I have a 5g ZTE modem with 2 LAN ports. I have connected to an old routerboard i have (951G), if i connect my laptop via LAN to the ZTE modem i can get 700Mbps, if i connect to the mikrotik only 70.
I have tried to hard reset the router and it does not make a difference.
On the modem then lan port settings are: MTU 1358, MSS 1318
if anyone could give some advice i would appreciate it.
ok - so if i dont use masquerade and just add the port to the bridge and use the same ip range i can get 800Mbps downloads, so it is something happening after, i use the masquerade function.
I see the screenshot and that says it is at 1GbE, but what about the other ports? Your original config had all the ports at 100M, and if you changed ether4 to GbE, but left the other ports at 100M, when you test from your laptop you’re still passing traffic through a 100M port and getting it throttled.
This is what you had before for ether4, but all your ports were set to 100M in the original config dump.
all my ports are the same as the screenshot, and i did not change any settings.
i reset it again and here is the export;
however i have the same issue when i use masquerade. if i just add the port to the bridge - then i get the full speed. but this is not an ideal solution for me.
# nov/19/2021 16:40:24 by RouterOS 6.49.1
# software id = J3TZ-KVGS
#
# model = 951G-2HnD
# serial number =
/interface bridge
add admin-mac=D4:CA:6D:EB:CC:4D auto-mac=no comment=defconf name=bridge
/interface wireless
set [ find default-name=wlan1 ] band=2ghz-b/g/n channel-width=20/40mhz-XX \
disabled=no distance=indoors frequency=auto installation=indoor mode=\
ap-bridge ssid=MikroTik-EBCC51 wireless-protocol=802.11
/interface list
add comment=defconf name=WAN
add comment=defconf name=LAN
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
/ip pool
add name=default-dhcp ranges=192.168.88.10-192.168.88.254
/ip dhcp-server
add address-pool=default-dhcp disabled=no interface=bridge name=defconf
/interface bridge port
add bridge=bridge comment=defconf interface=ether2
add bridge=bridge comment=defconf interface=ether3
add bridge=bridge comment=defconf disabled=yes interface=ether4
add bridge=bridge comment=defconf interface=ether5
add bridge=bridge comment=defconf interface=wlan1
/ip neighbor discovery-settings
set discover-interface-list=LAN
/interface list member
add comment=defconf interface=bridge list=LAN
add comment=defconf interface=ether1 list=WAN
/ip address
add address=192.168.88.1/24 comment=defconf interface=bridge network=\
192.168.88.0
/ip dhcp-client
add comment=defconf disabled=no interface=ether4
/ip dhcp-server network
add address=192.168.88.0/24 comment=defconf dns-server=192.168.88.1 gateway=\
192.168.88.1
/ip dns
set allow-remote-requests=yes
/ip dns static
add address=192.168.88.1 comment=defconf name=router.lan
/ip firewall filter
add action=accept chain=input comment=\
"defconf: accept established,related,untracked" connection-state=\
established,related,untracked disabled=yes
add action=drop chain=input comment="defconf: drop invalid" connection-state=\
invalid disabled=yes
add action=accept chain=input comment="defconf: accept ICMP" disabled=yes \
protocol=icmp
add action=accept chain=input comment=\
"defconf: accept to local loopback (for CAPsMAN)" disabled=yes dst-address=\
127.0.0.1
add action=drop chain=input comment="defconf: drop all not coming from LAN" \
disabled=yes in-interface-list=!LAN
add action=accept chain=forward comment="defconf: accept in ipsec policy" \
disabled=yes ipsec-policy=in,ipsec
add action=accept chain=forward comment="defconf: accept out ipsec policy" \
disabled=yes ipsec-policy=out,ipsec
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" \
connection-state=established,related disabled=yes
add action=accept chain=forward comment=\
"defconf: accept established,related, untracked" connection-state=\
established,related,untracked disabled=yes
add action=drop chain=forward comment="defconf: drop invalid" connection-state=\
invalid disabled=yes
add action=drop chain=forward comment="defconf: drop all from WAN not DSTNATed" \
connection-nat-state=!dstnat connection-state=new disabled=yes \
in-interface-list=WAN
/ip firewall nat
add action=masquerade chain=srcnat comment="defconf: masquerade" ipsec-policy=\
out,none out-interface=ether4
/system clock
set time-zone-name=Asia/Riyadh
/tool mac-server
set allowed-interface-list=LAN
/tool mac-server mac-winbox
set allowed-interface-list=LAN
And yet it has to be searched in that domain (I could be wrong but I’d like to be sure).
70M is in the range of what can be reached on a 100M link.
The fact you get 700M when directly connected, should then correspond to 1G.
And link is to be defined as end to end. The slowest part is what will define the complete speed.
Can you provide this
interface/ethernet/print detail
You’re note showing your complete config on that last part.
There is no ethernet anymore ?
Oops, I missed your previous replies about the masquerade.
Since you did full reset, can you drop full config again ?
/export hide-sensitive file=anynameyouwish
RB951G is a great device … for when it was concieved. Its CPU is weak for today’s standards. Official test results indicate it’s capable of routing at around 240 Mbps. However, you configured VLANs on bridge which all by itself reduces bridging capacity from wirespeed to one third. Throw in CPU-bound wireless and throughput drops further. Not saying that one should multiply all effects, but they are all clear signs that you won’t be able to squeeze much more juice out of it. No chance of getting anywhere near 700 Mbps anyway.
BTW, device has a very decent switch chip built in and if device is not used as simple router on a stick (i.e. it’s also switching traffic within VLAN between different ports), you could get better performance if you configured stuff on switch-chip directly.
Two minor things:
No need to reduce l2mtu on ether4, setting mtu to value ZTE is using is enough.
ether2 is set with pvid=20 and yet it’s set as tagged member of same vlan
understood regarding the limitations of the device. To be fair it was an old unit that has been sat in my toolbox unused for a number of years, i guess it is time to retire it
