Good afternoon All,
I have RB750Gr3 with firmware 6.43.7 connected to 48 port cisco gigabit switch. My config looks like this: 3 vlans created on RB750Gr3 on interface LAN1, I have WAN1, WAN2, LAN2 and LAN3 (each LAN on physical port). I don’t use bridges as of right now. I am experiencing slow file transfer rates when copying files between vlans ) maxing out at around 23 megabytes per second. When looking at RB750Gr3 i see cpu0,1,2 showing around 30-40 % use but cpu3 100% during file transfers. Is it normal with this router? Should i create bridge int for each LAN and create vlans on the bridge, will that fix the issue? thanks
Chris
Hi
I would help to post your config: /export hide-sensitive compact
Jotne
December 23, 2018, 12:56pm
3
There are so many ways to setup VLAN and many of them will not give good throughput.
here is my config, I deleted some stuff from it so not everything will make sense but all important stuff should be in there, thanksconfig.rsc (15.2 KB)
Jotne
December 23, 2018, 2:13pm
5
You need yo use the bridge configuration.http://forum.mikrotik.com/t/sofware-vlan-bridge-on-ruteros-explained/122534/1
You should do the fowlloing
Add a bridge (just one) (Turn on VLAN filtering after all is configured)
Connect VLAN to the bridge
Connect Bridge to port
Configure Bridge VAN
Add DHCP/IP etc to each interface.
You should do a reset to default configuration and then adopt your config.
This is your config, so other do not need to download it.
# dec/23/2018 08:26:07 by RouterOS 6.43.7
# software id = ------------
#
# model = RouterBOARD 750G r3
# serial number = ----------------
/interface ethernet
set [ find default-name=ether1 ] name=ether1-WAN1
set [ find default-name=ether2 ] name=ether2-WAN2
set [ find default-name=ether3 ] name=ether3-LAN1
set [ find default-name=ether4 ] name=ether4-LAN2
set [ find default-name=ether5 ] name=ether5-LAN3
/interface vlan
add interface=ether3-LAN1 name=vlan60-servers vlan-id=60
add interface=ether3-LAN1 name=vlan70-home vlan-id=70
add interface=ether3-LAN1 name=vlan90-guest vlan-id=90
add interface=ether3-LAN1 name=vlan100-test vlan-id=100
add interface=ether3-LAN1 name=vlan110-ipcameras vlan-id=110
/ip firewall layer7-protocol
add name=torrentsites regexp="^.*(get|GET).+(torrent|thepiratebay|isohunt|ente\
rtane|demonoid|btjunkie|mininova|flixflux|torrentz|vertor|h33t|btscene|bit\
unity|bittoxic|thunderbytes|entertane|zoozle|vcdq|bitnova|bitsoup|meganova\
|fulldls|btbot|flixflux|seedpeer|fenopy|gpirate|commonbits).*\$"
/ip ipsec peer profile
add dh-group=modp1024 name=profile_1
/ip ipsec proposal
set [ find default=yes ] lifetime=0s pfs-group=none
/ip pool
add name=dhcp_pool_LAN2 ranges=192.168.12.100-192.168.12.199
add name=dhcp_pool_LAN3 ranges=192.168.13.100-192.168.13.199
add name=L2TPVPN_POOL ranges=192.168.101.240-192.168.101.250
add name=PPTPVPN_POOL ranges=192.168.102.240-192.168.102.250
add name=dhcp_pool_LAN1 ranges=192.168.80.100-192.168.80.199
add name=dhcp_pool_vlan90 ranges=192.168.90.100-192.168.90.199
add name=dhcp_pool_vlan100 ranges=192.168.100.100-192.168.100.199
add name=dhcp_pool_vlan110 ranges=192.168.110.10-192.168.110.99
/ip dhcp-server
add address-pool=dhcp_pool_LAN2 authoritative=after-2sec-delay disabled=no \
interface=ether4-LAN2 lease-time=2m name=dhcp-LAN2
add address-pool=dhcp_pool_LAN3 authoritative=after-2sec-delay disabled=no \
interface=ether5-LAN3 lease-time=2m name=dhcp-LAN3
add address-pool=dhcp_pool_LAN1 disabled=no interface=ether3-LAN1 name=\
dhcp-LAN1
add address-pool=dhcp_pool_vlan90 disabled=no interface=vlan90-guest name=\
dhcp-VLAN90
add address-pool=dhcp_pool_vlan100 disabled=no interface=vlan100-test name=\
dhcp-VLAN100
add address-pool=dhcp_pool_vlan110 disabled=no interface=vlan110-ipcameras \
name=dhcp-VLAN110
/ppp profile
add change-tcp-mss=yes dns-server=8.8.4.4,8.8.8.8 local-address=192.168.101.1 \
name=L2TPVPN_PROFILE remote-address=L2TPVPN_POOL use-mpls=no
add dns-server=8.8.8.8,8.8.4.4 local-address=192.168.102.1 name=\
PPTPVPN_PROFILE remote-address=PPTPVPN_POOL use-encryption=required
/snmp community
set [ find default=yes ] addresses=0.0.0.0/0
/system logging action
add disk-file-name=disk1/log disk-lines-per-file=5000 name=microSD target=\
disk
/ip firewall connection tracking
set enabled=yes
/interface l2tp-server server
set default-profile=L2TPVPN_PROFILE enabled=yes use-ipsec=yes
/interface pptp-server server
set enabled=yes
/ip address
add address=192.168.12.1/24 interface=ether4-LAN2 network=192.168.12.0
add address=192.168.13.1/24 interface=ether5-LAN3 network=192.168.13.0
add address=192.168.80.1/24 interface=ether3-LAN1 network=192.168.80.0
add address=192.168.60.1/24 interface=vlan60-servers network=192.168.60.0
add address=192.168.70.1/24 interface=vlan70-home network=192.168.70.0
add address=192.168.90.1/24 interface=vlan90-guest network=192.168.90.0
add address=192.168.100.1/24 interface=vlan100-test network=192.168.100.0
add address=192.168.110.1/24 interface=vlan110-ipcameras network=\
192.168.110.0
/ip cloud
set ddns-enabled=yes
/ip dhcp-client
add add-default-route=no dhcp-options=hostname,clientid disabled=no \
interface=ether1-WAN1
add add-default-route=no dhcp-options=clientid,hostname disabled=no \
interface=ether2-WAN2
/ip dhcp-relay
add dhcp-server=192.168.60.10 disabled=no interface=vlan60-servers name=\
relay-vlan60
add dhcp-server=192.168.60.10 disabled=no interface=vlan70-home name=\
relay-vlan70
/ip dhcp-server network
add address=192.168.12.0/24 dns-server=192.168.12.1,8.8.8.8 gateway=\
192.168.12.1
add address=192.168.13.0/24 dns-server=192.168.13.1,8.8.8.8 gateway=\
192.168.13.1
add address=192.168.80.0/24 dns-server=192.168.80.1,8.8.8.8 gateway=\
192.168.80.1 netmask=24
add address=192.168.90.0/24 dns-server=192.168.90.1,8.8.8.8 gateway=\
192.168.90.1 netmask=24
add address=192.168.100.0/24 dns-server=192.168.100.1,8.8.8.8 gateway=\
192.168.100.1 netmask=24
add address=192.168.110.0/24 dns-server=192.168.110.1,8.8.8.8 gateway=\
192.168.110.1 netmask=24
/ip dns
set allow-remote-requests=yes
/ip firewall address-list
add address=71.6.167.0/24 list=BlockedIPs
add address=66.240.236.0/24 list=BlockedIPs
add address=198.20.70.0/24 list=BlockedIPs
add address=198.20.87.0/24 list=BlockedIPs
add address=0.0.0.0/8 list=BOGONS
add address=10.0.0.0/8 list=BOGONS
add address=100.64.0.0/10 list=BOGONS
add address=127.0.0.0/8 list=BOGONS
add address=169.254.0.0/16 list=BOGONS
add address=172.16.0.0/12 list=BOGONS
add address=192.0.0.0/24 list=BOGONS
add address=192.0.2.0/24 list=BOGONS
add address=192.168.0.0/16 list=BOGONS
add address=198.18.0.0/15 list=BOGONS
add address=198.51.100.0/24 list=BOGONS
add address=203.0.113.0/24 list=BOGONS
add address=224.0.0.0/3 list=BOGONS
add address=192.168.70.10 comment="IPs Accessing Internet Through WAN1" list=\
IPs_WAN1
add address=192.168.70.11 comment="IPs Accessing Internet Through WAN2" list=\
IPs_WAN2
add address=192.168.90.2-192.168.90.253 comment=\
"IPs Accessing Internet Through WAN2 Guest Network" list=Guest_IPs_WAN2
/ip firewall filter
add action=drop chain=forward comment=\
"Restrict Guest traffic to its own subnet" dst-address=192.168.60.0/24 \
src-address=192.168.90.0/24
add action=drop chain=forward dst-address=192.168.70.0/24 src-address=\
192.168.90.0/24
add action=drop chain=forward dst-address=192.168.80.0/24 src-address=\
192.168.90.0/24
add action=drop chain=forward dst-address=192.168.100.0/24 src-address=\
192.168.90.0/24
add action=drop chain=forward dst-address=192.168.110.0/24 src-address=\
192.168.90.0/24
add action=drop chain=forward comment=\
"Block Traffic to Internet from IPCameras" src-address=192.168.110.0/24
add action=drop chain=input comment=\
"Block Traffic from Internet from specific IP ranges" src-address-list=\
BlockedIPs
add action=accept chain=input comment=PPTP_VPN dst-port=1723 protocol=tcp \
src-address-list=UnitedStatesIPs
add action=accept chain=input protocol=gre src-address-list=UnitedStatesIPs
add action=accept chain=input comment=L2TP_VPN dst-port=1701 protocol=udp \
src-address-list=UnitedStatesIPs
add action=accept chain=input dst-port=4500 protocol=udp src-address-list=\
UnitedStatesIPs
add action=accept chain=input dst-port=500 protocol=udp src-address-list=\
UnitedStatesIPs
add action=accept chain=input protocol=ipsec-esp src-address-list=\
UnitedStatesIPs
add action=accept chain=input protocol=ipsec-ah src-address-list=\
UnitedStatesIPs
add action=accept chain=input comment="Accept ICMP from Internet" disabled=\
yes protocol=icmp src-address-list=UnitedStatesIPs
add action=drop chain=input comment="Drop invalid connections" \
connection-state=invalid
add action=accept chain=input comment="Accept established,related" \
connection-state=established,related
add action=drop chain=input comment="Drop all from WAN" in-interface=\
ether1-WAN1
add action=drop chain=forward comment="Drop invalid connections" \
connection-state=invalid
add action=accept chain=forward comment="Accept established,related" \
connection-state=established,related
add action=drop chain=forward comment="Drop all from WAN not DSTNATed" \
connection-nat-state=!dstnat connection-state=new in-interface=\
ether1-WAN1
/ip firewall mangle
add action=mark-routing chain=prerouting comment=WAN2 new-routing-mark=WAN2 \
passthrough=no src-address-list=IPs_WAN2
add action=mark-routing chain=prerouting comment=WAN1 new-routing-mark=WAN1 \
passthrough=no src-address-list=IPs_WAN1
add action=passthrough chain=forward comment="IP TV BSMNT" dst-address=\
192.168.70.108
add action=passthrough chain=forward comment="IP TV LIVING" dst-address=\
192.168.70.109
add action=passthrough chain=forward comment=UniFi dst-address=192.168.60.101
add action=mark-routing chain=prerouting comment="HTTP Traffic" dst-port=80 \
new-routing-mark="HTTP traffic" passthrough=no protocol=tcp
add action=mark-routing chain=prerouting comment="SSL Traffic" dst-port=443 \
new-routing-mark="SSL traffic" passthrough=no protocol=tcp
add action=mark-routing chain=prerouting comment="UNKNOWN Traffic" \
new-routing-mark="Unknown traffic" passthrough=no
/ip firewall nat
add action=masquerade chain=srcnat comment="WAN1 Masquerade" out-interface=\
ether1-WAN1
add action=masquerade chain=srcnat comment="WAN2 Masquerade" out-interface=\
ether2-WAN2
add action=dst-nat chain=dstnat comment=HairPin_NAT_UniFi_Controller \
dst-address=!192.168.60.0/24 dst-address-type=local dst-port=8282 \
protocol=tcp to-addresses=192.168.60.101 to-ports=8282
add action=dst-nat chain=dstnat comment=HairPin_NAT_Exchange_Server \
dst-address=!192.168.60.0/24 dst-address-type=local dst-port=443 \
protocol=tcp to-addresses=192.168.60.100 to-ports=443
add action=masquerade chain=srcnat comment=HairPin_NAT_from_70_to_60_subnet \
dst-address=192.168.60.0/24 out-interface=ether3-LAN1 packet-mark="" \
src-address=192.168.70.0/24
add action=masquerade chain=srcnat comment=HairPin_NAT_from_70_to_70_subnet \
disabled=yes dst-address=192.168.70.0/24 out-interface=ether3-LAN1 \
packet-mark="" src-address=192.168.70.0/24
add action=dst-nat chain=dstnat comment=HairPin_NAT_NVR disabled=yes \
dst-address=!192.168.70.0/24 dst-address-type=local dst-port=1234 \
protocol=tcp to-addresses=192.168.70.200 to-ports=1234
add action=dst-nat chain=dstnat comment=HairPin_NAT_NVR2 disabled=yes \
dst-address=!192.168.70.0/24 dst-address-type=local dst-port=1234 \
protocol=tcp to-addresses=192.168.70.200 to-ports=10554
add action=dst-nat chain=dstnat comment=mail_smtp dst-port=25 in-interface=\
ether1-WAN1 protocol=tcp src-address-list=--------- to-addresses=\
192.168.60.100 to-ports=25
add action=dst-nat chain=dstnat comment=mail_pop3 dst-port=110 in-interface=\
ether1-WAN1 protocol=tcp src-address-list=--------- to-addresses=\
192.168.60.100 to-ports=110
add action=dst-nat chain=dstnat comment=ftp_server dst-port=20-21 \
in-interface=ether1-WAN1 protocol=tcp src-address-list=UnitedStatesIPs \
to-addresses=192.168.60.102 to-ports=20-21
add action=dst-nat chain=dstnat comment=mail_https dst-port=443 in-interface=\
ether1-WAN1 protocol=tcp src-address-list=UnitedStatesIPs to-addresses=\
192.168.60.100 to-ports=443
add action=dst-nat chain=dstnat comment=unifi_portal_http dst-port=1234 \
in-interface=ether1-WAN1 protocol=tcp src-address-list=UnitedStatesIPs \
to-addresses=192.168.60.101 to-ports=1234
add action=dst-nat chain=dstnat comment=unifi_portal_https dst-port=1234 \
in-interface=ether1-WAN1 protocol=tcp src-address-list="" to-addresses=\
192.168.60.101 to-ports=1234
add action=dst-nat chain=dstnat comment=unifi_db dst-port=1234 in-interface=\
ether1-WAN1 protocol=tcp src-address-list=UnitedStatesIPs to-addresses=\
192.168.60.101 to-ports=1234
add action=dst-nat chain=dstnat comment=unifi_http dst-port=1234 \
in-interface=ether1-WAN1 protocol=tcp to-addresses=192.168.60.101 \
to-ports=1234
add action=dst-nat chain=dstnat comment=unifi_https dst-port=1234 \
in-interface=ether1-WAN1 protocol=tcp src-address-list=UnitedStatesIPs \
to-addresses=192.168.60.101 to-ports=1234
add action=dst-nat chain=dstnat comment=unifi_stun dst-port=1234 \
in-interface=ether1-WAN1 protocol=udp src-address-list=UnitedStatesIPs \
to-addresses=192.168.60.101 to-ports=1234
add action=dst-nat chain=dstnat comment=nvr_web disabled=yes dst-port=1234 \
in-interface=ether1-WAN1 protocol=tcp to-addresses=192.168.70.200 \
to-ports=1234
add action=dst-nat chain=dstnat comment=nvr_server disabled=yes dst-port=1234 \
in-interface=ether1-WAN1 protocol=tcp to-addresses=192.168.70.200 \
to-ports=1234
add action=dst-nat chain=dstnat comment=nvr_rtsp disabled=yes dst-port=1234 \
in-interface=ether1-WAN1 protocol=tcp to-addresses=192.168.70.200 \
to-ports=1234
add action=dst-nat chain=dstnat comment=Blue_Iris dst-port=1234 in-interface=\
ether1-WAN1 protocol=tcp src-address-list=UnitedStatesIPs to-addresses=\
192.168.60.106 to-ports=1234
add action=dst-nat chain=dstnat comment=Milestone_server2 disabled=yes \
dst-port=8082 in-interface=ether1-WAN1 protocol=tcp src-address-list=\
UnitedStatesIPs to-addresses=192.168.60.103 to-ports=1234
add action=dst-nat chain=dstnat comment=FreePBX disabled=yes dst-port=1234 \
in-interface=ether1-WAN1 protocol=tcp to-addresses=192.168.60.106 \
to-ports=5000
add action=dst-nat chain=dstnat disabled=yes dst-port=5001 in-interface=\
ether1-WAN1 protocol=tcp to-addresses=192.168.60.106 to-ports=5001
add action=dst-nat chain=dstnat disabled=yes dst-port=5060 in-interface=\
ether1-WAN1 protocol=tcp src-port="" to-addresses=192.168.60.106 \
to-ports=5060
add action=dst-nat chain=dstnat disabled=yes dst-port=5065 in-interface=\
ether1-WAN1 protocol=tcp src-port="" to-addresses=192.168.70.126 \
to-ports=5065
add action=dst-nat chain=dstnat disabled=yes dst-port=5090 in-interface=\
ether1-WAN1 protocol=udp src-port="" to-addresses=192.168.60.106 \
to-ports=5090
add action=dst-nat chain=dstnat disabled=yes dst-port=5090 in-interface=\
ether1-WAN1 protocol=tcp src-port="" to-addresses=192.168.60.106 \
to-ports=5090
add action=dst-nat chain=dstnat disabled=yes dst-port=5060 in-interface=\
ether1-WAN1 protocol=udp src-port="" to-addresses=192.168.60.106 \
to-ports=5060
add action=dst-nat chain=dstnat disabled=yes dst-port=9000-9500 in-interface=\
ether1-WAN1 protocol=udp to-addresses=192.168.60.106 to-ports=9000-9500
/ip firewall service-port
set sip disabled=yes
/ip ipsec peer
add address=0.0.0.0/0 exchange-mode=main-l2tp generate-policy=port-override \
passive=yes profile=profile_1
/ip route
/ip upnp
set show-dummy-rule=no
/ppp secret
add name=l2tpuser profile=L2TPVPN_PROFILE service=l2tp
add name=pptpuser profile=PPTPVPN_PROFILE service=pptp
/system clock
set time-zone-name=America/New_York
/system logging
add action=microSD topics=critical
add action=microSD topics=error
add action=microSD topics=info
add action=microSD topics=warning
add action=microSD topics=system
/system ntp client
set enabled=yes primary-ntp=216.239.35.0
/system resource irq rps
set ether1-WAN1 disabled=no
set ether2-WAN2 disabled=no
set ether3-LAN1 disabled=no
set ether4-LAN2 disabled=no
set ether5-LAN3 disabled=no
/system scheduler
/system script
-------------------------------
/tool e-mail
set address=192.168.60.100 from=<------------>
/tool netwatch
add disabled=yes host=4.2.2.4
(FYI: RB750Gr3 uses MT7621 switch chip which doens’t support hardware offloading for vlan filtering: https://wiki.mikrotik.com/wiki/Manual:Switch_Chip_Features#Bridge_Hardware_Offloading .
So, in my view your issue is just normal routing issue and I don’t see any FastTrack being enabled and connection tracking is enabled.
anav
December 24, 2018, 3:13am
7
Hi Sebastia, I thought if one had only one bridge HW offloading did work??
Correct, but it also depends on functions used. Some of these bridge functions can be done in hardware (as listed on wiki) and others can be only achieved by software.
Kindis
December 24, 2018, 7:34am
9
I don’t think this is a VLAN issue. My guess is that if you look at profile when you would see that firewall holds the CPU.
add action=fasttrack-connection chain=forward comment="Fasttracking connections" connection-state=established,related
You could also improve your rules and you have a lot of NAT and different rules that puts a lot of load on the CPU. My guess is that fasttrack will improve the performance a lot as I use to have a 750Gr3 and I could push around 850 Mbit through the device (routing) with VLAN and firewall rules.
This is my guess at least
Jotne
December 24, 2018, 11:35am
10
I do not have fast track on a 750Gr3 and are able to transfer 250Mbps. OP does only get 23Mbps,so its not only fast track.
Thank you guys for trying to help me to figure it out, I cant bring that network down right now to test the bridge theory but I want to clarify something, I did a little more testing (copied few files) and it looks like I’m actually limited to around 400 Mbits when copying single file from NAS in vlan 70 to file server in vlan 60. In vlan 70 copying from NAS1 to NAS2 I see full gig speed. When I was testing it originally I was copying files from NAS1 to NAS2 (both in vlan 70) through file server in vlan 60 and thats why i was getting only half of 400 Mbits which is around 23-25 Megabytes. My thing is that Im using only 1 ether port for all vlans so I dont exactly understand why bridge would improve speed (as one of you guys pointed out). Is it possible that simply CPU is not able to do that speed?
thanks
chris
I enabled fast track and now im getting around 90 megabytes, which I can leave with that I guess. Any other suggestions? thanks
FYI: you’re hitting the hardware limitations with that, see block diagram
If you in profile see “networkning” hogging the CPU the you need to have a look at VLAN implementation and so on.