The last weeks I have had very bad WIFI in our apartment. I have an MikroTik Cloud Router model: CRS125-24G-1S-2HnD and I’m still learning how it should be setup. All our family members using the WIFI have the same experience that it’s almost useless to use WIFI at the moment.
When using my Samsung S7 phone via WIFI (SSID: WIFI ABCDEF_2G) I get about 0.33 Mbit/s down and 0.01 Mbit/s up, but when using the same phone over 4G/LTE connection I 92.18 Mbit/s down and 12.42 Mbit/s up. Also, when using the router with threaded connections it’s performs very well.
I’ll attach my router configuration, so you experienced users can have a look and point me in the right direction where to look to solve this frustrating issue?
# jan/22/2018 20:33:37 by RouterOS 6.42rc11
# software id = I415-ZLXP
# model = CRS125-24G-1S-2HnD
/interface bridge
add fast-forward=no name=EXT
add admin-mac=1C:3B:6B:1D:08:21 auto-mac=no fast-forward=no name=bridge
/interface wireless
set [ find default-name=wlan1 ] band=2ghz-b/g/n channel-width=20/40mhz-Ce \
comment="WIFI ABCDEF_2G" disabled=no distance=indoors frequency=auto \
mode=ap-bridge ssid=ABCDEF1_2GHz wireless-protocol=802.11 wps-mode=\
disabled
/interface ethernet
set [ find default-name=ether1 ] comment="BBB WAN"
set [ find default-name=ether2 ] name=ether2-master
set [ find default-name=ether11 ] comment="External IP to TV-Box"
/interface wireless manual-tx-power-table
set wlan1 comment="WIFI ABCDEF_2G"
/interface wireless nstreme
set wlan1 comment="WIFI ABCDEF_2G"
/interface list
add name=mactel
add name=mac-winbox
add exclude=dynamic name=discover
add name=WAN
/interface wireless security-profiles
set [ find default=yes ] authentication-types=wpa2-psk eap-methods="" mode=\
dynamic-keys supplicant-identity=MikroTik wpa-pre-shared-key=\
ABCDEFABCDEF wpa2-pre-shared-key=ABCDEFABCDEF
add authentication-types=wpa2-psk eap-methods="" mode=dynamic-keys name=\
profile supplicant-identity=MikroTik wpa-pre-shared-key=xxxxxxxxx \
wpa2-pre-shared-key=xxxxxxxx
/interface wireless
add comment="GUEST WIFI" disabled=no mac-address=61:3B:6B:71:08:39 \
master-interface=wlan1 name=wlan2 security-profile=profile ssid=\
ABCDEF_GUEST wps-mode=disabled
/interface wireless manual-tx-power-table
set wlan2 comment="GUEST WIFI"
/interface wireless nstreme
set wlan2 comment="GUEST WIFI"
/ip pool
add name=dhcp ranges=192.168.10.10-192.168.10.199
add name=vpn ranges=192.168.89.2-192.168.89.255
add name=OpenVPN ranges=192.168.20.2-192.168.20.255
/ip dhcp-server
add address-pool=dhcp authoritative=after-2sec-delay disabled=no interface=\
bridge name=defconf
/ppp profile
set *FFFFFFFE bridge=bridge local-address=192.168.89.1 remote-address=vpn
/snmp community
set [ find default=yes ] addresses=0.0.0.0/0
/system logging action
set 0 memory-lines=100
set 1 disk-lines-per-file=100
/caps-man manager
set ca-certificate=auto certificate=auto
/interface bridge filter
add action=accept chain=forward disabled=yes in-bridge=bridge in-interface=\
ether1 out-bridge=bridge out-interface=ether11
add action=drop chain=forward in-interface=wlan2
add action=drop chain=forward out-interface=wlan2
/interface bridge port
add bridge=bridge comment=defconf interface=ether2-master
add bridge=bridge comment=defconf hw=no interface=wlan1
add bridge=bridge hw=no interface=wlan2
add bridge=bridge interface=ether3
add bridge=bridge interface=ether4
add bridge=bridge interface=ether5
add bridge=bridge interface=ether6
add bridge=bridge interface=ether7
add bridge=bridge interface=ether8
add bridge=bridge interface=ether9
add bridge=bridge interface=ether10
add bridge=bridge interface=ether11
add bridge=bridge interface=ether12
add bridge=bridge interface=ether13
add bridge=bridge interface=ether14
add bridge=bridge interface=ether15
add bridge=bridge interface=ether16
add bridge=bridge interface=ether17
add bridge=bridge interface=ether18
add bridge=bridge interface=ether19
add bridge=bridge interface=ether20
add bridge=bridge interface=ether21
add bridge=bridge interface=ether22
add bridge=bridge interface=ether23
add bridge=bridge interface=ether24
add bridge=bridge interface=sfp1
/ip neighbor discovery-settings
set discover-interface-list=discover
/ip settings
set rp-filter=strict
/interface ethernet switch multicast-fdb
add ports=ether11
/interface l2tp-server server
set enabled=yes ipsec-secret=ABCDEFABCDEF use-ipsec=yes
/interface list member
add interface=ether2-master list=mactel
add interface=wlan1 list=mactel
add interface=ether2-master list=mac-winbox
add interface=wlan2 list=mactel
add interface=wlan1 list=mac-winbox
add interface=wlan2 list=mac-winbox
add interface=wlan1 list=discover
add interface=ether2-master list=discover
add interface=ether3 list=discover
add interface=ether4 list=discover
add interface=ether5 list=discover
add interface=ether6 list=discover
add interface=ether7 list=discover
add interface=ether8 list=discover
add interface=ether9 list=discover
add interface=ether10 list=discover
add interface=ether11 list=discover
add interface=ether12 list=discover
add interface=ether13 list=discover
add interface=ether14 list=discover
add interface=ether15 list=discover
add interface=ether16 list=discover
add interface=ether17 list=discover
add interface=ether18 list=discover
add interface=ether19 list=discover
add interface=ether20 list=discover
add interface=ether21 list=discover
add interface=ether22 list=discover
add interface=ether23 list=discover
add interface=ether24 list=discover
add interface=sfp1 list=discover
add interface=bridge list=discover
add interface=wlan2 list=discover
add interface=EXT list=discover
add interface=bridge list=WAN
/interface pptp-server server
set enabled=yes
/interface sstp-server server
set default-profile=default-encryption enabled=yes
/interface wireless access-list
add comment="Daniel Mobil" mac-address=4C:66:41:48:A1:12
add comment="Adina Mobil" mac-address=E8:50:8B:04:F3:1F
add comment="Adina Laptop" mac-address=7C:D1:C3:E9:E2:47
add comment="Chromebook 1" mac-address=AC:89:95:DB:5A:C5
add comment="Maria Mobil" mac-address=AC:5F:3E:26:C9:97
add comment=CC-Music mac-address=54:60:09:EA:D4:4A
add comment="Andr\E9 Mobil" mac-address=D4:61:2E:93:63:69
add comment=CC-Sovrum mac-address=6C:AD:F8:A4:33:19
add mac-address=B8:EE:65:F0:FD:CB
add mac-address=48:51:B7:61:1D:6D
add mac-address=1C:AF:05:77:D6:95
add mac-address=F4:F5:D8:DC:C5:92
add mac-address=44:85:00:CB:17:DB
add mac-address=28:56:5A:A0:0B:06
add mac-address=50:C7:BF:59:F5:A6
add mac-address=B8:27:EB:E6:97:32
add mac-address=6C:AD:F8:D0:0F:69
add mac-address=54:60:09:5C:AE:30
add mac-address=E4:58:B8:5E:81:DF
/ip address
add address=192.168.10.1/24 comment=defconf interface=ether2-master network=\
192.168.10.0
/ip cloud
set ddns-enabled=yes
/ip dhcp-client
add comment=defconf dhcp-options=hostname,clientid disabled=no interface=\
ether1
/ip dhcp-server lease
add address=192.168.10.253 always-broadcast=yes client-id=1:4c:66:41:48:a1:12 \
mac-address=4C:66:41:48:A1:12 server=defconf
add address=192.168.10.125 client-id=1:48:51:b7:61:1d:6d mac-address=\
48:51:B7:61:1D:6D server=defconf
add address=192.168.10.117 client-id=1:f0:1f:af:3:2b:51 mac-address=\
F0:1F:AF:03:2B:51 server=defconf
add address=192.168.10.136 client-id=1:b8:ac:6f:b0:5:3f mac-address=\
B8:AC:6F:B0:05:3F server=defconf
add address=192.168.10.113 mac-address=54:60:09:EA:D4:4A server=defconf
add address=192.168.10.104 always-broadcast=yes client-id=1:ac:5f:3e:26:c9:97 \
mac-address=AC:5F:3E:26:C9:97 server=defconf
add address=192.168.10.106 always-broadcast=yes mac-address=6C:AD:F8:A4:33:19 \
server=defconf
add address=192.168.10.11 always-broadcast=yes mac-address=D4:61:2E:93:63:69 \
server=defconf
add address=192.168.10.14 always-broadcast=yes comment="IOT-IKEA Gateway" \
mac-address=B0:72:BF:27:86:D5 server=defconf
add address=192.168.10.13 mac-address=F4:F5:D8:DC:C5:92 server=defconf
add address=192.168.10.15 mac-address=A4:77:33:6D:38:B2 server=defconf
add address=192.168.10.227 client-id=1:70:8b:cd:ab:ec:fd mac-address=\
70:8B:CD:AB:EC:FD server=defconf
add address=192.168.10.17 mac-address=00:17:88:2B:01:71 server=defconf
add address=192.168.10.18 client-id=1:44:85:0:cb:17:db mac-address=\
44:85:00:CB:17:DB server=defconf
add address=192.168.10.19 mac-address=B4:A5:EF:E7:51:8D server=defconf
add address=192.168.10.16 mac-address=B8:27:EB:9C:9C:25 server=defconf
add address=192.168.10.10 client-id=1:30:7:4d:8d:2c:9a mac-address=\
30:07:4D:8D:2C:9A server=defconf
add address=192.168.10.22 mac-address=28:56:5A:A0:0B:06 server=defconf
add address=192.168.10.20 client-id=1:b8:27:eb:e6:97:32 mac-address=\
B8:27:EB:E6:97:32 server=defconf
add address=192.168.10.12 always-broadcast=yes mac-address=6C:AD:F8:D0:0F:69 \
server=defconf
add address=192.168.10.26 client-id=1:f0:9f:c2:1d:b:5 mac-address=\
F0:9F:C2:1D:0B:05 server=defconf
add address=192.168.10.27 always-broadcast=yes mac-address=E4:F0:42:48:CF:B2 \
server=defconf
add address=192.168.10.28 always-broadcast=yes mac-address=48:D6:D5:E1:21:29 \
server=defconf
add address=192.168.10.24 always-broadcast=yes mac-address=54:60:09:5C:AE:30 \
server=defconf
add address=192.168.10.32 client-id=ff:90:12:ef:98:0:3:0:1:30:58:90:12:ef:98 \
mac-address=30:58:90:12:EF:98 server=defconf
add address=192.168.10.25 client-id=1:0:7:5f:7a:f8:e8 mac-address=\
00:07:5F:7A:F8:E8 server=defconf
add address=192.168.10.31 client-id=1:2c:54:91:57:49:c3 mac-address=\
2C:54:91:57:49:C3 server=defconf
/ip dhcp-server network
add address=192.168.10.0/24 comment=defconf gateway=192.168.10.1 netmask=24
/ip dns
set allow-remote-requests=yes servers=\
8.8.8.8,195.54.122.200,8.8.4.4,195.54.122.204
/ip dns static
add address=192.168.10.1 name=router
add address=8.8.8.8 name="Google DNS 1"
add address=8.8.4.4 name="Google DNS 2"
add address=192.168.10.16 disabled=yes name=www.abcdefg.duckdns.org
add address=192.168.10.16 name=abcdefg.duckdns.org
/ip firewall address-list
add address=192.168.10.0/24 list=PrivateIPs
add address=192.168.10.0/24 list=support
add address=0.0.0.0/8 comment="Self-Identification [RFC 3330]" list=bogons
add address=10.0.0.0/8 comment="Private[RFC 1918] - CLASS A # Check if you nee\
d this subnet before enable it" list=bogons
add address=127.0.0.0/8 comment="Loopback [RFC 3330]" list=bogons
add address=169.254.0.0/16 comment="Link Local [RFC 3330]" list=bogons
add address=172.16.0.0/12 comment="Private[RFC 1918] - CLASS B # Check if you \
need this subnet before enable it" list=bogons
add address=192.168.0.0/16 comment="Private[RFC 1918] - CLASS C # Check if you\
\_need this subnet before enable it" list=bogons
add address=192.0.2.0/24 comment="Reserved - IANA - TestNet1" list=bogons
add address=192.88.99.0/24 comment="6to4 Relay Anycast [RFC 3068]" list=\
bogons
add address=198.18.0.0/15 comment="NIDB Testing" list=bogons
add address=198.51.100.0/24 comment="Reserved - IANA - TestNet2" list=bogons
add address=203.0.113.0/24 comment="Reserved - IANA - TestNet3" list=bogons
/ip firewall filter
add action=fasttrack-connection chain=forward comment=FastTrack \
connection-state=established,related disabled=yes
add action=accept chain=forward connection-nat-state=srcnat,dstnat \
in-interface=ether1 in-interface-list=all out-interface-list=all \
protocol=igmp
add action=accept chain=input comment="allow IPsec NAT" dst-port=4500 \
protocol=udp
add action=accept chain=input comment=HomeAssitandWebLogin dst-port=8123 \
protocol=tcp
add action=accept chain=input comment="allow IKE" dst-port=500 log=yes \
log-prefix=VPN protocol=udp
add action=accept chain=input comment="allow l2tp" dst-port=1701 protocol=udp
add action=accept chain=input comment="allow pptp" dst-port=1723 log=yes \
log-prefix=VPN protocol=tcp
add action=accept chain=input comment="allow sstp" dst-port=443 protocol=tcp
add action=accept chain=input protocol=ipsec-esp
add action=accept chain=input protocol=ipsec-ah
add action=accept chain=input comment="Allow ICMP" protocol=icmp
add action=accept chain=input in-interface=!ether1 src-address=\
192.168.10.0/24
add action=drop chain=input comment="Drop Invalid connections" \
connection-state=invalid
add action=accept chain=input comment="Allow Established connections" \
connection-state=established
add action=accept chain=forward in-interface=bridge out-interface=bridge
/ip firewall nat
add action=masquerade chain=srcnat comment="defconf: masquerade" \
out-interface=ether1
add action=masquerade chain=srcnat comment="masq. vpn traffic" src-address=\
192.168.89.0/24
add action=dst-nat chain=dstnat dst-port=8123 in-interface=ether1 log=yes \
log-prefix=HomeAssistantWebLogin protocol=tcp to-addresses=192.168.10.16 \
to-ports=8123
/ip firewall service-port
set ftp disabled=yes
set tftp disabled=yes
set irc disabled=yes
set sip disabled=yes
/ip service
set telnet disabled=yes
set ftp disabled=yes
set www address=192.168.10.0/24 disabled=yes
set ssh disabled=yes
set winbox address=192.168.10.0/24
set api-ssl disabled=yes
/ip smb
set allow-guests=no comment=Router domain=WORKGROUP
/ip ssh
set strong-crypto=yes
/ip upnp
set show-dummy-rule=no
/ip upnp interfaces
add interface=bridge type=internal
add interface=ether1 type=external
/ppp secret
add name=vpn password=ABCDEFABCDEF
/routing igmp-proxy interface
add alternative-subnets=1.2.3.0/24,2.3.4.0/24 interface=ether1 upstream=yes
add interface=ether11
/routing igmp-proxy mfc
add downstream-interfaces=ether11 group=224.10.10.11 source=192.168.10.1 \
upstream-interface=wlan1
/routing pim bsr-candidates
add disabled=yes interface=ether11
/routing pim interface
add disabled=yes interface=ether11
/routing pim rp-candidates
add interface=ether11
/snmp
set enabled=yes location=HOME trap-version=3
/system clock
set time-zone-name=Europe/Stockholm
/system identity
set name=Router
/system leds
set 0 disabled=yes
set 1 disabled=yes
/system logging
set 0 disabled=yes
set 3 action=disk
add action=disk topics=ipsec
add action=disk topics=account
/system note
set note="ABCDEF Network Architecture - Authorized administrators only. Acces\
s to this device is monitored."
/system ntp client
set enabled=yes primary-ntp=79.138.40.123 secondary-ntp=62.209.166.40 \
server-dns-names=\
0.se.pool.ntp.org,1.se.pool.ntp.org,2.se.pool.ntp.org,3.se.pool.ntp.org
/system package update
set channel=release-candidate
/system scheduler
add interval=13m name=Update_DDNS on-event=Update_DDNS policy=\
ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon \
start-time=startup
add interval=12h name=Update_RouterOS on-event=Auto_Update_RouterOS policy=\
ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon \
start-date=mar/23/2017 start-time=03:00:00
add interval=1w name=Send_ConfigFile_email on-event=Send_ConfigFile_email \
policy=ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon \
start-date=mar/26/2017 start-time=02:00:00
add interval=10m name=RUN_UPDATE_DUCK_DNS on-event=UPDATE_DUCK_DNS policy=\
ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon \
start-date=jan/09/2018 start-time=15:00:00
/system script
add name=Update_DDNS owner=admin policy=\
ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon source="#\
\_ This script will update a ChangeIP.com dynamic dns hostname\r\
\n:local ddnsuser \"daniel.abcd@gmail.com\"\r\
\n:local ddnspass \"ABCDEFABCDEF\"\r\
\n:local ddnshost \"abcdefg.ddns.info\"\r\
\n:local ddnsinterface \"ether1\"\r\
\n\r\
\n:global ddnslastip\r\
\n:global ddnsip [ /ip address get [find interface=\$ddnsinterface disable\
d=no] address ]\r\
\n:if ([ :typeof \$ddnslastip ] = nil ) do={ :global ddnslastip 0.0.0.0/0 \
}\r\
\n\r\
\n:if ([ :typeof \$ddnsip ] = nil ) do={\r\
\n:log info (\"DDNS: No ip address present on \" . \$ddnsinterface . \", p\
lease check.\") } else={\r\
\n:if (\$ddnsip != \$ddnslastip) do={\r\
\n:log info \"DDNS: Sending UPDATE!\"\r\
\n:log info [ /tool dns-update name=\$ddnshost address=[:pick \$ddnsip 0 [\
:find \$ddnsip \"/\"] ] key-name=\$ddnsuser key=\$ddnspass ]\r\
\n:global ddnslastip \$ddnsip } else={\r\
\n:log info \"DDNS: No change\" }\r\
\n}"
add name=Send_ConfigFile_email owner=admin policy=read,write,test source="/sys\
tem backup save name=email_backup\r\
\n/tool e-mail send file=email_backup.backup to=\"abcdefg@gmail.com\" bo\
dy=\"See attached backup file\" subject=\"\$[/system identity get name] \$\
[/system clock get time] \$[/system clock get date] RouterOS Backup\")\r\
\n"
add name=Auto_Update_RouterOS owner=admin policy=\
ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon source="/\
system package update\r\
\ncheck-for-updates once\r\
\n:delay 1s;\r\
\n:if ( [get status] = \"New version is available\") do={ install }"
add name=UPDATE_DUCK_DNS owner=admin policy=\
ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon source=":\
global actualIP value=[/ip address get [find where interface=ether1] value\
-name=address];\r\
\n:global actualIP value=[:pick \$actualIP -1 [:find \$actualIP \"/\" -1] \
];\r\
\n:if ([:len [/file find where name=ipstore.txt]] < 1 ) do={\r\
\n /file print file=ipstore.txt where name=ipstore.txt;\r\
\n /delay delay-time=2;\r\
\n /file set ipstore.txt contents=\"0.0.0.0\";\r\
\n};\r\
\n:global previousIP value=[/file get [find where name=ipstore.txt ] value\
-name=contents];\r\
\n:if (\$previousIP != \$actualIP) do={\r\
\n :log info message=(\"Try to Update DuckDNS with actual IP \".\$actualIP\
.\" - Previous IP are \".\$previousIP);\r\
\n /tool fetch mode=https keep-result=yes dst-path=duckdns-result.txt addr\
ess=[:resolve www.duckdns.org] port=443 host=www.duckdns.org src-path=(\"/\
update\?domains=abcdefg&token=17300a3e-5686-4bc0-a82a-eab0f73825f4&ip=\"\
.\$actualIP);\r\
\n /delay delay-time=5;\r\
\n :global lastChange value=[/file get [find where name=duckdns-result.txt\
\_] value-name=contents];\r\
\n :global previousIP value=\$actualIP;\r\
\n /file set ipstore.txt contents=\$actualIP;\r\
\n :if (\$lastChange = \"OK\") do={:log warning message=(\"DuckDNS update \
successfull with IP \".\$actualIP);};\r\
\n :if (\$lastChange = \"KO\") do={:log error message=(\"Fail to update Du\
ckDNS with new IP \".\$actualIP);};\r\
\n};"
/system watchdog
set auto-send-supout=yes send-email-to=abcdefg@gmail.com watch-address=\
8.8.8.8
/tool e-mail
set address=74.125.127.109 from=RouterOS@abcdefg.ddns.info password=\
123241241244 port=587 start-tls=yes user=abcdef.abcd@gmail.com
/tool graphing interface
add interface=bridge
add interface=wlan1
add interface=sfp1
/tool mac-server
set allowed-interface-list=mactel
/tool mac-server mac-winbox
set allowed-interface-list=mac-winbox
/tool sniffer
set file-limit=10000KiB file-name=NetScan.pcap filter-interface=ether1
/tool traffic-monitor
add interface=ether1 name=MON_Received threshold=0 traffic=received
add interface=ether1 name=MON_TRANSMITTED threshold=0
