised, your router is compromised since it’s essentially executing arbitrary commands from a remote host (!).

Thanks R1CH,

I will do that right away!

Have made some changes to firewall rules and address lists
Now performance almost 900mbit!

Suggesstions welcomed!