I have a RB750Gr3 located with some servers and I use it as a VPN to get in to the network. At some point a few weeks ago the upload from the VPN slowed to 180 Mbps or 22.5 MB/s. Data in the other direction and data in both directions to the other servers is gigabit and works fine. The CPU isn’t maxed out and the status pages show that it’s connected at gigabit speed in both directions so I am assuming the cable is good.
So, as an example, if I download a file from one of the servers it downloads at near gigabit speeds. If I download the same file from the same server, but connected through the VPN, it is slow. If I upload it’s full speed either way.
Any thoughts on what the problem might be or how to test further?
# 2023-12-04 14:21:18 by RouterOS 7.12.1
# software id = xxx
#
# model = RB750Gr3
# serial number = XXX
/interface bridge
add admin-mac=XXX auto-mac=no comment=defconf name=bridge
/interface l2tp-server
add name=VPN user=XXX
/interface list
add comment=defconf name=WAN
add comment=defconf name=LAN
/interface lte apn
set [ find default=yes ] ip-type=ipv4 use-network-apn=no
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
/ip ipsec profile
set [ find default=yes ] dh-group=modp1024 dpd-interval=disable-dpd enc-algorithm=aes-128
/ip ipsec proposal
set [ find default=yes ] auth-algorithms=sha256,sha1 enc-algorithms=aes-256-cbc,aes-128-cbc lifetime=6h
/ip pool
add name=dhcp ranges=10.0.2.2-10.0.2.254
add name="VPN Pool" ranges=10.0.3.0/24
/ip dhcp-server
add address-pool=dhcp interface=bridge lease-time=10m name=defconf
/ipv6 pool
add name=ipv6-pool prefix=XXX::/56 prefix-length=64
/port
set 0 name=serial0
/ppp profile
add bridge=bridge local-address="VPN Pool" name=VPN remote-address="VPN Pool"
/routing bgp template
set default disabled=no output.network=bgp-networks
/routing ospf instance
add disabled=no name=default-v2
add disabled=no name=default-v3 version=3
/routing ospf area
add disabled=yes instance=default-v2 name=backbone-v2
add disabled=yes instance=default-v3 name=backbone-v3
/interface bridge port
add bridge=bridge comment=defconf ingress-filtering=no interface=ether2
add bridge=bridge comment=defconf ingress-filtering=no interface=ether3
add bridge=bridge comment=defconf ingress-filtering=no interface=ether4
add bridge=bridge comment=defconf ingress-filtering=no interface=ether5
/ip neighbor discovery-settings
set discover-interface-list=LAN
/ipv6 settings
set accept-router-advertisements=yes max-neighbor-entries=8192
/interface l2tp-server server
set default-profile=VPN enabled=yes use-ipsec=yes
/interface list member
add comment=defconf interface=bridge list=LAN
add comment=defconf interface=ether1 list=WAN
/interface ovpn-server server
set auth=sha1,md5
/ip address
add address=10.0.2.1/24 comment=defconf interface=bridge network=10.0.2.0
add address=xx/26 interface=ether1 network=XX
/ip cloud
set ddns-enabled=yes
/ip dhcp-client
add comment=defconf disabled=yes interface=ether1
/ip dhcp-server network
add address=10.0.2.0/24 comment=defconf dns-server=1.1.1.1,8.8.8.8 gateway=10.0.2.1 netmask=24
/ip dns
set allow-remote-requests=yes servers=8.8.8.8,1.1.1.1
/ip dns static
add address=10.0.2.1 comment=defconf name=router.lan
/ip firewall filter
add action=accept chain=input comment="defconf: accept established,related,untracked" connection-state=established,related,untracked
add action=accept chain=input in-interface=ether1 protocol=ipsec-esp
add action=accept chain=input dst-port=500,1701,4500 in-interface=ether1 protocol=udp
add action=accept chain=input dst-port=80 in-interface=all-ppp protocol=tcp
add action=drop chain=input comment="defconf: drop invalid" connection-state=invalid
add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp
add action=accept chain=input comment="defconf: accept to local loopback (for CAPsMAN)" dst-address=127.0.0.1
add action=drop chain=input comment="defconf: drop all not coming from LAN" in-interface-list=!LAN
add action=accept chain=forward comment="defconf: accept in ipsec policy" ipsec-policy=in,ipsec
add action=accept chain=forward comment="defconf: accept out ipsec policy" ipsec-policy=out,ipsec
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" connection-state=established,related hw-offload=yes
add action=accept chain=forward comment="defconf: accept established,related, untracked" connection-state=established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" connection-state=invalid
add action=drop chain=forward comment="defconf: drop all from WAN not DSTNATed" connection-nat-state=!dstnat connection-state=new in-interface-list=WAN
/ip firewall nat
add action=masquerade chain=srcnat comment="defconf: masquerade" ipsec-policy=out,none out-interface-list=WAN
/ip route
add disabled=no dst-address=0.0.0.0/0 gateway=xx
/ip service
set telnet disabled=yes
set ftp disabled=yes
set ssh disabled=yes
set api disabled=yes
set winbox disabled=yes
set api-ssl disabled=yes
/ipv6 address
add address=::1 from-pool=ipv6-pool interface=bridge
/ipv6 nd
set [ find default=yes ] managed-address-configuration=yes other-configuration=yes
/ppp secret
add name=XXXprofile=VPN
/routing bfd configuration
add disabled=no interfaces=all min-rx=200ms min-tx=200ms multiplier=5
/system clock
set time-zone-name=America/Denver
/system identity
set name=VPN
/system note
set show-at-login=no
/tool mac-server
set allowed-interface-list=LAN
/tool mac-server mac-winbox
set allowed-interface-list=LAN