Hi all,

i use RouterOS v6.49.2 and some days ago i found out that when i go to speedtest.net it stucks on Finding optimal server...
Fast.com and other speed test pages works fine.
Any ideas what might cause the issue? Its not a router or provider issue because if i bypass the mikrotik firewall and connect straight to
my provider's router speedtest.net works fine :/

i use RouterOS v6.49.2 and some days ago...

But V6.49.2 was only released today????

I think you have sort of isolated where problem is yourself, i.e. look at your firewall rules

Are you sure you haven't block any port, especially 8080? and can you send the /export hide-sensitive file=x here.

speedtest.net works fine here on 6.49.2

just NOT on Firefox, some protection is blocking stuff
on Safari speedtest.net works fine

Are you sure you haven't block any port, especially 8080? and can you send the /export hide-sensitive file=x here.

# dec/07/2021 12:41:22 by RouterOS 6.49.2
# software id = BE0Y-BEJ6
#
# model = RouterBOARD 941-2nD
# serial number =
/interface bridge
add admin-mac=xx:xx:xx:xx:xx:xx auto-mac=no comment=defconf name=bridge
/interface list
add comment=defconf name=WAN
add comment=defconf name=LAN
/interface wireless security-profiles
set [ find default=yes ] authentication-types=wpa2-psk mode=dynamic-keys supplicant-identity=MikroTik
/ip pool
add name=dhcp ranges=192.168.88.10-192.168.88.254
/ip dhcp-server
add address-pool=dhcp disabled=no interface=bridge name=defconf
/user group
set full policy=local,telnet,ssh,ftp,reboot,read,write,policy,test,winbox,password,web,sniff,sensitive,api,romon,dude,tikapp
/interface bridge port
add bridge=bridge comment=defconf interface=ether2
add bridge=bridge comment=defconf interface=ether3
add bridge=bridge comment=defconf interface=ether4
add bridge=bridge comment=defconf interface=pwr-line1
add bridge=bridge comment=defconf interface=wlan1
/ip neighbor discovery-settings
set discover-interface-list=LAN
/interface list member
add comment=defconf interface=bridge list=LAN
add comment=defconf interface=ether1 list=WAN
/ip address
add address=192.168.88.1/24 comment=defconf interface=ether2 network=192.168.88.0
/ip dhcp-client
add comment=defconf disabled=no interface=ether1
/ip dhcp-server network
add address=192.168.88.0/24 comment=defconf gateway=192.168.88.1
/ip dns
set allow-remote-requests=yes
/ip dns static
add address=192.168.88.1 comment=defconf name=router.lan
/ip firewall filter
add action=accept chain=input comment="defconf: accept established,related,untracked" connection-state=established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=invalid
add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp
add action=accept chain=input comment="defconf: accept to local loopback (for CAPsMAN)" dst-address=127.0.0.1
add action=drop chain=input comment="defconf: drop all not coming from LAN" in-interface-list=!LAN
add action=accept chain=forward comment="defconf: accept in ipsec policy" ipsec-policy=in,ipsec
add action=accept chain=forward comment="defconf: accept out ipsec policy" ipsec-policy=out,ipsec
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" connection-state=established,related
add action=accept chain=forward comment="defconf: accept established,related, untracked" connection-state=established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" connection-state=invalid
add action=drop chain=forward comment="defconf: drop all from WAN not DSTNATed" connection-nat-state=!dstnat connection-state=new in-interface-list=WAN
add action=accept chain=forward comment=Test dst-address=192.168.88.200 dst-port=9000 in-interface=ether1 protocol=tcp
add action=accept chain=forward comment="Test Http" dst-address=192.168.88.200 dst-port=8080 in-interface=ether1 protocol=tcp
/ip firewall mangle
add action=mark-connection chain=prerouting disabled=yes layer7-protocol=*4 new-connection-mark=speedtest passthrough=yes
add action=mark-packet chain=prerouting connection-mark=speedtest disabled=yes new-packet-mark=SpeedtestPKT passthrough=no
/ip firewall nat
add action=masquerade chain=srcnat comment="defconf: masquerade" ipsec-policy=out,none
add action=dst-nat chain=dstnat dst-port=9000 log=yes protocol=tcp to-addresses=192.168.88.200 to-ports=9000
add action=dst-nat chain=dstnat dst-port=8080 protocol=tcp to-addresses=192.168.88.200 to-ports=8080
/ip firewall service-port
set sip disabled=yes
/system clock
set time-zone-name=Europe/Athens
/tool mac-server
set allowed-interface-list=LAN
/tool mac-server mac-winbox
set allowed-interface-list=LAN

Remove these two rules and it should be fine:
/ip firewall filter
add action=accept chain=forward comment="Test Http" dst-address=192.168.88.200 dst-port=8080 in-interface=ether1 protocol=tcp
/ip firewall nat
add action=dst-nat chain=dstnat dst-port=8080 protocol=tcp to-addresses=192.168.88.200 to-ports=8080

Its a test server i have so i accidentaly enabled and forget it , so 8080 must be free for speedtest.net to work .

Thank you !

so 8080 must be free for speedtest.net to work .

No. It doesn't matter what you do with incoming packages to port 8080, but your NAT rule applies to outgoing internet traffic as well.
You should limit your NAT rule's scope, e.g. by using in-interface parameter.