HELP: RB5009 limiting WAN speeds of any *nix machines
Posted: Sun Sep 22, 2024 8:42 pm
I have an RB5009 router that hopefully has a misconfiguration somewhere, as it seems to be limiting the WAN speed of any Linux/macOS machine that connects to it via Ethernet or WiFi. This also happens to a WSL2 environment under Windows! With Ethernet the speed tests from google and speedtest.net regardless of the time of day maxes out at roughly 20Mb/s whereas WiFi surprisingly maxes out at about 110Mb/s. Even a non-GUI environment while downloading the linux kernel using wget --report-speed=bits -O /dev/null https://cdn.kernel.org/pub/linux/kernel ... .11.tar.xz shows the WAN speed barely breaking 20Mb/s.
LAN speeds are not affected at all and neither are Android and Windows clients, with the exception of WSL2 under Windows. I've tried running various Linux distros off of USB aside from my main Slackware desktop and they all give the same slow WAN speeds. Additionally I've tried running the same various Linux distros off of 2 work laptops and they both give the same slow WAN speeds. I've set the DNS server to Google's 8.8.8.8 with no change.
I know the ISP isn't up to any funny tricks since I've plugged the Ethernet cable directly from the ISP into both work laptops and am able to obtain their advertised speeds of 500Mb/s. Below is my mikrotik config, hopefully someone can spot a misconfig somewhere
LAN speeds are not affected at all and neither are Android and Windows clients, with the exception of WSL2 under Windows. I've tried running various Linux distros off of USB aside from my main Slackware desktop and they all give the same slow WAN speeds. Additionally I've tried running the same various Linux distros off of 2 work laptops and they both give the same slow WAN speeds. I've set the DNS server to Google's 8.8.8.8 with no change.
I know the ISP isn't up to any funny tricks since I've plugged the Ethernet cable directly from the ISP into both work laptops and am able to obtain their advertised speeds of 500Mb/s. Below is my mikrotik config, hopefully someone can spot a misconfig somewhere
Code: Select all
# 2024-09-16 16:16:40 by RouterOS 7.15.3
# model = RB5009UPr+S+
/container mounts
add dst=/config name=reflector_conf src=\
/usb1/containers/github/bonjour-reflector_conf
add dst=/opt/adguardhome/work name=adgh_work src=\
/usb1/containers/dockers/adguardhome/work
add dst=/opt/adguardhome/conf name=adgh_conf src=\
/usb1/containers/dockers/adguardhome/conf
/disk
set usb1 media-interface=none media-sharing=no
/interface bridge
add name=bridge1 vlan-filtering=yes
add name=dockers
/interface ethernet
set [ find default-name=ether1 ] name=ether1_WAN
set [ find default-name=ether2 ]
set [ find default-name=ether3 ] comment="Ubiquiti Unifi U6 Enterprise"
set [ find default-name=ether4 ] comment="switch - desktop - VLAN99"
set [ find default-name=ether5 ] comment="switch - VLAN29"
set [ find default-name=ether6 ] disabled=yes
set [ find default-name=ether7 ] disabled=yes
set [ find default-name=sfp-sfpplus1 ] disabled=yes
/interface veth
add address=127.1.0.10/32 gateway=127.1.0.1 gateway6="" name=veth1-reflector
add address=192.168.19.2/24 gateway=192.168.19.1 gateway6="" name=\
veth2-adguard
/interface vlan
add comment="Wi-Fi 2.4GHz - IoT" interface=bridge1 name=vlan29 vlan-id=29
add comment="management VLAN" interface=bridge1 name=vlan99 vlan-id=99
add interface=bridge1 name=vlan199 vlan-id=199
/interface list
add comment=defconf name=WAN
add comment=defconf name=LAN
add comment="contains interfaces other than vlan29" name=non_vlan29
add name=non_mgmt_int
/ip pool
add name=dhcp_pool4 ranges=192.168.99.25-192.168.99.254
add name=vpn_pool ranges=10.168.99.25-10.168.99.254
add name=dhcp_pool2 ranges=192.168.24.200-192.168.24.254
add name=dhcp_pool3 ranges=192.168.199.25-192.168.199.254
/ip dhcp-server
add address-pool=dhcp_pool2 interface=vlan29 lease-time=4d name=dhcp2
add address-pool=dhcp_pool3 interface=vlan199 lease-time=4d name=dhcp3
add address-pool=dhcp_pool4 interface=vlan99 lease-time=4d name=dhcp4
/ppp profile
add dns-server=192.168.19.2 local-address=10.168.99.1 name=vpn_profile \
remote-address=vpn_pool use-encryption=yes
/queue simple
add disabled=yes max-limit=0/9600 name=voyager target=192.168.199.197/32
/system logging action
add disk-file-count=20 disk-file-name=usb1/RB5009UPr+S+IN/log \
disk-lines-per-file=4096 name=usb target=disk
add disk-file-count=20 disk-file-name=usb1/RB5009UPr+S+IN/auth.log \
disk-lines-per-file=4096 name=auth target=disk
/zerotier
set zt1 comment="ZeroTier Central controller - https://my.zerotier.com/" \
disabled=yes disabled=yes name=zt1 port=9993
/container
add comment=bonjour-reflector interface=veth1-reflector logging=yes mounts=\
reflector_conf root-dir=usb1/containers/github/bonjour-reflector \
start-on-boot=yes workdir=/
add comment=\
"AdGuardHome - backup container using same config as main container" \
interface=veth2-adguard logging=yes mounts=adgh_work,adgh_conf root-dir=\
usb1/containers/dockers/adguardhome/adgh-2 workdir=/opt/adguardhome/work
add comment="AdGuardHome - main container" interface=veth2-adguard logging=\
yes mounts=adgh_work,adgh_conf root-dir=\
usb1/containers/dockers/adguardhome/adgh-1 start-on-boot=yes workdir=\
/opt/adguardhome/work
/container config
set registry-url=https://registry-1.docker.io tmpdir=usb1/containers/tmp
/ip smb
set domain=startrek enabled=yes interfaces=vlan99
/interface bridge port
add bridge=bridge1 comment=defconf interface=ether2 pvid=99
add bridge=bridge1 comment=defconf interface=ether3 pvid=99
add bridge=bridge1 comment=defconf interface=ether4 pvid=99
add bridge=bridge1 comment=defconf interface=ether5 pvid=29
add bridge=bridge1 comment=defconf interface=ether8 pvid=29
add bridge=bridge1 edge=yes frame-types=admit-only-vlan-tagged \
ingress-filtering=no interface=veth1-reflector learn=yes \
multicast-router=permanent point-to-point=yes pvid=999
add bridge=dockers interface=veth2-adguard
/ip firewall connection tracking
set udp-timeout=10s
/ipv6 settings
set disable-ipv6=yes
/interface bridge vlan
add bridge=bridge1 tagged=bridge1,ether3,veth1-reflector untagged=\
ether5,ether8 vlan-ids=29
add bridge=bridge1 tagged=bridge1,ether3,veth1-reflector vlan-ids=199
add bridge=bridge1 tagged=bridge1,veth1-reflector untagged=\
ether2,ether3,ether4 vlan-ids=99
/interface list member
add comment=defconf interface=bridge1 list=LAN
add comment=defconf interface=ether1_WAN list=WAN
add disabled=yes interface=wireguard1 list=LAN
add interface=vlan99 list=LAN
add interface=vlan29 list=non_mgmt_int
add interface=vlan199 list=non_mgmt_int
/interface ovpn-server server
set auth=sha1 certificate=vpn_server-cert cipher=aes256-cbc default-profile=\
vpn_profile require-client-certificate=yes
/ip address
add address=192.168.29.1/24 interface=vlan29 network=192.168.29.0
add address=192.168.99.1/24 comment="management VLAN" interface=vlan99 \
network=192.168.99.0
add address=192.168.19.1/24 interface=dockers network=192.168.19.0
add address=10.168.99.1/24 interface=wireguard1 network=10.168.99.0
add address=192.168.199.1/24 interface=vlan199 network=192.168.199.0
/ip arp
add address=192.168.99.254 interface=vlan99 mac-address=FF:FF:FF:FF:FF:FF
/ip cloud
set ddns-enabled=yes
/ip dhcp-client
add comment=defconf interface=ether1_WAN use-peer-dns=no
/ip dhcp-server alert
add disabled=no interface=bridge1 on-alert=\
":log error message=\"Rogue DHCP Server detected\"" valid-server=\
78:9A:18:A2:E2:C6
/ip dhcp-server network
add address=192.168.29.0/24 dns-server=192.168.19.2 gateway=192.168.29.1
add address=192.168.99.0/24 dns-server=192.168.19.2,8.8.8.8,8.8.4.4 gateway=\
192.168.99.1
add address=192.168.199.0/24 dns-server=192.168.19.2 gateway=192.168.199.1
/ip dns
set allow-remote-requests=yes servers=192.168.19.2,8.8.8.8,8.8.4.4
/ip firewall address-list
add address=0.0.0.0/8 comment=\
"defconf: RFC6890 - IPv4 addresses that cannot be forwarded" list=\
no_forward_ipv4
add address=169.254.0.0/16 comment=\
"defconf: RFC6890 - IPv4 addresses that cannot be forwarded" list=\
no_forward_ipv4
add address=224.0.0.0/4 comment="defconf: multicast - IPv4 addresses that cann\
ot be forwarded, however disable this if you intend to use multicast forwa\
rding" list=no_forward_ipv4
add address=255.255.255.255 comment=\
"defconf: RFC6890 - IPv4 addresses that cannot be forwarded" list=\
no_forward_ipv4
add address=127.0.0.0/8 comment="defconf: RFC6890 - IPv4 addresses that cannot\
\_be used as src/dst/forwarded, etc." list=bad_ipv4
add address=192.0.0.0/24 comment="defconf: RFC6890 - IPv4 addresses that canno\
t be used as src/dst/forwarded, etc." list=bad_ipv4
add address=192.0.2.0/24 comment="defconf: RFC6890 documentation - IPv4 addres\
ses that cannot be used as src/dst/forwarded, etc." list=bad_ipv4
add address=198.51.100.0/24 comment="defconf: RFC6890 documentation - IPv4 add\
resses that cannot be used as src/dst/forwarded, etc." list=bad_ipv4
add address=203.0.113.0/24 comment="defconf: RFC6890 documentation - IPv4 addr\
esses that cannot be used as src/dst/forwarded, etc." list=bad_ipv4
add address=240.0.0.0/4 comment="defconf: RFC6890 reserved - IPv4 addresses th\
at cannot be used as src/dst/forwarded, etc." list=bad_ipv4
add address=0.0.0.0/8 comment=\
"defconf: RFC6890 - IPv4 addresses that cannot be routed globally" list=\
not_global_ipv4
add address=10.0.0.0/8 comment=\
"defconf: RFC6890 - IPv4 addresses that cannot be routed globally" list=\
not_global_ipv4
add address=100.64.0.0/10 comment=\
"defconf: RFC6890 - IPv4 addresses that cannot be routed globally" list=\
not_global_ipv4
add address=169.254.0.0/16 comment=\
"defconf: RFC6890 - IPv4 addresses that cannot be routed globally" list=\
not_global_ipv4
add address=172.16.0.0/12 comment=\
"defconf: RFC6890 - IPv4 addresses that cannot be routed globally" list=\
not_global_ipv4
add address=192.0.0.0/29 comment=\
"defconf: RFC6890 - IPv4 addresses that cannot be routed globally" list=\
not_global_ipv4
add address=192.168.0.0/16 comment=\
"defconf: RFC6890 - IPv4 addresses that cannot be routed globally" list=\
not_global_ipv4
add address=198.18.0.0/15 comment="defconf: RFC6890 benchmark - IPv4 addresses\
\_that cannot be routed globally" list=not_global_ipv4
add address=255.255.255.255 comment=\
"defconf: RFC6890 - IPv4 addresses that cannot be routed globally" list=\
not_global_ipv4
add address=224.0.0.0/4 comment=\
"defconf: multicast - IPv4 addresses that cannot be source address" list=\
bad_src_ipv4
add address=255.255.255.255 comment=\
"defconf: RFC6890 - IPv4 addresses that cannot be source address" list=\
bad_src_ipv4
add address=0.0.0.0/8 comment=\
"defconf: RFC6890 - IPv4 addresses that cannot be destination address" \
list=bad_dst_ipv4
add address=224.0.0.0/4 comment=\
"defconf: RFC6890 - IPv4 addresses that cannot be destination address" \
list=bad_dst_ipv4
/ip firewall filter
add action=drop chain=input comment="Drop traffic to the router from IPv4 addr\
esses contained in the non-mgmt firewall address list" src-address-list=\
non_mgmt_addr
add action=accept chain=input comment="defconf: accept ICMP after RAW" \
protocol=icmp
add action=accept chain=input comment=\
"defconf: accept established,related,untracked" connection-state=\
established,related,untracked
add action=accept chain=input comment="Allow WireGuard traffic" src-address=\
10.168.99.0/24
add action=accept chain=input comment="Allow WireGuard" dst-port=2612 \
protocol=udp
add action=accept chain=input comment="Allow OpenVPN" disabled=yes dst-port=\
119 protocol=udp
add action=drop chain=input comment="defconf: drop invalid" connection-state=\
invalid
add action=accept chain=input comment=\
"defconf: accept to local loopback (for CAPsMAN)" dst-address=127.0.0.1
add action=drop chain=input comment="defconf: drop all not coming from LAN" \
in-interface-list=!LAN
add action=drop chain=forward comment=\
"rule to block rogue clients on the network by MAC address" disabled=yes \
src-mac-address=F0:27:2D:B4:D2:7C
add action=accept chain=forward comment="Allow OpenVPN clients to access LAN" \
disabled=yes in-interface=all-ppp in-interface-list=!WAN
add action=accept chain=forward comment="defconf: accept in ipsec policy - if \
IPsec tunnels are used on the router this rule should be enabled" \
disabled=yes ipsec-policy=in,ipsec
add action=accept chain=forward comment="defconf: accept out ipsec policy - if\
\_IPsec tunnels are used on the router this rule should be enabled" \
disabled=yes ipsec-policy=out,ipsec
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" \
connection-state=established,related hw-offload=yes
add action=accept chain=forward comment=\
"defconf: accept established,related, untracked" connection-state=\
established,related,untracked
add action=accept chain=forward comment="Accept *SMB traffic from non-vlan29 i\
n SMB_clients address list to servers in SMB_servers address list on VLAN4\
4" dst-address-list=SMB_servers dst-port=445 in-interface=!vlan29 \
out-interface=vlan99 protocol=tcp src-address-list=SMB_clients
add action=accept chain=forward comment="Accept *SMB traffic from non-vlan29 i\
n SMB_clients address list to servers in SMB_servers address list on VLAN4\
4" disabled=yes dst-address-list=SMB_servers dst-port=445 in-interface=\
!vlan29 out-interface=vlan199 protocol=tcp src-address-list=SMB_clients
add action=accept chain=forward comment="Accept *syncthing* traffic from non-V\
LAN24 in SMB_clients address list to servers in SMB_servers address list o\
n vlan99" dst-address-list=SMB_servers dst-port=22000 in-interface=\
!vlan29 out-interface=vlan99 protocol=udp src-address-list=SMB_clients
add action=accept chain=forward comment="Accept *syncthing* traffic from non-V\
LAN24 in SMB_clients address list to servers in SMB_servers address list o\
n vlan99" dst-address-list=SMB_servers dst-port=22000 in-interface=\
!vlan29 out-interface=vlan99 protocol=tcp src-address-list=SMB_clients
add action=accept chain=forward comment="Accept *iSyncr* traffic from non-VLAN\
24 in SMB_clients address list to servers in SMB_servers address list on V\
LAN99" dst-address-list=SMB_servers dst-port=34000 in-interface=!vlan29 \
out-interface=vlan99 protocol=tcp src-address-list=SMB_clients
add action=accept chain=forward comment="Accept *WoL* packets traffic from non\
-vlan29 in SMB_clients address list to servers on vlan99" dst-address=\
192.168.99.254 dst-port=9 in-interface=!vlan29 out-interface=vlan99 \
protocol=udp src-address-list=SMB_clients
add action=drop chain=forward comment="Drop traffic to vlan99 from non-managem\
ent interfaces contained in non-mgmt interface list" in-interface-list=\
non_mgmt_int out-interface=vlan99
add action=drop chain=forward comment=\
"Drop traffic from vlan29 to vlan199 (main)" in-interface=vlan29 \
out-interface=vlan199
add action=drop chain=forward comment="defconf: drop invalid" \
connection-state=invalid
add action=drop chain=forward comment=\
"defconf: drop all from WAN not DSTNATed" connection-nat-state=!dstnat \
connection-state=new in-interface-list=WAN
add action=drop chain=forward comment="defconf: drop bad forward IPs" \
src-address-list=no_forward_ipv4
add action=drop chain=forward comment="defconf: drop bad forward IPs" \
dst-address-list=no_forward_ipv4
/ip firewall nat
add action=masquerade chain=srcnat comment="defconf: masquerade" \
ipsec-policy=out,none out-interface-list=WAN
add action=accept chain=srcnat comment=\
"defconf: accept all that matches IPSec policy" disabled=yes \
ipsec-policy=out,ipsec
add action=dst-nat chain=dstnat comment="[1/4] following 4 lines force all DNS\
\_traffic to AdGuard Home DNS and block WAN traffic to port 53" disabled=\
yes dst-address=!192.168.14.2 dst-port=53 in-interface=!ether1_WAN \
protocol=udp src-address=!192.168.14.2 to-addresses=192.168.14.2
add action=dst-nat chain=dstnat comment="[2/4] for more details see https://ww\
w.reddit.com/r/pihole/comments/aj9mxd/force_all_dns_traffic_to_go_through_\
pihole_using/\?rdt=35355" disabled=yes dst-address=!192.168.14.2 \
dst-port=53 in-interface=!ether1_WAN protocol=tcp src-address=\
!192.168.14.2 to-addresses=192.168.14.2
add action=masquerade chain=srcnat comment="[3/4]" disabled=yes dst-address=\
192.168.14.2 dst-port=53 protocol=udp
add action=masquerade chain=srcnat comment="[4/4]" disabled=yes dst-address=\
192.168.14.2 dst-port=53 protocol=tcp
/ip firewall raw
add action=accept chain=prerouting comment=\
"defconf: enable for transparent firewall"
add action=accept chain=prerouting comment="defconf: accept DHCP discover" \
dst-address=255.255.255.255 dst-port=67 in-interface-list=LAN protocol=\
udp src-address=0.0.0.0 src-port=68
add action=drop chain=prerouting comment="defconf: drop bogon IP's" \
src-address-list=bad_ipv4
add action=drop chain=prerouting comment="defconf: drop bogon IP's" \
dst-address-list=bad_ipv4
add action=drop chain=prerouting comment="defconf: drop bogon IP's" \
src-address-list=bad_src_ipv4
add action=drop chain=prerouting comment="defconf: drop bogon IP's" \
dst-address-list=bad_dst_ipv4
add action=drop chain=prerouting comment="defconf: drop non global from WAN" \
in-interface-list=WAN src-address-list=not_global_ipv4
add action=drop chain=prerouting comment=\
"defconf: drop forward to local lan from WAN" dst-address=192.168.99.0/24 \
in-interface-list=WAN
add action=drop chain=prerouting comment=\
"defconf: drop local if not from default IP range" in-interface-list=LAN \
src-address=!192.168.99.0/24
add action=drop chain=prerouting comment="defconf: drop bad UDP" port=0 \
protocol=udp
add action=jump chain=prerouting comment="defconf: jump to ICMP chain" \
jump-target=icmp4 protocol=icmp
add action=jump chain=prerouting comment="defconf: jump to TCP chain" \
jump-target=bad_tcp protocol=tcp
add action=accept chain=prerouting comment=\
"defconf: accept everything else from LAN" in-interface-list=LAN
add action=accept chain=prerouting comment=\
"defconf: accept everything else from WAN" in-interface-list=WAN
add action=drop chain=prerouting comment="defconf: drop the rest"
add action=drop chain=bad_tcp comment=\
"defconf: TCP flag filter - drop TCP packets known to be invalid" \
protocol=tcp tcp-flags=!fin,!syn,!rst,!ack
add action=drop chain=bad_tcp comment=defconf protocol=tcp tcp-flags=fin,syn
add action=drop chain=bad_tcp comment=defconf protocol=tcp tcp-flags=fin,rst
add action=drop chain=bad_tcp comment=defconf protocol=tcp tcp-flags=fin,!ack
add action=drop chain=bad_tcp comment=defconf protocol=tcp tcp-flags=fin,urg
add action=drop chain=bad_tcp comment=defconf protocol=tcp tcp-flags=syn,rst
add action=drop chain=bad_tcp comment=defconf protocol=tcp tcp-flags=rst,urg
add action=drop chain=bad_tcp comment="defconf: TCP port 0 drop" port=0 \
protocol=tcp
add action=accept chain=icmp4 comment="defconf: ICMP filtering - echo reply" \
icmp-options=0:0 limit=5,10:packet protocol=icmp
add action=accept chain=icmp4 comment=\
"defconf: ICMP filtering - net unreachable" icmp-options=3:0 protocol=\
icmp
add action=accept chain=icmp4 comment=\
"defconf: ICMP filtering - host unreachable" icmp-options=3:1 protocol=\
icmp
add action=accept chain=icmp4 comment=\
"defconf: ICMP filtering - protocol unreachable" icmp-options=3:2 \
protocol=icmp
add action=accept chain=icmp4 comment=\
"defconf: ICMP filtering - port unreachable" icmp-options=3:3 protocol=\
icmp
add action=accept chain=icmp4 comment=\
"defconf: ICMP filtering - fragmentation needed" icmp-options=3:4 \
protocol=icmp
add action=accept chain=icmp4 comment="defconf: ICMP filtering - echo" \
icmp-options=8:0 limit=5,10:packet protocol=icmp
add action=accept chain=icmp4 comment=\
"defconf: ICMP filtering - time exceeded " icmp-options=11:0-255 \
protocol=icmp
add action=drop chain=icmp4 comment=\
"defconf: ICMP filtering - drop other icmp" protocol=icmp
/ip service
set telnet disabled=yes
set ftp disabled=yes
set www disabled=yes
set ssh address=192.168.99.0/24
set api disabled=yes
set winbox address=192.168.99.0/24
set api-ssl disabled=yes
/ip smb shares
set [ find default=yes ] directory=/pub
add directory=usb1/itunes name=itunes valid-users=itunes
/system clock
set time-zone-name=America/New_York
/system logging
add action=usb topics=warning
add action=usb topics=info
add action=usb topics=error
add action=usb topics=critical
add action=auth topics=account
/system note
set show-at-login=no
/system ntp client
set enabled=yes
/system ntp client servers
add address=0.us.pool.ntp.org
add address=1.us.pool.ntp.org
add address=2.us.pool.ntp.org
add address=3.us.pool.ntp.org
/tool bandwidth-server
set enabled=no
/tool mac-server
set allowed-interface-list=LAN
/tool mac-server mac-winbox
set allowed-interface-list=LAN
/tool mac-server ping
set enabled=no