RB750GL Slow Routing with new ISP

bentglasstube · Thu Feb 21, 2019 11:34 pm

This morning, I had service from a new ISP that does fixed wireless installed. The technician was able to get very good speeds connecting directly, but when I add in the RB750GL everything is very slow.

Speeds directly: 220Mbps down 120Mbps up
Speeds with RB750GL: 50Mbps down 60Mbps up

I checked the router's CPU during a speedtest and it peaked around 23%.

With my previous ISP (cable) I was getting 240Mbps down and 11Mbps up, which were approximately the limits they said I'd get. I didn't change any configurations for the new ISP, but I assume something is misconfigured that is making it go so much slower.

I have very few firewall and nat rules, and I don't use any queues as far as I know. I tried messing with the MTU settings a bit but didn't get any faster results.

> ip firewall filter print
Flags: X - disabled, I - invalid, D - dynamic 
 0  D ;;; special dummy rule to show fasttrack counters
      chain=forward 

 1  I  ;;; default configuration
      chain=input action=accept protocol=icmp log=no log-prefix="" 

 2  I  ;;; default configuration
      chain=input action=accept connection-state=established log=no log-prefix="" 

 3  I  ;;; default configuration
      chain=input action=drop in-interface=wan log=no log-prefix="" 
      
     > ip firewall nat print  
Flags: X - disabled, I - invalid, D - dynamic 
 0    ;;; default configuration
      chain=srcnat action=masquerade out-interface=wan log=no log-prefix="" 

 1    chain=dstnat action=dst-nat to-addresses=10.47.0.106 protocol=tcp in-interface=wan dst-port=22 log=no 
      log-prefix="" 

 2    chain=dstnat action=dst-nat to-addresses=10.47.0.106 protocol=tcp in-interface=wan dst-port=5000 log=no 
      log-prefix="" 

 3    chain=dstnat action=dst-nat to-addresses=10.47.0.106 protocol=tcp in-interface=wan dst-port=6600 log=no 
      log-prefix="" 

 4    chain=dstnat action=dst-nat to-addresses=10.47.0.106 protocol=tcp in-interface=wan dst-port=8000 log=no 
      log-prefix="" 

 5    chain=dstnat action=dst-nat to-addresses=10.47.0.100 protocol=tcp in-interface=wan dst-port=32400 log=no 
      log-prefix=""

mkx · Fri Feb 22, 2019 11:24 am

Your firewall lacks quite some stuff if you really only have those 3 rules (plus auto-generated one) ... which I kinda doubt as those 3 rules wouldn't generate the rule #0. You might want to post output of /ip firewall export to have full picture.

If the 3 rules are really all you've got, then it could be that some things are not working right (but you might notice that or not). Add the following rules to the end of your current list and then remove your existing rules ... reboot router afterwards so it clears the connection states etc.

/ip firewall filter
add chain=input action=accept connection-state=established,related,untracked comment="defconf: accept established,related,untracked"
add chain=input action=drop connection-state=invalid comment="defconf: drop invalid"
add chain=input action=accept protocol=icmp comment="defconf: accept ICMP"
add chain=input action=drop in-interface-list=wan comment="drop the rest targeting router coming from WAN"
add chain=forward action=accept ipsec-policy=in,ipsec comment="defconf: accept in ipsec policy"
add chain=forward action=accept ipsec-policy=out,ipsec comment="defconf: accept out ipsec policy"
add chain=forward action=fasttrack-connection connection-state=established,related comment="defconf: fasttrack"
add chain=forward action=accept connection-state=established,related,untracked comment="defconf: accept established,related, untracked"
add chain=forward action=drop connection-state=invalid comment="defconf: drop invalid"
add chain=forward action=drop connection-state=new connection-nat-state=!dstnat in-interface-list=wan comment="defconf:  drop all from WAN not DSTNATed"

It is essentially the default firewall rule list, I just adapted 4th rule (original reads like this: filter add chain=input action=drop in-interface-list=!LAN comment="defconf: drop all not coming from LAN" and from your current firewall it's not clear if you have interface list called LAN).

From the performance point of view, it's rule #7 (the one with action=fasttrack-connection) that should make big difference.

It might happen that even with the rules above you won't be able to achieve same speeds as measured directly ... it depends on how test programme tests connection (single connection or multiple connections in parallel) ... most routers struggle with single connection at some point (due to adding delay and/or due to single-threaded operation) while unleashing full power with multiple concurrent connections. The venerable RB750GL is not the fastest beast either, but should be able to achieve up to around 200 Mbps.

Sometimes, however, there's some interaction between RB and ISP's equipment which is hard to explain, but cripples the whole connectivity.

argusb · Fri Feb 22, 2019 12:18 pm

The connection to the new ISP could have higher latency and/or packetloss (especially if it's a wireless ISP).
This also leads to lower (single stream) speedtests.

Have you tried the (multi-connection) DSLreports speedtest? http://www.dslreports.com/speedtest

And do you have any numbers on latency/packetloss for the old and new connections?

bentglasstube · Mon Feb 25, 2019 8:23 pm

Thanks for the suggestions. I saw that there was a firmware update for my device so I wound up doing a factory reset and upgrade and now I am getting good speeds with the new ISP.

As you suspected latency is slightly worse, (14ms vs 10ms in speed tests) but I don't see any real uptick in packet loss.

RB750GL Slow Routing with new ISP

RB750GL Slow Routing with new ISP

Re: RB750GL Slow Routing with new ISP

Re: RB750GL Slow Routing with new ISP

Re: RB750GL Slow Routing with new ISP

Who is online