I'm using a hEX S as a home-router on a FTTH connection.
The setup: The hEX S is connected to an ONT. That's it.
ISP requires to use VLAN-ID7 as well as PPPOE in a standard configuration.
ISP hast configured the line to provide 300Mbit in both directions.
If I connect a spare linux notebook, with VLAN-ID7 and PPPOE directly to the ONT, I get abour 310Mbit in both directions, without any issue. This is rock solid. Multiple tests showed this value.
BUT if I connect my hEX S to the ONT, I onle get up to about 200Mbit in download and a good 300Mbit in upload.
This differs a bit over the day, but all in all: Download is about 100Mbit missing compared to what I should be.
This is *not* a matter of a wrong/broken speedtest (proved with multiple tests on different devices, also without router). This is matter of configuration.
So, I need help on the config of my router.
What I checked so far:
* CPU load is quite okay, I think. While 300mbit upload, it rises to about 70% in total. While 200mbit download it's about 50%.
* I checked the cables: Did an iperf3 test with the used cables, and also with the used ethernet port on the hEX S... works as expected with almost 1000mbit.
* I checked that there is no queue or similar configured.
MTU on PPPOE interface is auto-tuned to 1492. Should be okay, see no way on how to change it, as it get's kind of autocofigured?
As only download is affected, I think it's the firewall configuration. Why? Most rules should affect the incoming traffic, not the outgoing.
BUT I have no idea on how to fix it or to track it down (beside deactivating one rule after another). Means: I'm a firewall noob
Is there some experience in this direction (slow download in relation to firewall rules), or can someone give me a hint on what to do?
Or is there some other ideas on what can cause this issue?
best regards,
Alex
[update]
I tried to reduce the firewall to a very minimum. I cleared all rules and fired up these commands:
Code: Select all
/ip firewall filter add chain=forward connection-state=established,related action=accept comment="Allows established and related connections"
/ip firewall filter add chain=forward connection-state=invalid action=drop comment="Drops invalid connections"
/ip firewall filter add chain=forward in-interface=bridge action=accept comment="Allows outgoing traffic"
/ip firewall filter add chain=forward in-interface=PPPOE-BBV-toni action=drop comment="Drops incoming traffic from the Internet"
/ip firewall filter add chain=input connection-state=established,related action=accept comment="Router management: Allows established connections"
/ip firewall filter add chain=input in-interface=bridge action=accept comment="Router management: Allows internal access"
/ip firewall filter add chain=input action=drop comment="Drops any other access to the router"
/ip firewall nat add chain=srcnat out-interface=PPPOE-BBV-toni action=masquerade comment="Masquerading for Internet access"
CPU load is below the previous maximum.