RB2011UiAS-2HnD-IN, is Gigabit routing possible?

SquidCannon · Fri Jul 18, 2014 10:10 pm

Just switched from cable to fiber from 50/10 Mbps to 1 Gbps symmetrical.
As I did not have a modem or router with a fiber-optic connection, I purchased a RB2011UiAS-2HnD bundled with a SFP module and patch-cable at the recommendation of the ISP.

The connection from the ISP is on SFP1, the test computer connected to Port 3

- Tested via speedtest.net over several different servers, multiple runs (425 Mbps, 100% CPU load)
- Tested by downloading the BSD DVD release with multiple mirrors (40 to 42 MB/s, 80% to 100% CPU load)

There are 10 Firewall rules, 5 NAT rules, no mangling, no queues
Judging by the CPU load it is either a configuration issue or a hardware limit.

Has anyone successfully done gigabit routing with a RB2011UiAS-2HnD? Any ideas for troubleshooting?
If you require additional information, I'd be happy to provide it.

NicolBolas · Mon Jul 21, 2014 2:13 pm

Hi SquidCannon,

On the RB2011 series, all gigabit ports inclueding SFP1 are on the same switch chip with a single gigabit link to the SoC. It means no more than 1Gbps half duplex can flow through the switch uplink.

The real limit is still on the CPU though. As you may have already seen, reading the specifications (like http://routerboard.com/RB2011UiAS-2HnD-IN), the RB2011 is not capable of sustained gigabit speed when routing and applying a few filters, even on large packets.

When using a RB2011 in typical internet access scenarii (no encryption, simple routing, minimal ACLs), I'd usualy rate it for 300Mbps. For higher speeds, the 1100AHx2 or CCR1009 are far better choices.

Best regards,

marsark · Tue Jul 22, 2014 1:46 am

Hi,

my cable operator boosted my line to the 240/24 Mbps for summer, but sadly I wasn't able to achieve this speed with RB2011.

packet mangle, some shaping and NAT => 174 Mbps

mangling and NAT => 190 Mbps

only NAT => 214 Mbps

In all cases CPU is driven to 100%. Without NAT only with switching I can reach 240 Mbps. But RB2011 CPU seems not to be so powerful to do NAT for such bandwidth.

bajodel · Tue Jul 22, 2014 5:49 am

.. on the same switch chip with a single gigabit link to the SoC. It means no more than 1Gbps half duplex can flow through the switch uplink...,

half duplex? the cpu uplink behave that way on all board ?

onnoossendrijver · Tue Jul 22, 2014 9:34 am

The link is full-duplex, but it your WAN and LAN are on the same switchchip the traffic flows from switchchip to CPU twice.
That way you can reach only 500 mbit/s full-duplex or 1gbit/s half-duplex maximum.

bajodel · Tue Jul 22, 2014 10:10 am

The link is full-duplex, but.. [CUT]..

thanx

SquidCannon · Wed Jul 23, 2014 8:05 pm

Thank you for your answers, I feared as much.
The 1100AHx2 is not an option, as I need a SFP slot, as for the CCR1009, I will try alternative solutions before investing in an additional router.

Tested the router by bridging SFP and port 5, this resulted in much better performance, alas there is no security (also CPU was at 80%).
I will attempt to use my server as a Firewall / Router by adding an additional network card and bridging directly to the server.

Results with bridging:

docmarius · Wed Jul 23, 2014 9:08 pm

Wouldn't a RB260GS used basically as a media converter do a better job connecting to the server?
It offers you a SFP and 5 gigabit ports at wire speed at a fair price.
http://routerboard.com/RB260GS

Quindor · Thu Jul 24, 2014 12:46 am

Thank you for your answers, I feared as much.
The 1100AHx2 is not an option, as I need a SFP slot, as for the CCR1009, I will try alternative solutions before investing in an additional router.

Tested the router by bridging SFP and port 5, this resulted in much better performance, alas there is no security (also CPU was at 80%).
I will attempt to use my server as a Firewall / Router by adding an additional network card and bridging directly to the server.

Results with bridging:

If that is an option for you, it would be even better to switch the two ports together instead of bridging. This will make the RB2011 basically a switch/media converter though.

As stated above, I agree that an RB2011 is a good match for a 200Mbit internet link max. It can do more, but when you add NAT, firewall rules, some mangle stuff, etc. 200Mbit is a good average to stick to.

I have a CCR1009 and it's easilly capble of many times the performance of the RB2011. But if you have a server which you can utilize, maybe you can just run RouterOS on the server? Keeping your RB2011 as a media converter. If the server also has other purposes, it won't work though.

bds1904 · Thu Jul 24, 2014 1:09 am

I run a Core2Duo x86 (2x 2.2GHz cores) w/ routeros and it'll route about 1.6Gb effectivly; even with full firewall, vpn servers with 4-5 clients all the time, mangle rules and traffic shaping. It's a HP SFF system I picked up off ebay for about $45, put a couple PCIe NIC's in ($30) plus a $40 RouterOS licence. Does really good for $115 out the door, full load is about 50w of power.

Is an x86 box an option for you? If not CCR1009 is really the cheapest RouterBoard solution for you.

SquidCannon · Sat Jul 26, 2014 12:59 pm

Using my home server as a router and firewall (webmin package), using an additional NIC. Doing a speed test causes a load of 25% on 2 out 4 cores of the i5-2500 CPU.
As recommended, using the switch function instead of routing, routerboard load is now 1% - 3%.

Spaham · Fri Feb 06, 2015 4:38 pm

Hi !

I just bought and installed a RB2011UiAS-2HnD-IN in my home office config.
My plan was to use it with my gigabit fiber connexion (french "Free" ISP with a freebox in bridge mode).
The idea is to use the RB2011 as a routeur/firewall and set my freebox as a bridge (with the SFP connected to the freebox).
My fiber isn't up yet (I'm currently connected through DSL).

I'm sorry to read what is said here (ie that I won't be able to route to anything faster than 200 or 300 MB/s)

My freebox is supposed to support up to 600 MB/s as a router, and up to 1GB/s as a bridge, and I bought the RB2011UiAS-2HnD-IN in order to reach the higher speeds...

I'm thinking about buying a CCR1009-8G-1S to replace the RB2011, or maybe keeping the RB2011 for the wifi AP.

Could you confirm me that the CCR1009 will be able to handle the 1 gigabits fiber connexion to the max, when setup as a router/firewall with simple filter rules ?

thanks !

Mon Feb 09, 2015 11:32 pm

Yes, it will.

Spaham · Mon Feb 09, 2015 11:34 pm

Yes, it will.

thanks !

peper · Wed Feb 11, 2015 1:44 am

I'm thinking about buying a CCR1009-8G-1S to replace the RB2011, or maybe keeping the RB2011 for the wifi AP.

CCR1009 is good if you can afford it. But there are better access points than RB2011. Especially, if you hope to have high internet speeds over Wi-Fi too. You need smth with 5Ghz and 802.11ac support.

Spaham · Wed Feb 11, 2015 1:51 am

I'm thinking about buying a CCR1009-8G-1S to replace the RB2011, or maybe keeping the RB2011 for the wifi AP.

CCR1009 is good if you can afford it. But there are better access points than RB2011. Especially, if you hope to have high internet speeds over Wi-Fi too. You need smth with 5Ghz and 802.11ac support.

Well the thing is that I already bought the 2011. So I might as well use it. And I don't care much about the wifi speed. It's brazil in my house. I love Ethernet

Thanks for your info, though ! I'll keep that in mind if I start to use wifi heavily !

mlu17 · Wed May 06, 2015 3:04 pm

You need smth with 5Ghz and 802.11ac support.

You really think that? Does your ISP provide you with more than 300 Mbit/s?

Spaham · Wed May 06, 2015 3:47 pm

Absolutely !
I'm now using a mac as a router, and I'm getting around 100-120 megabytes UP and DOWN ! (it's a gigabit connexion)
(yeah Free !)

Wed May 06, 2015 7:06 pm

Nothing is free. Someone is paying for it anyway.

Spaham · Wed May 06, 2015 7:13 pm

Nothing is free. Someone is paying for it anyway.

Free is the name of the ISP

See free.fr
I'm paying around 38€ per month for it.

Fri May 15, 2015 3:07 pm

2011 with new fasttrack feature maybe could be able to get closer to gigabit throughput. Have you tried it?

thebigcow · Sat May 16, 2015 12:46 am

Try turning off the LCD to get a little more performance, those graphs do not come free.

peper · Sat Jul 25, 2015 11:31 pm

You need smth with 5Ghz and 802.11ac support.
You really think that? Does your ISP provide you with more than 300 Mbit/s?

300 Mbit/s is only theoretical maximum of Wi-Fi in 2011x. If fact Wi-Fi speeds are much lower whenever you have more or less realistic usage scenarios with concrete walls, several Wi-Fi devices connected to AP simultaneously and dozen of neighbor 2,5GHz networks competing with your own. And it is not only about internet speeds. Intra LAN speeds are also important. So important, that even though I have dual band Unifi AP AC, when I need maximum speeds (e.g. launch Virtual Machine which VHD is loaded from NAS), gigabit ethernet cable is my choice.

vortex · Sun Jul 26, 2015 12:59 pm

I do 500Mbps at 65% CPU in one direction with fasttrack and NAT if the LAN port is not in a bridge.

gogusrl · Tue Jul 28, 2015 3:55 pm

The problem is that fast-track doesn't work with pppoe connections. I had the same problem and my solution was to build a mini-itx system (i5-2520m 2c4t, 16gb ram), thrown an ESXI on it and some hdds and running RouterOS and a debian for torrents.

Now I'm routing gigabit at 45% cpu load on 1 core and 256 ram with nat, firewall, mangle, vpn, etc.

Did some tests before virtualizing :

static IP, no esxi = 22-25% cpu load (all cores)
pppoe, no esxi = 27-31% cpu load (all cores)
pppoe behind esxi = 32-35% cpu load (all cores)
pppoe behind esxi = 40-45% cpu load (1 core)

deanMKD1 · Wed Jul 29, 2015 2:46 am

I'm thinking about buying a CCR1009-8G-1S to replace the RB2011, or maybe keeping the RB2011 for the wifi AP.

CCR1009 is good if you can afford it. But there are better access points than RB2011. Especially, if you hope to have high internet speeds over Wi-Fi too. You need smth with 5Ghz and 802.11ac support.

What is better then RB2011 for example?

Wed Jul 29, 2015 8:06 am

In which criteria according to which conditions it should be better for you?

peper · Thu Jul 30, 2015 12:55 am

I'm thinking about buying a CCR1009-8G-1S to replace the RB2011, or maybe keeping the RB2011 for the wifi AP.

CCR1009 is good if you can afford it. But there are better access points than RB2011. Especially, if you hope to have high internet speeds over Wi-Fi too. You need smth with 5Ghz and 802.11ac support.
What is better then RB2011 for example?

I'm using UniFi AP/AP AC together with http://routerboard.com/RB2011UiAS-IN. Yes, this means using two separate devices, but Wi-Fi abilities of UniFi APs are much better in comparison to what http://routerboard.com/RB2011UiAS-2HnD-IN can offer. Mikrotik's ceiling AP, added to the product line not long ago, is outdated on arrival while having neither 5GHz, nor AC support. hapAC on the other hand has AC, but not enough ports for me. So, what about combining CCR with some UniFi AP? Other variant is DIY from many of those boards and cases Mtk and partners provide, but I'm not sure about how cost effective is this even in comparison to not cheap UniFi AP AC.

KBV · Thu Jul 30, 2015 7:00 am

5GHz has a narrow application. I'm not sure that the router with the AP 5GHz it right. You can not put RB2011 (or similar device but with a 5GHz) on the ceiling or on the wall in the living room

Really good scheme networks- separate router and a separate AP installed in the proper place.

vortex · Thu Sep 03, 2015 11:55 pm

I do 500Mbps at 65% CPU in one direction with fasttrack and NAT if the LAN port is not in a bridge.

I got rid of the bridge and put everything needing multicast DNS on the gigabit ports under master. I still max out my 500Mbps downlink without slowdown, no need for the port to be alone, just not in bridge.

So now each switch has its own subnet and I route between them.

Tue May 17, 2016 12:04 pm

Note since 6.35, there is fast track support for PPPoE client,

What's new in 6.35 (2016-Apr-14 12:55):

*) pppoe-client - implemented fastpath support;

nsimeonov · Thu Sep 15, 2016 4:00 am

I'm thinking about buying a CCR1009-8G-1S to replace the RB2011, or maybe keeping the RB2011 for the wifi AP.

CCR1009 is good if you can afford it. But there are better access points than RB2011. Especially, if you hope to have high internet speeds over Wi-Fi too. You need smth with 5Ghz and 802.11ac support.

I just upgraded my internet and got the same problem with RB2011, so I am looking to replace it with CCR1009, but I'll need a wifi too. What will you recommend?

MartijnVdS · Thu Sep 15, 2016 12:50 pm

I just upgraded my internet and got the same problem with RB2011, so I am looking to replace it with CCR1009, but I'll need a wifi too. What will you recommend?

Inside? I like the wAP AC a lot myself.

sb1349 · Mon Sep 26, 2016 7:43 pm

I just upgraded my internet and got the same problem with RB2011, so I am looking to replace it with CCR1009, but I'll need a wifi too. What will you recommend?
Inside? I like the wAP AC a lot myself.

They are good but if you want speed at a decent range the RB921 with decent antennas is the way to go. Someone else was talking about the UniFi devices. The controller is great it gives plenty of options if you do not need the speed. We have many UAP Pro devices and they are great but avoid the AC line like the plague. They are still trying to figure out the firmware for the devices. Deployed half a dozen of the UAP AC Pro devices and after many issues we pulled them down and replaced them with the UAP Pro or a RB 921-2HP with a 5 ghz ac card where speed/reliability is needed.