For an unknown reason, I can't get the full Gigabit download Speed I should be getting with my current setup. I do get the 940mbps speed on upload tho. On download I reach about 740mbps max (tested both on DSL report Speedtest and speedtest.net). The CPU never gets higher than 25% so I don't think it's related RB4011 power. With the supplied ISP modem, I get 940/940.
CPU profile while testing
Code: Select all
l2tp 0 0%
ethernet 0 6%
firewall 0 2.5%
networking 0 10.5%
winbox 0 0%
management 0 0%
unclassified 0 0.5%
cpu0 19.5%
ethernet 1 0.5%
firewall 1 0%
networking 1 3%
management 1 0%
cpu1 3.5%
ethernet 2 0%
networking 2 0%
ipsec 2 0%
winbox 2 0%
management 2 0%
cpu2 0%
l2tp 3 0.5%
ethernet 3 1%
console 3 0%
Fiber from ISP -> ONT -> Ubi Switch SFP port on VLAN 35 -> Ubi Switch SFP+ port on VLAN 35 -> RB4011 on SFP+ port
My ROS config
Code: Select all
/interface bridge
add admin-mac=B8:69:F4:A0:04:33 auto-mac=no comment=defconf name=bridge \
protocol-mode=none
/interface ethernet
set [ find default-name=sfp-sfpplus1 ] advertise=\
1000M-full,2500M-full,5000M-full,10000M-full l2mtu=1530 mtu=1530
/interface vlan
add interface=sfp-sfpplus1 mtu=1520 name=vlan35-internet vlan-id=35
add interface=sfp-sfpplus1 mtu=1522 name=vlan36-tv vlan-id=36
/interface pppoe-client
add add-default-route=yes dial-on-demand=yes disabled=no interface=\
vlan35-internet keepalive-timeout=disabled max-mru=1500 max-mtu=1500 \
name=Bell password=**** user=*****
/interface list
add comment=defconf name=WAN
add comment=defconf name=LAN
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
/ip ipsec peer profile
set [ find default=yes ] enc-algorithm=aes-256,3des
/ip ipsec proposal
set [ find default=yes ] enc-algorithms=aes-256-cbc,3des pfs-group=none
/ip pool
add name=default-dhcp ranges=192.168.30.100-192.168.30.189
add name=VPN-pool ranges=192.168.30.190-192.168.30.195
/ip dhcp-server
add address-pool=default-dhcp disabled=no interface=sfp-sfpplus1 name=default
/ppp profile
set *FFFFFFFE dns-server=192.168.30.1 local-address=192.168.30.1 \
remote-address=VPN-pool use-encryption=required
/interface bridge port
add bridge=bridge comment=defconf interface=ether2
add bridge=bridge comment=defconf interface=ether3
add bridge=bridge comment=defconf interface=ether4
add bridge=bridge comment=defconf interface=ether5
add bridge=bridge comment=defconf interface=ether6
add bridge=bridge comment=defconf interface=ether7
add bridge=bridge comment=defconf interface=ether8
add bridge=bridge comment=defconf interface=ether9
add bridge=bridge comment=defconf interface=ether10
/ip neighbor discovery-settings
set discover-interface-list=LAN
/interface l2tp-server server
set allow-fast-path=yes enabled=yes ipsec-secret=***** use-ipsec=yes
/interface list member
add comment=defconf interface=sfp-sfpplus1 list=LAN
add comment=defconf interface=Bell list=WAN
/ip address
add address=192.168.30.1/24 comment=defconf interface=sfp-sfpplus1 network=\
192.168.30.0
/ip cloud
set ddns-enabled=yes
/ip dhcp-client
add comment=defconf dhcp-options=hostname,clientid disabled=no interface=\
ether1
/ip dhcp-server lease
/ip dhcp-server network
add address=192.168.30.0/24 comment=defconf dns-server=9.9.9.9,8.8.8.8 \
gateway=192.168.30.1
/ip dns
set allow-remote-requests=yes servers=9.9.9.9,149.112.112.112
/ip dns static
add address=192.168.88.1 name=router.lan
/ip firewall filter
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" \
connection-state=established,related
add action=accept chain=forward comment=\
"defconf: accept established,related, untracked" connection-state=\
established,related,untracked
add action=accept chain=forward comment="defconf: accept in ipsec policy" \
ipsec-policy=in,ipsec
add action=accept chain=forward comment="defconf: accept out ipsec policy" \
ipsec-policy=out,ipsec
add action=accept chain=input comment=\
"defconf: accept established,related,untracked" connection-state=\
established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=\
invalid
add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp
add action=drop chain=input comment="defconf: drop all not coming from LAN" \
disabled=yes in-interface-list=!LAN
add action=accept chain=input comment="VPN L2TP UDP 500" dst-port=500 \
in-interface=Bell protocol=udp
add action=accept chain=input comment="VPN L2TP UDP 1701" dst-port=1701 \
in-interface=Bell protocol=udp
add action=accept chain=input comment="VPN L2TP 4500" dst-port=4500 \
in-interface=Bell protocol=udp
add action=accept chain=input comment="VPN L2TP ESP" in-interface=Bell \
protocol=ipsec-esp
add action=accept chain=input comment="VPN L2TP AH" in-interface=Bell \
protocol=ipsec-ah
add action=drop chain=forward comment="defconf: drop invalid" \
connection-state=invalid
add action=drop chain=forward comment=\
"defconf: drop all from WAN not DSTNATed" connection-nat-state=!dstnat \
connection-state=new in-interface-list=WAN
/ip firewall mangle
add action=change-mss chain=forward new-mss=1460 out-interface=Bell protocol=\
tcp tcp-flags=syn tcp-mss=1450-65535
/ip firewall nat
add action=masquerade chain=srcnat comment="defconf: masquerade" \
ipsec-policy=out,none out-interface-list=WAN
add action=masquerade chain=srcnat dst-address=192.168.30.0/24 \
out-interface-list=LAN src-address=192.168.30.0/24 to-addresses=0.0.0.0
/ip ipsec peer
add address=0.0.0.0/0 exchange-mode=main-l2tp generate-policy=port-override \
local-address=192.168.30.1 passive=yes secret=******
/ip ipsec policy
set 0 dst-address=0.0.0.0/0 src-address=0.0.0.0/0
/ppp secret
/system clock
set time-zone-autodetect=no time-zone-name=America/Montreal
/tool graphing interface
add interface=sfp-sfpplus1
/tool graphing resource
add
/tool mac-server
set allowed-interface-list=LAN
/tool mac-server mac-winbox
set allowed-interface-list=LAN
