so - I gave up and configured the connection between 2 Frtizboxes according to https://avm.de/service/vpn/praxis-tipps/vpn-verbindung-zwischen-zwei-fritzboxen-fuer-einzelne-lan-anschluesse-einrichten/ it has advantage, that the "weak" wifi-link is not being used. Speed is now around 4Mbit ...

so, it worked - but still slow :( I tested from ping from routerA to public IP of routerB and it turns out there is about 20-25% packet loss over wifi :( sent=20 received=15 packet-loss=25% min-rtt=17ms avg-rtt=201ms max-rtt=882ms sent=26 received=20 packet-loss=23% min-rtt=17ms avg-rtt=216ms max-rt...

replace 0.0.0.0/0 in the src-address of the policy on Router A by 0.0.0.0/1.

huhu!! it worked

What does the log say at the same time on Router B? 12:25:49 ipsec,info,account peer authorized: 192.168.178.23[4500]-92.117.xx.yyy[4500] spi:c0ed8b0caab3c720:3e5c98fcd461edb4 12:25:49 ipsec,info killing ike2 SA: 192.168.178.23[4500]-92.117.xx.yyy[4500] spi:c0ed8b0caab3c720:3e5c98fcd461edb4 12:25:5...

after At Router A, add a mirror policy, but not as a template: /ip ipsec policy add dst-address=192.168.77.0/24 group=ike2-gre peer=xxx8 proposal=ike2-gre src-address=0.0.0.0/0 level=unique tunnel=yes IPSEC tunnel is getting killed and the error message in log: ipsec,error responder selectors does n...

Routing the traffic from device B to internet via Router A using an L3 tunnel is simple. could you please elaborate ? I think this is all I need. I don't understand this idea at all. The DHCP client broadcasts the DHCPDISCOVER request... Sorry I was not clear - the DHCP Server does not have to be o...

so, I tried with MTU 1500 everywhere, on Router A /interface print Flags: D - dynamic, X - disabled, R - running, S - slave # NAME TYPE ACTUAL-MTU L2MTU MAX-L2MTU MAC-ADDRESS 0 ether1 ether 1500 1598 2028 E4:8D:8C: 1 RS ether2 ether 1500 1598 2028 E4:8D:8C: 2 S ether3 ether 1500 1598 2028 E4:8D:8C: ...

yes, the are bridges... so I ran the sniffing with MTU 1290 und 1000 und get quite a lot Fragments, e.g. with MTU 1280: frag_mtu1280.png Length of 1290 is OK, I guess ? (for MTU 1000 it was 1010) Do I need to set MTU 1280 on the bridges as well and maybe somewhere else too? Stats show wrong seq. num...

@sindy thank you for the instructions, I did the sniffing, but it is difficult to make sense - too much packets. I noticed, that like 50% (1467 out of 2946) from the packets have stat_spi.png and the sequence seems always to be 1 off: 39170.png 31846.png and so on... I also realized that I did not m...

yes. <IPofIPSECtunnel> is the private one inside the tunnel on the other side. I tried it with udp and get higher throughput, but lost packets (guess this is OK ?): /tool bandwidth-test 192.168.99.1 duration=10s protocol=udp status: done testing duration: 11s rx-current: 11.4Mbps rx-10-second-averag...

thank you for the reply sindy! both routers are RouterBOARD 941-2nD (hAP lite) packet loss - I don't know, because IPSEC tunnel seems to have the performance I need in both directions. (or the test with "/tool bandwidth-test <IPofIPSECtunnel> duration=10s protocol=tcp" does not prove it ?)...

Hi all, so I have a setup that worked without problems for a few years. About 2 or 3 weeks ago I got a performance problem in one direction over EOIP tunnel. The setup: Router A is connected to Router B (I am on this end) via IPSEC tunnel und there is EOIP over IPSEC tunnel. for performance reasons,...

yes, I think you could activate DDNS
https://wiki.mikrotik.com/wiki/Manual:IP/Cloud
/ip cloud set ddns-enabled=yes
and then use the dns-name instead of static IP