ultra Slow Upload, Download fast

lametta · April 25, 2025, 1:14pm

Hi,
I’m using a RB5009UG+S+ with 7.18. also tried 7.19beta (7.13 and 7.15).
My ISP provides a 300/100 up connection. for two weeks now my uploads stall at about 5 to 10MB/s. Download is fine.

I changed cables,
tried different routerOs Versions.
Ports negotiate fine at 1gbit.
deactivated firewall
test setup is just one cable to the modem, and one to a mac, no switches etc…

I’ve also reseted several times and problem persists. I just added some caps but the slow upload also appears using wifi. I’ve changed my modem, etc… It’s not a problem on the ISP side.
Using a very old 50€ TPLink router with standard settings I get around 100MB/s upload all the time.

any idea what to try next?
lamConf.rsc (8.24 KB)

baragoon · April 25, 2025, 1:56pm

Hi,
Do you know the difference between megabits (Mbps) and megabytes (MB)?

Amm0 · April 25, 2025, 2:12pm

Is there a reason you’re setting MTU of 1460 on ether1 / WAN? Unless you know something, it likely should be 1500 (or you may need a PPPoE connection, or other things from your ISP than just a lower MTU).

lametta · April 25, 2025, 6:10pm

Hi,

Yes definitely know the difference. sorry for confusing, but your comment is useless.

My ISP grants me about 100 Mbps Upload, and I reach 5-10. I get full upload speed (70 to 95 Mbps) with the cheap TP router.
Setting different MTU was a test, I am now back to 1500 with no luck.

My Router is set to DHCP and gets a static IP from the ISP (no PPoE)

Amm0 · April 25, 2025, 6:24pm

I’d make sure reboot both router and test machine after MTU changes, and make sure the “BIOS”/firmware in /system/routerboard matches the current RouterOS version. This mismatch speeds screamed “MTU problem”, that has to be right — so your “guessing” I’m not sure was helpful.

Can you post the current test case/results?

And also the current config to make sure we’re looking at some config as your test. Ideally just cut-and-paste the text, rather than attachment.

jspool · April 25, 2025, 6:31pm

The 2.5G port can be problematic sometimes. For a test try removing eth2 from bridge and set eth2 up as WAN, update interface list and dhcp-client to eth2 and retest. You can also play with flow control and see if it has any impact.

baragoon · April 27, 2025, 8:22am

How and with what did you test?

lametta · April 28, 2025, 9:10am

Hi,

Thanks for all your replies. I’m testing speed with various websites, and I see extremely poor upload to Dropbox and my other servers.

I moved the WAN to ether 8. Still no luck. upload is uiltraslow. I tried different flowcontrol settings, disabled firewall etc…

here is my current setup:

/interface bridge
add admin-mac=D4:01:C3:55:87:39 auto-mac=no comment=defconf name=bridge
/interface ethernet
set [ find default-name=ether1 ] advertise=“10M-baseT-half,10M-baseT-full,100M
-baseT-half,100M-baseT-full,1G-baseT-half,1G-baseT-full” comment=INTERNET
mtu=1500 rx-flow-control=auto tx-flow-control=auto
set [ find default-name=ether2 ] mtu=1500 rx-flow-control=auto
tx-flow-control=auto
set [ find default-name=ether8 ] rx-flow-control=auto tx-flow-control=auto
/caps-man interface
add comment=LamettaCapsMan disabled=no mac-address=00:00:00:00:00:00
master-interface=none name=cap1 radio-mac=00:00:00:00:00:00 radio-name=“”
/caps-man datapath
add bridge=bridge name=datapath1
/caps-man security
add authentication-types=wpa2-psk name=security1
/caps-man configuration
add comment=“LamettaCAP Standard” country=austria datapath=datapath1
distance=indoors installation=indoor mode=ap name=LamettaCAP_2GHZ_Conf
security=security1 ssid=LamettaWeb_2Ghz
/interface list
add comment=defconf name=WAN
add comment=defconf name=LAN
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
/ip pool
add name=dhcp ranges=192.168.0.2-192.168.0.254
/ip dhcp-server
add address-pool=dhcp interface=bridge name=defconf
/caps-man manager
set enabled=yes
/caps-man provisioning
add action=create-dynamic-enabled master-configuration=LamettaCAP_2GHZ_Conf
/certificate settings
set builtin-trust-anchors=not-trusted
/disk settings
set auto-media-interface=bridge auto-media-sharing=yes auto-smb-sharing=yes
/interface bridge port
add bridge=bridge interface=ether1
add bridge=bridge comment=defconf interface=ether2
add bridge=bridge comment=defconf interface=ether3
add bridge=bridge comment=defconf interface=ether4
add bridge=bridge comment=defconf interface=ether5
add bridge=bridge comment=defconf interface=ether6
add bridge=bridge comment=defconf interface=ether7
add bridge=bridge comment=defconf interface=sfp-sfpplus1
/ip neighbor discovery-settings
set discover-interface-list=LAN
/ipv6 settings
set disable-ipv6=yes
/interface list member
add comment=defconf interface=bridge list=LAN
add comment=defconf interface=ether8 list=WAN
/interface wifi cap
set caps-man-addresses=“” discovery-interfaces=bridge enabled=yes
/interface wifi capsman
set enabled=yes package-path=“” require-peer-certificate=no upgrade-policy=
none
/ip address
add address=192.168.0.81/24 comment=defconf interface=bridge network=
192.168.0.0
/ip dhcp-client
add comment=defconf interface=ether8
/ip dhcp-server lease
add address=192.168.0.11 comment=“Hue Bridge Studio C” mac-address=
00:17:88:63:59:CD server=defconf
add address=192.168.0.6 client-id=1:0:30:48:c2:e1:b2 mac-address=
00:30:48:C2:E1:B2 server=defconf
add address=192.168.0.35 client-id=1:b8:ae:ed:7f:f2:bb mac-address=
B8:AE:ED:7F:F2:BB server=defconf
add address=192.168.0.33 client-id=1:b0:c5:54:5f:19:6b mac-address=
B0:C5:54:5F:19:6B server=defconf
add address=192.168.0.28 client-id=1:b0:c5:54:5e:c1:e5 mac-address=
B0:C5:54:5E:C1:E5 server=defconf
add address=192.168.0.32 client-id=1:b0:c5:54:5f:52:97 mac-address=
B0:C5:54:5F:52:97 server=defconf
/ip dhcp-server network
add address=192.168.0.0/24 comment=defconf dns-server=192.168.0.81 gateway=
192.168.0.81 netmask=24
/ip dns
set allow-remote-requests=yes
/ip dns static
add address=192.168.0.81 comment=defconf name=router.lan type=A

/ip firewall filter
add action=accept chain=input comment=
“defconf: accept established,related,untracked” connection-state=
established,related,untracked
add action=drop chain=input comment=“defconf: drop invalid” connection-state=
invalid
add action=accept chain=input comment=“defconf: accept ICMP” protocol=icmp
add action=accept chain=input comment=
“defconf: accept to local loopback (for CAPsMAN)” dst-address=127.0.0.1
add action=drop chain=input comment=“defconf: drop all not coming from LAN”
in-interface-list=!LAN
add action=accept chain=forward comment=“defconf: accept in ipsec policy”
ipsec-policy=in,ipsec
add action=accept chain=forward comment=“defconf: accept out ipsec policy”
ipsec-policy=out,ipsec
add action=fasttrack-connection chain=forward comment=“defconf: fasttrack”
connection-state=established,related hw-offload=yes
add action=accept chain=forward comment=
“defconf: accept established,related, untracked” connection-state=
established,related,untracked
add action=drop chain=forward comment=“defconf: drop invalid”
connection-state=invalid
add action=drop chain=forward comment=
“defconf: drop all from WAN not DSTNATed” connection-nat-state=!dstnat
connection-state=new in-interface-list=WAN
/ip firewall nat
add action=masquerade chain=srcnat comment=“defconf: masquerade”
ipsec-policy=out,none out-interface-list=WAN
/ipv6 firewall address-list
add address=::/128 comment=“defconf: unspecified address” list=bad_ipv6
add address=::1/128 comment=“defconf: lo” list=bad_ipv6
add address=fec0::/10 comment=“defconf: site-local” list=bad_ipv6
add address=::ffff:0.0.0.0/96 comment=“defconf: ipv4-mapped” list=bad_ipv6
add address=::/96 comment=“defconf: ipv4 compat” list=bad_ipv6
add address=100::/64 comment="defconf: discard only " list=bad_ipv6
add address=2001:db8::/32 comment=“defconf: documentation” list=bad_ipv6
add address=2001:10::/28 comment=“defconf: ORCHID” list=bad_ipv6
add address=3ffe::/16 comment=“defconf: 6bone” list=bad_ipv6
/ipv6 firewall filter
add action=accept chain=input comment=
“defconf: accept established,related,untracked” connection-state=
established,related,untracked
add action=drop chain=input comment=“defconf: drop invalid” connection-state=
invalid
add action=accept chain=input comment=“defconf: accept ICMPv6” protocol=
icmpv6
add action=accept chain=input comment=“defconf: accept UDP traceroute”
dst-port=33434-33534 protocol=udp
add action=accept chain=input comment=
“defconf: accept DHCPv6-Client prefix delegation.” dst-port=546 protocol=
udp src-address=fe80::/10
add action=accept chain=input comment=“defconf: accept IKE” dst-port=500,4500
protocol=udp
add action=accept chain=input comment=“defconf: accept ipsec AH” protocol=
ipsec-ah
add action=accept chain=input comment=“defconf: accept ipsec ESP” protocol=
ipsec-esp
add action=accept chain=input comment=
“defconf: accept all that matches ipsec policy” ipsec-policy=in,ipsec
add action=drop chain=input comment=
“defconf: drop everything else not coming from LAN” in-interface-list=
!LAN
add action=fasttrack-connection chain=forward comment=“defconf: fasttrack6”
connection-state=established,related
add action=accept chain=forward comment=
“defconf: accept established,related,untracked” connection-state=
established,related,untracked
add action=drop chain=forward comment=“defconf: drop invalid”
connection-state=invalid
add action=drop chain=forward comment=
“defconf: drop packets with bad src ipv6” src-address-list=bad_ipv6
add action=drop chain=forward comment=
“defconf: drop packets with bad dst ipv6” dst-address-list=bad_ipv6
add action=drop chain=forward comment=“defconf: rfc4890 drop hop-limit=1”
hop-limit=equal:1 protocol=icmpv6
add action=accept chain=forward comment=“defconf: accept ICMPv6” protocol=
icmpv6
add action=accept chain=forward comment=“defconf: accept HIP” protocol=139
add action=accept chain=forward comment=“defconf: accept IKE” dst-port=
500,4500 protocol=udp
add action=accept chain=forward comment=“defconf: accept ipsec AH” protocol=
ipsec-ah
add action=accept chain=forward comment=“defconf: accept ipsec ESP” protocol=
ipsec-esp
add action=accept chain=forward comment=
“defconf: accept all that matches ipsec policy” ipsec-policy=in,ipsec
add action=drop chain=forward comment=
“defconf: drop everything else not coming from LAN” in-interface-list=
!LAN
/system clock
set time-zone-name=Europe/Vienna
/system identity
set name=MikroTik_ROUTER_FIREWALL
/tool mac-server
set allowed-interface-list=LAN
/tool mac-server mac-winbox
set allowed-interface-list=LAN

Larsa · April 28, 2025, 10:01am

Do you get the same result with Google’s speed test (just Google “internet speed test”) when you’re plugged directly into an Ethernet port?

lametta · April 28, 2025, 10:04am

Yes, I just tried.

Using an old Netgear N300 Router with standard settings I Immediately get 50-80Mbits upload. Changing back to the Mikrotik - (also plugged directly to the mac) I read 5 to 10mbits/s

EDIT: and I see the same when I observe my uploads to Dropbox, my Nextcloud Server or a simple ftp connection.

and I already went through all the port speed testing…hooked up the modem via a gbits switch to the mikrotik, etc. but this shouldnt be the problem, since ports are negotiating fine. and If there would be any cap to 100mbits the download wouldn’t go up that high (up to 500mbit/s at night).

infabo · April 28, 2025, 1:23pm

Why did you enable wifi capsman and wifi cap mode?

/interface wifi cap
set caps-man-addresses="" discovery-interfaces=bridge enabled=yes
/interface wifi capsman
set enabled=yes package-path="" require-peer-certificate=no upgrade-policy=\
none

Both should be disabled. You have no wifi config. And having wifi/cap enabled makes no sense at all (never) on this device.

Then, why all these non-default settings on ethernet interfaces?

/interface ethernet
set [ find default-name=ether1 ] advertise="10M-baseT-half,10M-baseT-full,100M\
-baseT-half,100M-baseT-full,1G-baseT-half,1G-baseT-full" comment=INTERNET \
mtu=1500 rx-flow-control=auto tx-flow-control=auto
set [ find default-name=ether2 ] mtu=1500 rx-flow-control=auto \
tx-flow-control=auto
set [ find default-name=ether8 ] rx-flow-control=auto tx-flow-control=auto
/caps-man interface

Please try the default and don’t play with flow control and/or advertising. see https://help.mikrotik.com/docs/spaces/ROS/pages/8323191/Ethernet

Amm0 · April 28, 2025, 4:33pm

Yet I have no idea why CAPsMAN be involved in slow wan speed.

And OP new config is pretty default, MTU is 1500 now. So something wierd, but it doesn’t look like a config error.

Maybe try not using auto-negotiate on ether8 and set the ethernet speed manually – but that my only guess.

Is the cable the same used in other router test, and/or does the cable show any error in ether8 stats?

infabo · April 29, 2025, 6:59am

flow control auto is not the default. and nobody knows what implications it has, when cap mode is enabled. And even if it is not the cause - it is still garbage config that should be removed.

rplant · April 30, 2025, 3:26am

You could try adding a queue to the WAN ethernet port, so it tries to keep it inside 100M upload limit.

Something like:

/queue type
add kind=cake name=cake-up

/queue tree
add bucket-size=0.01 max-limit=100M name=qOut packet-mark=no-mark parent=ether1 queue=cake-up

(should ether1 be ether8?)
Also, perhaps bucket-size could be smaller eg 0.005 or less (smaller makes cpu work harder)

edit: probably also worth a bit of trial and error with the max-limit value to see what works best, from say 70M to 110M.

Amm0 · April 30, 2025, 4:39am

Now there is a good idea @rplant.

OP - Is the internet via fiber, cable/DOCSIS, or wireless(5Ghz,60Ghz,LTE/5G)? CAKE lets you set that too. If it’s WISP or LTE/5G, it might be just congestion.