Without wireguard it's usually over 700 Mbps and with wireguard only around 50 Mbps. Is it normal or did i set something wrong?
Code: Select all
/interface ethernet
set [ find default-name=ether1 ]
set [ find default-name=ether2 ] advertise="100M-half,100M-full,1000M-half,100\
0M-full,10000M-full,2500M-full,5000M-full" comment=Internet
set [ find default-name=ether3 ] advertise="100M-half,100M-full,1000M-half,100\
0M-full,10000M-full,2500M-full,5000M-full"
set [ find default-name=ether4 ] advertise="100M-half,100M-full,1000M-half,100\
0M-full,10000M-full,2500M-full,5000M-full"
set [ find default-name=ether5 ] advertise="100M-half,100M-full,1000M-half,100\
0M-full,10000M-full,2500M-full,5000M-full"
set [ find default-name=ether6 ] advertise="100M-half,100M-full,1000M-half,100\
0M-full,10000M-full,2500M-full,5000M-full"
set [ find default-name=ether7 ] advertise="100M-half,100M-full,1000M-half,100\
0M-full,10000M-full,2500M-full,5000M-full"
set [ find default-name=ether8 ] advertise=\
1000M-half,1000M-full,10000M-full,2500M-full,5000M-full \
disabled=yes full-duplex=no speed=100Mbps
/interface wireguard
add disabled=yes listen-port=13231 mtu=1420 name=wireguard1
/interface list
add comment=defconf name=WAN
add comment=defconf name=LAN
/routing bgp template
set default disabled=no output.network=bgp-networks
/routing ospf instance
add disabled=no name=default-v2
/routing ospf area
add disabled=yes instance=default-v2 name=backbone-v2
/routing table
add disabled=no fib name=vpn
/interface bridge port
add bridge=bridge comment=defconf ingress-filtering=no interface=ether3
add bridge=bridge comment=defconf ingress-filtering=no interface=ether4
add bridge=bridge comment=defconf ingress-filtering=no interface=ether5
add bridge=bridge comment=defconf ingress-filtering=no interface=ether6
add bridge=bridge comment=defconf ingress-filtering=no interface=ether7
add bridge=bridge comment=defconf ingress-filtering=no interface=ether8
add bridge=bridge comment=defconf ingress-filtering=no interface=sfp1
add bridge=bridge comment=defconf ingress-filtering=no interface=wlan1
/interface list member
add comment=defconf interface=bridge list=LAN
add comment=defconf interface=ether2 list=WAN
add interface=wireguard1 list=WAN
/interface ovpn-server server
set auth=sha1,md5
/interface wireguard peers
add allowed-address=0.0.0.0/0 endpoint-address=''.nordvpn.com \
endpoint-port=51820 interface=wireguard1 persistent-keepalive=25s \
public-key="----"
/ip address
add address=192.168.88.1/24 comment=defconf interface=bridge network=\
192.168.88.0
add address=10.5.0.2 disabled=yes interface=wireguard1 network=10.5.0.0
/ip firewall address-list
add address=192.168.88.0/24 list=local
/ip firewall filter
add action=accept chain=input comment=\
"defconf: accept established,related,untracked" connection-state=\
established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=\
invalid
add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp
add action=accept chain=input comment=\
"defconf: accept to local loopback (for CAPsMAN)" dst-address=127.0.0.1
add action=drop chain=input comment="defconf: drop all not coming from LAN" \
in-interface-list=!LAN
add action=accept chain=forward comment="defconf: accept in ipsec policy" \
ipsec-policy=in,ipsec
add action=accept chain=forward comment="defconf: accept out ipsec policy" \
ipsec-policy=out,ipsec
add action=accept chain=forward connection-mark=under_nordvpn disabled=yes
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" \
connection-state=established,related hw-offload=yes
add action=accept chain=forward comment=\
"defconf: accept established,related, untracked" connection-state=\
established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" \
connection-state=invalid
add action=drop chain=forward comment=\
"defconf: drop all from WAN not DSTNATed" connection-nat-state=!dstnat \
connection-state=new in-interface-list=WAN
add action=accept chain=forward out-interface=wireguard1 src-address=\
192.168.88.0/24
/ip firewall nat
add action=masquerade chain=srcnat comment="defconf: masquerade" \
ipsec-policy=out,none out-interface-list=WAN
add action=masquerade chain=srcnat log=yes log-prefix=wg out-interface=\
wireguard1
add action=masquerade chain=srcnat disabled=yes out-interface=ether2
/ip route
add check-gateway=ping disabled=yes distance=1 dst-address=0.0.0.0/0 gateway=\
10.5.0.2 pref-src=0.0.0.0 routing-table=vpn scope=30 suppress-hw-offload=\
no target-scope=10
add disabled=no distance=1 dst-address=0.0.0.0/0 gateway=wireguard1 pref-src=\
0.0.0.0 routing-table=vpn scope=30 suppress-hw-offload=no target-scope=10
/routing rule
add action=lookup disabled=yes dst-address=192.168.88.0/24 src-address=\
192.168.88.0/24 table=main
add action=lookup disabled=no src-address=192.168.88.0/24 table=vpn
/system clock