The official Mikrotik router thread

LandyMan said:
It was disabled all along. LOL.
Will fiddle a bit with the NATting when I have a chance, see what's potting there
Click to expand...
Could you post up your sanitised config?

Run this in the terminal:
export terse file=config.rsc.

Then download the file from the Mikrotik filesystem, open it with Notepad and paste the config here. Just mask details as needed but it will strip passwords out by default unless you add the show-sensitive flag to the export command.
 
Part 1
Code: 
# 2025-03-27 12:16:03 by RouterOS 7.18.2
#
# model = RBD52G-5HacD2HnD
# serial number = 
/interface bridge add admin-mac=E4:8D:8C:51:41:87 auto-mac=no comment="created from master port" name=bridge1 port-cost-mode=short protocol-mode=none
/interface wireless set [ find default-name=wlan1 ] band=2ghz-b/g/n channel-width=20/40mhz-XX country="south africa" disabled=no frequency-mode=superchannel mode=ap-bridge name=WiFi-2Ghz ssid=SSID
/interface wireless set [ find default-name=wlan2 ] band=5ghz-a/n/ac channel-width=20/40/80mhz-XXXX country="south africa" disabled=no frequency=5200 frequency-mode=superchannel mode=ap-bridge name=WiFi-5Ghz ssid=SSID-5-MT
/interface ethernet set [ find default-name=ether1 ] mac-address=XX:XX:XX:XX:XX:XX name=ether1-gateway rx-flow-control=auto tx-flow-control=auto
/interface ethernet set [ find default-name=ether2 ] mac-address=XX:XX:XX:XX:XX:XX name=ether2-master-local
/interface ethernet set [ find default-name=ether3 ] mac-address=XX:XX:XX:XX:XX:XX name=ether3-slave-local
/interface ethernet set [ find default-name=ether4 ] mac-address=XX:XX:XX:XX:XX:XX name=ether4-slave-local
/interface ethernet set [ find default-name=ether5 ] mac-address=XX:XX:XX:XX:XX:XX name=ether5-slave-local
/interface pppoe-client add add-default-route=yes disabled=no interface=ether1-gateway keepalive-timeout=60 max-mru=1480 max-mtu=1480 mrru=1500 name=pppoe-out1 use-peer-dns=yes user=NoneOfYourBusiness
/disk add parent=usb1 partition-number=1 partition-offset="4 685 824" partition-size="4 021 846 016" type=partition
/interface ethernet switch port set 0 default-vlan-id=0
/interface ethernet switch port set 1 default-vlan-id=0
/interface ethernet switch port set 2 default-vlan-id=0
/interface ethernet switch port set 3 default-vlan-id=0
/interface ethernet switch port set 4 default-vlan-id=0
/interface ethernet switch port set 5 default-vlan-id=0
/interface list add exclude=dynamic name=discover
/interface list add name=mactel
/interface list add name=mac-winbox
/interface list add name=WAN
/interface lte apn set [ find default=yes ] ip-type=ipv4 use-network-apn=no
/interface wireless security-profiles set [ find default=yes ] authentication-types=wpa-psk,wpa2-psk mode=dynamic-keys supplicant-identity=MikroTik
/ip ipsec proposal set [ find default=yes ] enc-algorithms=aes-128-cbc
/ip pool add name=dhcp ranges=192.168.88.10-192.168.88.100
/ip dhcp-server add address-pool=dhcp authoritative=after-2sec-delay interface=bridge1 lease-time=1d name=default
/ip smb users set [ find default=yes ] disabled=yes
/queue type add kind=fq-codel name=fq_codel
/queue type add cake-memlimit=32.0MiB cake-overhead=-64 kind=cake name=default-cake
/queue type add kind=pcq name=pcq-test
/queue tree add burst-limit=20971520 burst-threshold=20971520 burst-time=1m disabled=yes limit-at=18874368 max-limit=18874368 name=Master-Queue parent=bridge1 queue=pcq-download-default
/queue tree add burst-limit=90M burst-threshold=85M burst-time=1m disabled=yes limit-at=80M max-limit=80M name="Test Queue" parent=bridge1 queue=pcq-download-default
/routing bgp template set default disabled=no output.network=bgp-networks
/routing ospf instance add disabled=no name=default-v2
/routing ospf area add disabled=yes instance=default-v2 name=backbone-v2
/snmp community set [ find default=yes ] addresses=0.0.0.0/0 name=ss-snmp write-access=yes
/system logging action set 1 disk-file-name=log
/interface bridge port add bridge=bridge1 ingress-filtering=no interface=ether3-slave-local internal-path-cost=10 path-cost=10
/interface bridge port add bridge=bridge1 ingress-filtering=no interface=ether4-slave-local internal-path-cost=10 path-cost=10
/interface bridge port add bridge=bridge1 ingress-filtering=no interface=ether5-slave-local internal-path-cost=10 path-cost=10
/interface bridge port add bridge=bridge1 ingress-filtering=no interface=ether2-master-local internal-path-cost=10 path-cost=10
/interface bridge port add bridge=bridge1 interface=WiFi-2Ghz
/interface bridge port add bridge=bridge1 interface=WiFi-5Ghz
 
Part 2
Code: 
/ip firewall connection tracking set udp-timeout=10s
/ip neighbor discovery-settings set discover-interface-list=discover
/ip settings set allow-fast-path=no max-neighbor-entries=8192
/ipv6 settings set max-neighbor-entries=8192
/interface detect-internet set detect-interface-list=all
/interface list member add interface=bridge1 list=discover
/interface list member add interface=ether3-slave-local list=discover
/interface list member add interface=ether4-slave-local list=discover
/interface list member add interface=ether5-slave-local list=discover
/interface list member add interface=*6 list=discover
/interface list member add interface=*7 list=discover
/interface list member add interface=*8 list=discover
/interface list member add interface=pppoe-out1 list=discover
/interface list member add interface=bridge1 list=mactel
/interface list member add interface=ether3-slave-local list=mactel
/interface list member add interface=bridge1 list=mac-winbox
/interface list member add interface=ether4-slave-local list=mactel
/interface list member add interface=ether3-slave-local list=mac-winbox
/interface list member add interface=ether5-slave-local list=mactel
/interface list member add interface=ether4-slave-local list=mac-winbox
/interface list member add interface=ether5-slave-local list=mac-winbox
/interface list member add interface=pppoe-out1 list=WAN
/interface ovpn-server server add auth=sha1,md5 mac-address=XX:XX:XX:XX:XX:XX name=ovpn-server1
/interface pptp-server server
# PPTP connections are considered unsafe, it is suggested to use a more modern VPN protocol instead
set authentication=pap,chap,mschap1,mschap2
/ip address add address=192.168.88.1/24 comment="default configuration" interface=bridge1 network=192.168.88.0
/ip cloud set ddns-enabled=yes
/ip dhcp-server config set store-leases-disk=immediately
/ip dhcp-server network add address=192.168.88.0/24 comment="default configuration" dns-server=1.1.1.1,8.8.8.8 gateway=192.168.88.1
/ip dns set allow-remote-requests=yes max-concurrent-tcp-sessions=30 servers=1.1.1.1,8.8.8.8
/ip dns static add address=192.168.88.1 name=router type=A
/ip firewall filter add action=drop chain=input dst-port=53 in-interface=pppoe-out1 protocol=tcp
/ip firewall filter add action=drop chain=input dst-port=53 in-interface=pppoe-out1 protocol=udp
/ip firewall nat add action=masquerade chain=srcnat comment="default configuration" out-interface=pppoe-out1 src-address=192.168.88.0/24
/ip firewall nat add action=dst-nat chain=dstnat comment=";;; Disabled by Adrian as it has no destination" disabled=yes dst-port=80 in-interface=bridge1 protocol=tcp to-addresses=192.168.88.230 to-ports=80
/ip firewall nat add action=dst-nat chain=dstnat comment=";;; Disabled by Adrian as it has no destination" disabled=yes dst-port=443 in-interface=bridge1 protocol=tcp to-addresses=192.168.88.230 to-ports=443
/ip firewall nat add action=dst-nat chain=dstnat comment=";;; Disabled by Adrian as it has no destination" disabled=yes dst-port=1935 in-interface=pppoe-out1 protocol=tcp to-ports=1935
/ip firewall nat add action=dst-nat chain=dstnat comment=";;; Disabled by Adrian as it has no destination" disabled=yes dst-port=3480 in-interface=pppoe-out1 protocol=tcp to-ports=3480
/ip firewall nat add action=dst-nat chain=dstnat comment=";;; Disabled by Adrian as it has no destination" disabled=yes dst-port=8572 in-interface=bridge1 protocol=udp to-addresses=192.168.88.230 to-ports=8572
/ip firewall nat add action=dst-nat chain=dstnat comment=";;; Disabled by Adrian as it has no destination" disabled=yes dst-port=3479 in-interface=pppoe-out1 protocol=udp to-ports=3479
/ip firewall nat add action=dst-nat chain=dstnat comment="PS4 PUBG" disabled=yes dst-port=1935 in-interface=bridge1 protocol=tcp to-addresses=192.168.88.230 to-ports=1935
/ip firewall nat add action=dst-nat chain=dstnat comment="PS4 PUBG" disabled=yes dst-port=1935 in-interface=bridge1 protocol=udp to-addresses=192.168.88.230 to-ports=1935
/ip firewall nat add action=dst-nat chain=dstnat comment="PC COD MW" disabled=yes dst-port=27014-27050 in-interface=pppoe-out1 protocol=tcp to-addresses=192.168.88.20 to-ports=27014-27050
/ip firewall nat add action=dst-nat chain=dstnat comment="PSN NAT" disabled=yes dst-port=3479 in-interface=bridge1 protocol=tcp to-addresses=192.168.88.230 to-ports=3479
/ip firewall nat add action=dst-nat chain=dstnat comment="PSN NAT" disabled=yes dst-port=3479 in-interface=bridge1 protocol=udp to-addresses=192.168.88.230 to-ports=3479
/ip firewall nat add action=dst-nat chain=dstnat comment="PSN NAT" disabled=yes dst-port=49152-65535 in-interface=bridge1 protocol=udp to-addresses=192.168.88.230 to-ports=49152-65535
/ip firewall nat add action=dst-nat chain=dstnat comment="PSN NAT" disabled=yes dst-port=5223 in-interface=bridge1 protocol=udp to-addresses=192.168.88.230 to-ports=5223
/ip firewall nat add action=dst-nat chain=dstnat comment="PSN NAT" disabled=yes dst-port=3480 in-interface=bridge1 protocol=tcp to-addresses=192.168.88.230 to-ports=3480
/ip firewall nat add action=dst-nat chain=dstnat comment="Disabled as it is used by WhatsApp" disabled=yes dst-port=3480 in-interface=bridge1 protocol=udp to-addresses=192.168.88.230 to-ports=3480
/ip firewall nat add action=dst-nat chain=dstnat comment="PC COD MW" disabled=yes dst-port=4379-4380 in-interface=pppoe-out1 protocol=udp to-addresses=192.168.88.20 to-ports=4379-4380
/ip firewall nat add action=dst-nat chain=dstnat comment="PC COD MW" disabled=yes dst-port=27000-27031 in-interface=pppoe-out1 protocol=udp to-addresses=192.168.88.20 to-ports=27000-27031
/ip firewall nat add action=dst-nat chain=dstnat comment="PC COD MW" disabled=yes dst-port=27036 in-interface=pppoe-out1 protocol=udp to-addresses=192.168.88.20 to-ports=27036
/ip firewall nat add action=dst-nat chain=dstnat comment="PSN NAT" disabled=yes dst-port=3478 in-interface=bridge1 protocol=tcp to-addresses=192.168.88.230 to-ports=3478
/ip firewall nat add action=dst-nat chain=dstnat comment="Disabled as it is used by WhatsApp" disabled=yes dst-port=3478 in-interface=bridge1 protocol=udp to-addresses=192.168.88.230 to-ports=3478
/ip firewall service-port set ftp disabled=yes
/ip firewall service-port set tftp disabled=yes
/ip firewall service-port set h323 disabled=yes
/ip firewall service-port set sip disabled=yes
/ip firewall service-port set pptp disabled=yes
/ip firewall service-port set udplite disabled=yes
/ip firewall service-port set dccp disabled=yes
/ip firewall service-port set sctp disabled=yes
/ip hotspot service-port set ftp disabled=yes
/ip ipsec profile set [ find default=yes ] dpd-interval=2m dpd-maximum-failures=5
/ip service set telnet disabled=yes
/ip service set ftp disabled=yes
/ip service set www disabled=yes
/ip service set ssh disabled=yes port=2308
/ip service set api disabled=yes
/ip service set api-ssl disabled=yes
/ip smb shares set [ find default=yes ] directory=/pub
/ip ssh set ciphers=aes-gcm,aes-ctr,aes-cbc,3des-cbc,null forwarding-enabled=remote
/ip upnp set enabled=yes
/ip upnp interfaces add interface=pppoe-out1 type=external
/ip upnp interfaces add interface=bridge1 type=internal
/ppp secret add disabled=yes local-address=192.168.88.1 name=test2 profile=default-encryption remote-address=192.168.88.180 service=pptp
/routing bfd configuration add disabled=no
/system clock set time-zone-name=Africa/Johannesburg
/system clock manual set time-zone=+02:00
/system identity set name=BlahBlahBlah
/system leds add interface=ether1-gateway leds="" type=interface-activity
/system leds add interface=bridge1 leds="" type=interface-activity
/system leds add interface=ether3-slave-local leds="" type=interface-activity
/system leds add interface=ether4-slave-local leds="" type=interface-activity
/system leds add interface=ether5-slave-local leds="" type=interface-activity
/system logging add action=disk prefix=Error topics=error,packet
/system note set show-at-login=no
/system ntp client set enabled=yes
/system ntp client servers add address=196.21.187.2
/system ntp client servers add address=146.64.58.41
/system resource irq rps set ether1-gateway disabled=no
/system resource irq rps set ether3-slave-local disabled=no
/system resource irq rps set ether4-slave-local disabled=no
/system resource irq rps set ether5-slave-local disabled=no
/system resource irq rps set ether2-master-local disabled=no
/system scheduler add interval=1d name=Backups on-event="/system script run Local-Backup\r\
    \n/system script run Cloud-Backup" policy=ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon start-date=2025-02-28 start-time=03:00:00
/system script add dont-require-permissions=no name=Local-Backup owner= policy=ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon source="export terse file=usb1-part1/backup.rsc"
/system script add dont-require-permissions=no name=Cloud-Backup owner= policy=ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon source="/system backup cloud upload-file action=create-and-upload replace=[/system/backup/cloud/find 0] password=@ppl3S33d"
/tool graphing interface add interface=pppoe-out1
/tool mac-server set allowed-interface-list=mactel
/tool mac-server mac-winbox set allowed-interface-list=mac-winbox
/tool romon port add interface=all
 
Some observations @LandyMan :

Try disabling your queues to see if that makes a difference.

Set your bridge protocol to rstp:
/interface bridge set bridge1 protocol-mode=rstp

Try setting a larger MTU on your pppoe interface. Maybe try 1492 instead of 1480?:
/interface pppoe-client set pppoe-out1 max-mtu=1492 max-mru=1492

I know you said you have tried upnp, but try specifying the interfaces if you haven't already:
/ip upnp set enabled=yes
/ip upnp interfaces add interface=bridge1 type=internal
/ip upnp interfaces add interface=pppoe-out1 type=external
 
PhireSide said:
Some observations @LandyMan :

Try disabling your queues to see if that makes a difference.

Set your bridge protocol to rstp:
/interface bridge set bridge1 protocol-mode=rstp

Try setting a larger MTU on your pppoe interface. Maybe try 1492 instead of 1480?:
/interface pppoe-client set pppoe-out1 max-mtu=1492 max-mru=1492

I know you said you have tried upnp, but try specifying the interfaces if you haven't already:
/ip upnp set enabled=yes
/ip upnp interfaces add interface=bridge1 type=internal
/ip upnp interfaces add interface=pppoe-out1 type=external
Click to expand...
That export is weird. All queues are disabled, in fact, I don't even have anymore, or are you referring to the interface queues:

1743091262163.png

uPnP:
1743091280017.png
1743091293538.png

Will change the other two settings, and see what happens.

1743091430667.png
1743091450117.png

Thanks man
 
Ah okay no cool you can leave the interface queues on.

Let us know if you have any luck.
 
LandyMan said:
No luck yet unfortunately :( Thanks for trying to help!
Click to expand...
Drat.

Do you have a spare router laying around that you can use?

Thinking maybe you should nuke the config, and start off with the bare minimum config and then test and see if there is an improvement. Then add back bits and pieces as needed and test in-between to see where things fall off the wagon.
 
PhireSide said:
Drat.

Do you have a spare router laying around that you can use?

Thinking maybe you should nuke the config, and start off with the bare minimum config and then test and see if there is an improvement. Then add back bits and pieces as needed and test in-between to see where things fall off the wagon.
Click to expand...
Yeah I do. But testing is difficult, as I can test like once a night when the squad is on PS for some gaming :) Reckon for now I will just leave it as is, and deal with the party delays.
 
So I have been looking at different settings on the router, and two that popped out at me that might help:

1. Fasttrack - I am pretty sure I have this on in the original config for the queues, but it is not on now in the restored backup
Activating this should not be a big deal, as it shouldn't impact anything negatively
2. NAT-PMP
Not too sure if this will help, but it does seem it might. I am also not sure it was on previously, but worth a look

Any words of wisdom for the above two items?
 
NAT PMP is worth a try. Fasttrack disabled would mean your CPU would work harder, but not to the extent that you would get issues using voice chat IMHO unless the CPU is pegged at 100%.
 
PhireSide said:
NAT PMP is worth a try. Fasttrack disabled would mean your CPU would work harder, but not to the extent that you would get issues using voice chat IMHO unless the CPU is pegged at 100%.
Click to expand...
I enabled fasstrack now ... as it appears it will be better for CPU usage in any case, and seeing that I am not using queues (bandwidth hog not in the house anymore :) ) it might give overall improvement.
Will try NAT PMP as well, hopefully I can test tonight to see
 
LandyMan said:
I enabled fasstrack now ... as it appears it will be better for CPU usage in any case, and seeing that I am not using queues (bandwidth hog not in the house anymore :) ) it might give overall improvement.
Will try NAT PMP as well, hopefully I can test tonight to see
Click to expand...
And still the same :( Guess I just need to live with it now :)
 
I need help from smart people


How would I limit a interface like wlan or LTE to lets say 10mbps

1743952183833.png
 
Okay trying to understand this,

Trying limit my pc download speed via ip

1743953495085.png
But it does not work at all

Edit: Had to disable fast track option in firewall....
 
Last edited:
Yes, disabling Fasttrack would be a step in the right direction as it would bypass the queues with it enabled.

What you could also do is use Mangle rules to mark traffic to/from certain IP addresses or ranges, then apply a queue to that packet mark. Slightly more complex to setup, but more versatile especially if you use multiple queues, queue types, IP ranges, vlans, etc.

I have eight queues, seven of which I prioritise in order of importance (basically service-class values) and then the last being the 'scavenger' queue that handles any traffic that does not fall into the above buckets. In essence, the 7 queues get dedicated traffic to those ranges/services and then the last 'bucket' is free to get whatever bandwidth is left.
 
Anyone here had any experience with the Mikrotik range of wireless AP's? Coming from a Unifi AP AC LR, what would I miss if I got one of these?

scoop.co.za

MikroTik cAP ac Dual Band 1200Mbps WiFi 5 Ceiling AP | RbcAPGi-5acD2nD

MikroTik's RB-CAPAC is a very capable and powerful wireless access point that looks beautiful on both walls and ceilings. The concurrent dual-band wireless radio supports dual chain 2GHz and 5GHz in 802.11ac and legacy standards, and will provide coverage
scoop.co.za scoop.co.za

Having everything manageable from one system (Winbox) would be nice, but I have heard the Mikrotik stuff can be tricky to setup and get going. Also, I think the Unifi stuff has spoilt me but my unit seems to be flaking more and more lately, granted it is 7 years old now.

Probably eyeing something like the u6-Lite if I don't decide to go the Tik route.
 
PhireSide said:
Anyone here had any experience with the Mikrotik range of wireless AP's? Coming from a Unifi AP AC LR, what would I miss if I got one of these?

scoop.co.za

MikroTik cAP ac Dual Band 1200Mbps WiFi 5 Ceiling AP | RbcAPGi-5acD2nD

MikroTik's RB-CAPAC is a very capable and powerful wireless access point that looks beautiful on both walls and ceilings. The concurrent dual-band wireless radio supports dual chain 2GHz and 5GHz in 802.11ac and legacy standards, and will provide coverage
scoop.co.za scoop.co.za

Having everything manageable from one system (Winbox) would be nice, but I have heard the Mikrotik stuff can be tricky to setup and get going. Also, I think the Unifi stuff has spoilt me but my unit seems to be flaking more and more lately, granted it is 7 years old now.

Probably eyeing something like the u6-Lite if I don't decide to go the Tik route.
Click to expand...
Not too bad to setup.
But I would rather get a newer Unifi.
Use Mikrotik for routing and Unifi for WiFi.
 
You must log in or register to reply here.
Back
Top
Sign up to the MyBroadband newsletter
X