Hello.
I have tested some RB2011 with latest ROS and latest firmware.

It does NAT from one eth (wan eth1) and one eth (lan eth6.
Just plain NAT 1-1 for some about 50 hosts and it is fed via a 100Mbit FD Fiber uplink (eth1)
no VLAN, about 10 firewall rules and nothing else.
no QoS, no queue, just NAT 1-1 .

The performances are a shame.
Even if I use wan eth2 and lan eth2 the CPU usage is very very high.

A download at 100mbit maxes out the cpu.
If i put a RB750GL in an IDENTICAL configuration, the CPU stays about 22%.

I have used both RB2011-RM-UAS and the RB2011i-RM-UAS with no differences. I have replaced RB2011 with RB750GL becuase for NAT, 64mb is not a issue for me and the CPU is a LOT better.

Is there something that I dont know about RB2011?

Have you used the profile tool to finde out what eating up the cpu time? I usually get around 300Mbit/s through a RB2011 when NAT/Connection Tracking/Firewall is enabled. If all that stuff is off and fastpass is possible it can route deal with full 1Gbit/s

@Maggiore81
I don't know what is wrong, but something is definitely not working correct. The RB2011 CPU should be at least 150% the speed of the RB750GL. I also use multiple RB2011's and they can all do 200Mbit with NAT and routing/firewall, etc. At that point they do reach a pretty high CPU usage, but that's ok.

Is your performance actually being limited by the CPU usage? If you use iperf from 2 hosts going through the RB2011, what performance do you achieve?

Can you try resetting the configuration to empty and rebuilding everything?

Hello.

The conf are exactly identical!!!!
I also tried to build them from scratch, onRB750GL and on RB2011-UAS-RM
latest ROS and latest routerboot.

I have never gained any benefit using RB2011.
I have seen high cpu usage on firewall module, using profile tool.

very low usage with RB750GL..

Ok, If you use iperf from 2 hosts going through the RB2011, what performance do you achieve?

Can you try at various steps through building your configuration? Something must be causing this, as said the RB2011 IS at least 1.5x as fast as a RB750GL and in anything I use it with, it performs very well. Up to 200Mbit of internet routing, firewall, DHCP, DNS, NAT, etc. should work no problem, it will max your CPU to 100% so that is about the max with those features enabled.

Please provide bandwidth measurements and results of your tests. What performance with how much CPU usage, doing what, printout of config, etc.

The conf are exactly identical ..cut..

maybe a nonsense, but try to disable the LCD on rb2011 ..

The conf are exactly identical ..cut..

maybe a nonsense, but try to disable the LCD on rb2011 ..

how can I do ?

the packages loaded are:

adv-tools
system
security
routing
ipv6

how can I do ?

not a package, look at the menu item LCD..

I try.
I will let you know,.

The conf are exactly identical ..cut..

maybe a nonsense, but try to disable the LCD on rb2011 ..

The very first test shows interesting results... stay tuned I will post them later

The conf are exactly identical ..cut..

maybe a nonsense, but try to disable the LCD on rb2011 ..

The very first test shows interesting results... stay tuned I will post them later

The problem is definitely the LCD. If I disable them I get very fast speed

Funny, isn't it? Dumb lcd throws down the router's performance. Mabe shared irq or something like that. Report it to support and hope they will fix it.

maybe a nonsense, but try to disable the LCD on rb2011 ..

The very first test shows interesting results... stay tuned I will post them later

The problem is definitely the LCD. If I disable them I get very fast speed

as i told.. a nonsense ..but it works

Have the similar problem with rb2011 - 1Gbps copper connection from ISP, up to 25 simple firewall rules, NAT masquerade and as result only 280-300 Mbps NAT throughput from WAN to LAN with 100% CPU load. Turning off/on LED as metioned above dose nothing.

Any suggestions how to fix it? I was told that the only possible way is to sell rb2011 and buy ubiquiti edge 3 router?

hey where is my post?

hey where is my post?

you posted it in the wrong topic:
http://forum.mikrotik.com/viewtopic.php ... 84#p465484

Have the similar problem with rb2011 - 1Gbps copper connection from ISP, up to 25 simple firewall rules, NAT masquerade and as result only 280-300 Mbps NAT throughput from WAN to LAN with 100% CPU load. Turning off/on LED as metioned above dose nothing.

Any suggestions how to fix it? I was told that the only possible way is to sell rb2011 and buy ubiquiti edge 3 router?

What exactly is the problem? 280-300 Mbps NAT on an RB2011 is quite good and about the max you should expect from such a device.

If you need more performance, buy a faster device from MikroTik. They have one to fit almost any situation! If you need 1Gbps NAT I would recommend getting a small CCR or maybe the 1100AHx2.

You could go to a UBNT Edge router, but it has it's own limitations and problems. So do the research before you do, because it uses hardware acceleration if you use anything outside of it, it's performance will become worse then the RB2011.

What exactly is the problem? 280-300 Mbps NAT on an RB2011 is quite good and about the max you should expect from such a device.

The problem is that I thought that I bought a 1 Gbps routing device but received a 0,3 Gbps crap.
Yes I know that the throughput of the most network devices is lower than advertised. But 3 times lower than advertised is too much. This is unfair and should be noted at the product page.

If you need more performance, buy a faster device from MikroTik. They have one to fit almost any situation! If you need 1Gbps NAT I would recommend getting a small CCR or maybe the 1100AHx2.

Why should I buy a $300-$400 Mikrotik device if on the market exist devices capable of 1Gbps NAT throughput priced below $100?
Also I should say that for $400 I can build a system unit (or buy a used one) install there FreeBSD/OpenBSD or use Pfsense or Untangled or similar and get more functional device than just noisy router.
As far as I know RB1100AHx2 is capable of 1 Gbps NAT at 85% CPU load which is also not very impressive result.

You could go to a UBNT Edge router, but it has it's own limitations and problems. So do the research before you do, because it uses hardware acceleration if you use anything outside of it, it's performance will become worse then the RB2011.

Googled already. Results are acceptable for me especially for the price. http://www.smallnetbuilder.com/lanwan/l ... outer-lite

you posted it in the wrong topic:

Actually my question was about RB2011 but not about RB1100 where you moved my post.

The problem is definitely the LCD. If I disable them I get very fast speed

up to 0.3 Gbps but nothing more

you posted it in the wrong topic:

Actually my question was about RB2011 but not about RB1100 where you moved my post.

The problem is definitely the LCD. If I disable them I get very fast speed

up to 0.3 Gbps but nothing more

I did not move your post. You posted it there youself.

Actually the review is not so much positive. I would rather build or buy small barebone with two independent network cards for around 150 usd and put pfsense on it. Mikrotik definitely should provide devices able to nat 1gbit with some reserve for not more than 100usd.

Maybe this is something I think of as alternative to 1Gbit natting 1100AHx2 or small CCR:
http://www.aliexpress.com/item/2014-NEW ... 34276.html
Ok, it is without memory and HDD. But for 180USD you can get it all:
http://www.aliexpress.com/item/2014-new ... 73603.html

and it is multipurpose computer usable for whatever job you will assign to it.

Unfortunatelly I have not tried it yet but I am really thinking of it.

There are many interesting devices that could be better and cheaper than original mikrotik ones. Some of them are even labeled with Mikrotik stickers:
http://www.aliexpress.com/item/Intel-c1 ... 34449.html

But on the other hand, using original mikrotik devices gives you the support that you whould not have in case you buy something like this.

normis,

What about the user's actual problem? I can also confirm this exists.

What exactly is the problem? 280-300 Mbps NAT on an RB2011 is quite good and about the max you should expect from such a device.

The problem is that I thought that I bought a 1 Gbps routing device but received a 0,3 Gbps crap.
Yes I know that the throughput of the most network devices is lower than advertised. But 3 times lower than advertised is too much. This is unfair and should be noted at the product page.

I'm sorry but I do not agree with this statement. This device does exactly (and often more) then is stated on the product page. You are confusing routing performance with NAT. A Mikrotik device is very diverse in what it can do and depending on what features you are planning to use you need to select the appropriate model.

If you know anything about Mikrotik/Routerboard/RouterOS devices then you know it does not use hardware acceleration as a choice. The choice is to either be constricted by hardware features and get (cheap) fast performance, or enable a lot of features and use CPU performance.

The competing ubiquiti device you have linked chooses to use hardware NAT which results in very fast NAT performance, but if you wish to do anything with that traffic that is not supported by the hardware, it will fall out of hardware NAT mode and it actually becomes slower then the RB2011. So again, it all depends on your needs and feature set you require. For a simple home router it should do well. Then again, a RB2011 does also, unless you have a 1Gbps connection (Jealous! )

In this case I believe you have failed to do the proper research and bought a device on assumptions with too little knowledge to back it up. It's not fair to blame the maker of the device. I do hope that you will give Mikrotik another chance, but now properly selected. The RB2011 can still be useful for a lot of other stuff so it's never a waste.

I can also confirm there is a noticeable drop in CPU if the LCD is disabled.

i would say LCD eats around 5-7% from the CPU. usually i just turn it off.

I did not move your post. You posted it there youself.

Uh oh sorry, Could you move my message and answers to my message here please.

You are confusing routing performance with NAT.

RB2011 is positioned as a SOHO router. For such devices NAT performance is one of the key features. If NATing is not the part of the routing then what is it? A SFP port looks especially crappy on such low performace device.

you can do routing without any NAT

you can do routing without any NAT

I can access to the Internet without router at all and what? Firewall and NAT are basic functionality used to connect small LAN to the Internet safely so providing product info in sly way at the product page is the nothing more than unfair advertising. It won't help gain you more returning customers guys.

The device can do more than just NAT. It can do bridging, switching, routing, and also NAT.
As you can see in the table, which is on the bottom of this page, the average speed for routing with some firewall or NAT rules is 300-400Mbit for average size packets: http://routerboard.com/RB2011UiAS-2HnD-IN

Just that a device has 1GBit ports doesn't mean that this is the speed you will get in any configuration.

if you get less than 300, we could look at your config. email it to support@mikrotik.com

The device can do more than just NAT. It can do bridging, switching, routing, and also NAT.

I repeat in SOHO segment NAT throughput is the main feature and you know it. Yeah the functionality is great and even unnesesarily exsessive for SOHO but CPU is too slow or the software is unoptimised.

As you can see in the table, which is on the bottom of this page, the average speed for routing with some firewall or NAT rules is 300-400Mbit for average size packets: http://routerboard.com/RB2011UiAS-2HnD-IN

Standard packet size in most cases is around 1500 bits so I expected at least 698.0 Mbps router throughput as stated in lowest line of the table.

Just that a device has 1GBit ports doesn't mean that this is the speed you will get in any configuration.

It should show at least 0.7-0.8 Gbps NAT througput if it named a Gigabit router for SOHO.

speedtest.net uses TCP connection and not the large packet. you should do the test with UDP Torrent traffic if you want to see the 1500 packet result

speedtest.net uses TCP connection and not the large packet. you should do the test with UDP Torrent traffic if you want to see the 1500 packet result

To use torrent is also not that accurate. Better use iperf. It can test TCP,UDP and all kind of packet sizes with multiple dataflows. BTW i love the 2011. performance is in an expected area for the used CPU. i Just would like to see at least 1 more SFP port.

Better use iperf.

iperf+nat+1Gbps+rb2011=0.3Gbs crap

Better use iperf.

iperf+nat+1Gbps+rb2011=0.3Gbs crap

test through the router? from where to where, and if posible, please post the settings, so we can see the packet size and protocol

Better use iperf.

iperf+nat+1Gbps+rb2011=0.3Gbs crap

NAT is a CPU hungry task. What have you expected from the CPU build in the 2011? You can't but a scooter and expect racing car speed.

@Mikrotik i would like to see the option to turn off NAT , Firewall and Connectiontracking for forwarded traffic while still have firewall rules in the INPUT Q to protect the router. So i don't have to leave the mgmt ports ( https,ssh ) open while getting the full forwarding speed. At the moment we work with access restriction for the mgmt services but the ports are still open.

I would say that if you do not use srcnat or dstnat rules, the nat is off. Generally no rules in nat means no nat.

You can use forward, input, output chain or your custom chain rules independently from having or not having nat.

If you do not want any forwarding rules, it is better to turn ports from routing mode to switching mode and take care just about input chain.

Hope I am not wrong.

Better use iperf.

iperf+nat+1Gbps+rb2011=0.3Gbs crap

If you do not wish to understand, that is fine, but please stop blaming the product for your lack of knowledge or investigating. If you are just going to throw advice and explanations into the wind, don't bother.

Routerboard is quite clear about performance on their website, more so then many other companies will ever show you. Also this forum is full of examples of people using it and posting about their achieved performance. I myself maintain a topic about the RB2011 where certain performance figures are very clearly stated so I know this information is out there.

It takes a small man to make a mistake, it takes a bigger man to admit he made one, learn from it and better himself. Be the bigger man. It still sucks that you then have a device which can't meet your needs, but you can learn from it, learn RouterOS (It has the same features on all of their devices, big or small, one of it's strengths) and take a look at all it's features and possibilities. If it's not what you need, or doesn't work the way you want (or expected) fine, sell it and buy something else.

I would say that if you do not use srcnat or dstnat rules, the nat is off. Generally no rules in nat means no nat.

You can use forward, input, output chain or your custom chain rules independently from having or not having nat.

If you do not want any forwarding rules, it is better to turn ports from routing mode to switching mode and take care just about input chain.

Hope I am not wrong.

once something in the firewall is on fastpath is off, even if there are only firewallrules in the INPUT chain. only with fastpath on forwarding traffic is really fast.

If you do not wish to understand, that is fine, but please stop blaming the product for your lack of knowledge or investigating.

From now at the every computer forum I ever registered I will reveal that MIKROTIK ARE SLY LIERS and their products sucks.

Routerboard is quite clear about performance on their website

Dont make me laugh. Quite clear the TP-LINK are in describing their products. An example: http://www.tp-link.com/lk/products/deta ... R6120#spec

If you do not wish to understand, that is fine, but please stop blaming the product for your lack of knowledge or investigating.

From now at the every computer forum I ever registered I will reveal that MIKROTIK ARE SLY LIERS and their products sucks.

Routerboard is quite clear about performance on their website

Dont make me laugh. Quite clear the TP-LINK are in describing their products. An example: http://www.tp-link.com/lk/products/deta ... R6120#spec

Ok, so why then don't they list their routing speed and capabilities? Can you switch the 2 LAN ports? What is the forwarding rate between the Gigabit ports and as what can you configure them anyway? Where is the block diagram showing the linked ports and performance of those links? Or any supported routing protocols for that matter (oh wait, it supports RIP, wow!). It can do 60000 concurrent sessions (Not great, not horrible either), but what is it's packet forwarding rate? :S

This device costs twice as much for about the same performance (At least with NAT, the rest is not listed anywhere), less ports, and well really any advantage whatsoever? It's feature set seems to be a fraction of what RouterOS can do. If you are going to compare the RB2011 to some other device, please do so with at least a vaguely similar feature set. The Ubiquiti Edgerouter is a good example of that, which I mentioned earlier.

Also, VPN performance with 3DES, who uses that anymore anyway? I would want to bet it's even slower in AES256 then the RB2011 is.

Anyway, this discussion (or ranting from your side) grows tiring very quickly. Go buy some off the shelf home TP-Link with Hardware NAT and 5% of the features the Routerboard has. I use them too when I need something dirt cheap and a simple home setup. It's what you are looking for it seems, which is fine if that is your usage case. Just don't be a little child in admitting you did not do the correct research or are lacking in knowledge. We all where at some point.

This will be my last message in this topic. If you do decide to stay and learn, maybe even buy a Routerboard with the performance you need, I look forward to your helpful contributions to the forums in the future! If not, good luck to you the same.

Normis the RB2011 is being offered as a default router for some ISPs that offer symmetrical gigabit fibre optic connections even though it is not capable of gigabit NAT such as in sweden and it is causing more people to avoid mikrotik because of written articles. How about making a newer version of the RB2011 with a good dual core MIPS CPU? Something inexpensive that ISPs can offer.

The mindset around is that mikrotik is slow at NAT because of all these articles and old products still being used in high performance environments.

The ubiquiti edgerouter lite uses a dual core MIPS with hardware acceleration which does line rate NAT only costing $70-$80. I wouldnt mind a dual core MIPS with hardware acceleration routerboard that costs $150 if it had SFP, miniPCIe and some gigabit ports and the performance. The LCD panel could be present on slightly more expansive variants? Would also like to suggest looking at supporting IP phones via the standard rj11 to allow plugging in any phone to an ISP that has an SIP gateway, it doesnt have to physically be present on the device, just supported via usb, miniPCIe or even through rj11 to rj45 converters.