Долбаюсь с проблемой: при копировании файла, допустим 5 Гб, с сервера(192.168.88.16) на клиента (192.168.87.10) или любую другую сеть отличную от сети сервера - загрузка микротика возрастает до 100% и скорость режется с гигабита до 0-200мбит(зависит от общей нагрузки на сеть).
Менял компы клиентов, менял подсети - не принесло никаких успехов. Если клиенту с проблемой назначить ip с сетки 192.168.88.0 - загрузка микротика пропадает и скорость приближена к 1 Гигабиту.
Сам микротик имеет адрес 192.168.88.254 и 192.168.89.1. Кабинеты конектятся через ethernet3. В ethernet5 воткнут свитч.
Если клиенту, который включен в свитч назначит адрес другой подсети, допустим 84.0,(и добавить адрес этой подсети в микротик, чтобы он служил шлюзом), то проблема аналогична.
В profile загрузка в категориях networking (40-60 %) и firewall (20 -30%)
Есть идеи куда копать?
Код: Выделить всё
# oct/02/2023 16:22:24 by RouterOS 7.7
# software id = NI4P-YAGM
#
# model = RB2011UiAS
# serial number = Hidden
/caps-man channel
add control-channel-width=20mhz extension-channel=disabled frequency=\
2412,2432,2452 name=channel24 reselect-interval=1d skip-dfs-channels=yes
add control-channel-width=20mhz extension-channel=Ceee frequency=\
5180,5260,5660 name=channel5 reselect-interval=1d skip-dfs-channels=yes
/interface bridge
add arp=reply-only name=bridge-guest
add admin-mac=4C:5E:0C:C0:9C:76 arp=proxy-arp auto-mac=no fast-forward=no \
name=bridge-local
/interface ethernet
set [ find default-name=ether1 ] comment=WAN_rozetka_5.7.1 name=\
ether1-gateway speed=100Mbps
set [ find default-name=ether2 ] speed=100Mbps
set [ find default-name=ether3 ] comment=LAN_rozetka_5.7.2 speed=100Mbps
set [ find default-name=ether4 ] comment=IP_Phone speed=100Mbps
set [ find default-name=ether5 ] comment=Switch speed=100Mbps
set [ find default-name=ether6 ] advertise=\
10M-half,10M-full,100M-half,100M-full,1000M-half,1000M-full comment=\
"Not used"
set [ find default-name=ether7 ] advertise=\
10M-half,10M-full,100M-half,100M-full,1000M-half,1000M-full
set [ find default-name=ether8 ] advertise=\
10M-half,10M-full,100M-half,100M-full,1000M-half,1000M-full
set [ find default-name=ether9 ] advertise=\
10M-half,10M-full,100M-half,100M-full,1000M-half,1000M-full
set [ find default-name=ether10 ] advertise=\
10M-half,10M-full,100M-half,100M-full,1000M-half,1000M-full poe-out=off
/caps-man datapath
add bridge=bridge-local client-to-client-forwarding=no local-forwarding=yes \
name=datapath1
add bridge=bridge-guest name=datapath2-guest
/caps-man security
add authentication-types=wpa2-psk encryption=aes-ccm group-encryption=aes-ccm \
group-key-update=1h name=security1
add authentication-types=wpa2-psk encryption=aes-ccm group-key-update=1h \
name=security2-guest
/caps-man configuration
add channel=channel24 country=russia3 datapath=datapath1 mode=ap name=cf24 \
rx-chains=0,1,2,3 security=security1 ssid=Hidden_2.4Ghz tx-chains=0,1,2,3
add channel=channel5 country=russia3 datapath=datapath1 mode=ap name=cfg5 \
rx-chains=0,1,2,3 security=security1 ssid=Hidden_5Ghz tx-chains=0,1,2,3
add channel=channel24 country=russia3 datapath=datapath2-guest mode=ap name=\
cfg24-guest rx-chains=0,1,2,3 security=security2-guest ssid=\
Hidden_Guest_2.4Ghz tx-chains=0,1,2,3
add channel=channel5 country=russia3 datapath=datapath2-guest mode=ap name=\
cfg5-guest rx-chains=0,1,2,3 security=security2-guest ssid=Hidden_Guest_5Ghz \
tx-chains=0,1,2,3
/caps-man interface
add configuration=cf24 disabled=no l2mtu=1600 mac-address=08:55:31:F5:58:B8 \
master-interface=none name=cap22 radio-mac=08:55:31:F5:58:B8 radio-name=\
085531F558B8
add channel=channel24 channel.frequency=2412,2472 configuration=cfg24-guest \
configuration.mode=ap .rx-chains=0,1,2,3 .ssid=Hidden_Guest_2.4Ghz \
.tx-chains=0,1,2,3 datapath=datapath2-guest disabled=no l2mtu=1600 \
mac-address=0A:55:31:F5:58:B8 master-interface=cap22 name=cap22guset \
radio-mac=00:00:00:00:00:00 radio-name="" security=security2-guest
add configuration=cfg5 disabled=no l2mtu=1600 mac-address=08:55:31:F5:58:B9 \
master-interface=none name=cap23 radio-mac=08:55:31:F5:58:B9 radio-name=\
085531F558B9
add channel=channel5 configuration=cfg5 configuration.mode=ap .rx-chains=\
0,1,2,3 .ssid=Hidden_Guest_5Ghz .tx-chains=0,1,2,3 datapath=datapath2-guest \
disabled=no l2mtu=1600 mac-address=0A:55:31:F5:58:B9 master-interface=\
cap23 name=cap23guest radio-mac=00:00:00:00:00:00 radio-name="" security=\
security2-guest
add configuration=cfg5 disabled=no l2mtu=1600 mac-address=08:55:31:F5:58:81 \
master-interface=none name=cap24 radio-mac=08:55:31:F5:58:81 radio-name=\
085531F55881
add channel=channel5 configuration=cf24 configuration.mode=ap .rx-chains=\
0,1,2,3 .ssid=Hidden_Guest_5Ghz .tx-chains=0,1,2,3 datapath=datapath2-guest \
disabled=no l2mtu=1600 mac-address=0A:55:31:F5:58:81 master-interface=\
cap24 name=cap24guest radio-mac=00:00:00:00:00:00 radio-name="" security=\
security2-guest
add configuration=cf24 disabled=no l2mtu=1600 mac-address=08:55:31:F5:58:80 \
master-interface=none name=cap25 radio-mac=08:55:31:F5:58:80 radio-name=\
085531F55880
add channel=channel24 configuration=cf24 configuration.mode=ap .rx-chains=\
0,1,2,3 .ssid=Hidden_Guest_2.4Ghz .tx-chains=0,1,2,3 datapath=\
datapath2-guest disabled=no l2mtu=1600 mac-address=0A:55:31:F5:58:80 \
master-interface=cap25 name=cap25guest radio-mac=00:00:00:00:00:00 \
radio-name="" security=security2-guest
/interface ethernet switch
set 0 cpu-flow-control=no
set 1 cpu-flow-control=no
/interface list
add exclude=dynamic name=discover
add name=mactel
add name=mac-winbox
/interface lte apn
set [ find default=yes ] ip-type=ipv4 use-network-apn=no
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
/ip hotspot profile
set [ find default=yes ] login-by=http-chap
/ip ipsec peer
add address=Hidden/32 disabled=yes name=Hidden
/ip ipsec profile
set [ find default=yes ] dh-group=modp1024
/ip ipsec proposal
set [ find default=yes ] enc-algorithms=3des pfs-group=none
/ip pool
add name=default-dhcp ranges=192.168.88.31-192.168.88.229
add name=VPN ranges=192.168.92.2-192.168.92.100
add name=pool-guest ranges=192.168.85.11-192.168.85.250
/ip dhcp-server
add add-arp=yes address-pool=pool-guest interface=bridge-guest name=\
dhcp-guest
add address-pool=default-dhcp interface=bridge-local lease-time=30m name=\
default
/port
set 0 name=serial0
/ppp profile
add change-tcp-mss=yes dns-server=192.168.88.3 local-address=192.168.88.254 \
name=l2tp remote-address=default-dhcp use-encryption=yes
/interface pppoe-client
add interface=ether3 keepalive-timeout=60 name=pppoe-out1 profile=\
default-encryption user=ppp1
/interface pptp-client
add allow=mschap1,mschap2 connect-to=192.168.89.3 name=pptp-out1 profile=\
default user=ppp1
/routing bgp template
set default disabled=no output.network=bgp-networks
/routing ospf instance
add disabled=no name=default-v2
/routing ospf area
add disabled=yes instance=default-v2 name=backbone-v2
/routing table
add fib name=Odoo_Output
/snmp community
set [ find default=yes ] addresses=192.168.88.0/24 name=bits
/system logging action
set 0 memory-lines=100000
set 1 disk-file-count=20 disk-lines-per-file=10000
/caps-man access-list
add action=accept allow-signal-out-of-range=always disabled=no interface=all \
mac-address=00:00:00:00:00:00 signal-range=-79..120 ssid-regexp=""
add action=reject allow-signal-out-of-range=always disabled=no interface=all \
mac-address=00:00:00:00:00:00 signal-range=-120..-80 ssid-regexp="" time=\
0s-1d,sun,mon,tue,wed,thu,fri,sat
add action=reject allow-signal-out-of-range=always disabled=yes interface=any \
mac-address=00:00:00:00:00:00 signal-range=70..120 ssid-regexp="" time=\
0s-1d,sun,mon,tue,wed,thu,fri,sat
/caps-man manager
set enabled=yes
/caps-man provisioning
add action=create-dynamic-enabled hw-supported-modes=b,g,gn \
master-configuration=cf24 name-format=prefix-identity name-prefix=2.4Ghz \
slave-configurations=cfg24-guest
add action=create-dynamic-enabled hw-supported-modes=a,an,ac \
master-configuration=cfg5 name-format=prefix-identity name-prefix=5Ghz \
slave-configurations=cfg5-guest
/interface bridge port
add bridge=bridge-local ingress-filtering=no interface=ether2
add bridge=bridge-local hw=no ingress-filtering=no interface=ether4
add bridge=bridge-local hw=no ingress-filtering=no interface=ether5
add bridge=bridge-local ingress-filtering=no interface=ether6
add bridge=bridge-local hw=no ingress-filtering=no interface=sfp1
add bridge=bridge-local ingress-filtering=no interface=ether7
add bridge=bridge-local ingress-filtering=no interface=ether8
add bridge=bridge-local ingress-filtering=no interface=ether9
add bridge=bridge-local ingress-filtering=no interface=ether10
/ip firewall connection tracking
set enabled=yes tcp-syn-received-timeout=30s tcp-syn-sent-timeout=30s
/ip neighbor discovery-settings
set discover-interface-list=discover
/ip settings
set max-neighbor-entries=8192
/ipv6 settings
set disable-ipv6=yes max-neighbor-entries=8192
/interface l2tp-server server
set authentication=mschap2 default-profile=l2tp enabled=yes use-ipsec=\
required
/interface list member
add interface=sfp1 list=discover
add interface=ether2 list=discover
add interface=ether3 list=discover
add interface=ether4 list=discover
add interface=ether5 list=discover
add interface=ether6 list=discover
add interface=ether7 list=discover
add interface=ether8 list=discover
add interface=ether9 list=discover
add interface=ether10 list=discover
add interface=bridge-local list=discover
add interface=pppoe-out1 list=discover
add interface=pptp-out1 list=discover
add interface=ether2 list=mactel
add interface=ether3 list=mactel
add interface=ether2 list=mac-winbox
add interface=ether4 list=mactel
add interface=ether3 list=mac-winbox
add interface=ether5 list=mactel
add interface=ether6 list=mactel
add interface=ether4 list=mac-winbox
add interface=ether7 list=mactel
add interface=ether5 list=mac-winbox
add interface=ether6 list=mac-winbox
add interface=ether7 list=mac-winbox
add interface=ether8 list=mactel
add interface=ether8 list=mac-winbox
add interface=ether9 list=mactel
add interface=ether9 list=mac-winbox
add interface=ether10 list=mactel
add interface=ether10 list=mac-winbox
add interface=sfp1 list=mactel
add interface=sfp1 list=mac-winbox
add interface=bridge-local list=mactel
add interface=bridge-local list=mac-winbox
/interface ovpn-server server
set auth=sha1,md5
/interface pptp-server server
# PPTP connections are considered unsafe, it is suggested to use a more modern VPN protocol instead
set default-profile=l2tp max-mru=1460 max-mtu=1460
/ip address
add address=192.168.88.254/24 comment="default configuration" interface=\
bridge-local network=192.168.88.0
add address=192.168.89.1/24 interface=ether3 network=192.168.89.0
add address=Hidden/30 comment="Static IP" interface=ether1-gateway \
network=Hidden
add address=192.168.88.249/24 comment="default configuration" disabled=yes \
interface=bridge-local network=192.168.88.0
add address=192.168.85.1/24 comment="Guest subnet" interface=bridge-guest \
network=192.168.85.0
add address=Hidden/30 comment="Static IP" interface=ether1-gateway \
network=Hidden
add address=192.168.84.254/16 comment="\C4\EB\FF \F8\EB\FE\E7\E0 Bitrix24" \
interface=bridge-local network=192.168.0.0
add address=192.168.100.254 disabled=yes interface=bridge-local network=\
255.255.255.0
/ip dhcp-client
add comment="default configuration" interface=ether1-gateway
/ip dhcp-server config
set store-leases-disk=30m
/ip dhcp-server network
add address=192.168.85.0/24 dns-server=77.88.8.88 gateway=192.168.85.1 \
netmask=24
add address=192.168.88.0/24 comment="default configuration" dns-server=\
192.168.88.3 gateway=192.168.88.254
/ip dns
set servers=77.88.8.88,77.88.8.2
/ip dns static
add address=192.168.89.1 name=router
/ip firewall address-list
/ip firewall filter
add action=accept chain=input comment=L2TP dst-port=1723 protocol=tcp
add action=accept chain=input protocol=gre
add action=drop chain=input disabled=yes dst-address=Hidden dst-port=\
8291 protocol=tcp
add action=drop chain=forward comment=Block_Internet disabled=yes \
out-interface=ether1-gateway src-address=192.168.88.4
add action=drop chain=input dst-address-list=local dst-port=53 in-interface=\
ether1-gateway protocol=udp
add action=accept chain=input comment="default configuration" protocol=icmp
add action=accept chain=input comment="default configuration" \
connection-state=established,related
add action=drop chain=input src-address=212.98.179.133
add action=drop chain=forward src-address=212.98.179.133
add action=drop chain=forward src-address=91.132.58.20
add action=drop chain=forward src-address=91.132.58.102
add action=drop chain=forward src-address=45.134.144.119
add action=accept chain=input dst-port=500,1701,4500 in-interface=\
ether1-gateway protocol=udp
add action=accept chain=forward dst-port=15000 log=yes log-prefix="UDP KSC" \
protocol=udp
/ip firewall nat
add action=masquerade chain=srcnat comment="default configuration" \
out-interface=ether1-gateway
add action=dst-nat chain=dstnat comment=Kaspersky_Security_Center \
dst-address=Hidden dst-port=\
8060,8061,8080,13000,13111,13291,13299,14000,15000,17000 protocol=tcp \
to-addresses=192.168.88.10
add action=dst-nat chain=dstnat dst-address=Hidden dst-port=\
13000,15000,15001,15111 protocol=udp to-addresses=192.168.88.10
add action=dst-nat chain=dstnat comment=Bitrix_WAN dst-address=Hidden \
dst-port=22,25,80,443,5222,5223,8890,8891,8893,8894 in-interface=\
ether1-gateway protocol=tcp to-addresses=192.168.84.11
add action=dst-nat chain=dstnat comment=1C_VM_Supermicro_#2 dst-port=8830 \
in-interface=ether1-gateway protocol=tcp src-address-list=by_pool \
to-addresses=192.168.88.30 to-ports=3389
add action=dst-nat chain=dstnat comment=Audit_Supermicro_#1 dst-port=54306 \
in-interface=ether1-gateway protocol=tcp src-address-list=by_pool \
to-addresses=192.168.88.6 to-ports=3389
add action=dst-nat chain=dstnat comment=Host_Supermicro_#1 disabled=yes \
dst-port=54301 in-interface=ether1-gateway protocol=tcp src-address-list=\
by_pool to-addresses=192.168.88.1 to-ports=3389
add action=accept chain=srcnat comment=Tunnel disabled=yes \
dst-address=Hidden.0/24 src-address=192.168.88.0/24
add action=accept chain=srcnat disabled=yes dst-address=192.168.88.0/24 \
src-address=Hidden.0/24
add action=dst-nat chain=dstnat comment=Win10_Act dst-port=1688 protocol=tcp \
src-address-list=by_pool src-port="" to-addresses=192.168.88.6 to-ports=\
1688
add action=dst-nat chain=dstnat comment="Local server access by external ip" \
dst-address=Hidden dst-port=8830 in-interface=!ether1-gateway \
protocol=tcp to-addresses=192.168.88.30 to-ports=3389
add action=masquerade chain=srcnat dst-address=192.168.88.30 dst-port=3389 \
protocol=tcp src-address=192.168.88.0-192.168.91.254
/ip ipsec identity
add disabled=yes peer=Hidden
/ip ipsec policy
add disabled=yes dst-address=Hidden.0/24 peer=Hidden src-address=\
192.168.88.0/24 tunnel=yes
/ip route
add disabled=no dst-address=192.168.90.0/24 gateway=192.168.89.2
add disabled=no dst-address=192.168.91.0/24 gateway=192.168.89.3
add disabled=yes dst-address=192.168.91.0/24 gateway=ether3
add disabled=yes dst-address=Hidden/32 gateway=Hidden
add disabled=yes dst-address=Hidden/32 gateway=Hidden
add comment=" (Need NAT + IPSEC rules)" disabled=yes \
dst-address=Hidden.0/24 gateway=bridge-local
add disabled=no dst-address=192.168.87.0/24 gateway=192.168.89.4
/ip service
set telnet disabled=yes
set ftp disabled=yes
set www disabled=yes
set ssh disabled=yes
set api disabled=yes port=161
set winbox address="192.168.88.0/24,192.168.89.0/24,192.168.87.0/24"
set api-ssl disabled=yes
/ip ssh
set allow-none-crypto=yes forwarding-enabled=remote
/lcd
set default-screen=stat-slideshow enabled=no read-only-mode=yes touch-screen=\
disabled
/ppp aaa
set use-radius=yes
/ppp secret
add comment="\D1\EE\F2\F0\F3\E4\ED\E8\EA \E2 \CF\EE\EB\FC\F8\E5" name=\
vitali.pryiomka profile=l2tp service=l2tp
add comment="\D1\EE\F2\F0\F3\E4\ED\E8\EA \E2 \C3\F0\F3\E7\E8\E8" name=\
marina.abramovich profile=l2tp service=l2tp
add comment="IT \F1\EF\E5\F6\E8\E0\EB\E8\F1\F2" name=pavel.dyachuk profile=\
l2tp service=l2tp
add comment="\D1\EE\F2\F0\F3\E4\ED\E8\EA \E2 \CF\EE\EB\FC\F8\E5" name=\
darya.bulanda profile=l2tp service=l2tp
add disabled=yes name=Valentina.Skuratovich profile=l2tp service=l2tp
/radius
add address=192.168.88.3 disabled=yes service=ppp
/routing rule
add action=lookup disabled=yes src-address=192.168.88.215 table=Odoo_Output
add action=unreachable disabled=no dst-address=192.168.88.0/24 src-address=\
192.168.85.0/24
add action=unreachable disabled=no dst-address=192.168.85.0/24 src-address=\
192.168.88.0/24
/snmp
set contact= location=Minsk trap-generators="" trap-version=2
/system clock
set time-zone-autodetect=no time-zone-name=Europe/Minsk
/system identity
set name=MikroTik_2011UiAS_507
/system logging
set 0 action=disk
set 1 action=disk
set 2 action=disk
/system ntp client
set enabled=yes
/system ntp client servers
add address=88.147.254.235
add address=109.195.21.104
/tool bandwidth-server
set authenticate=no enabled=no
/tool mac-server
set allowed-interface-list=mactel
/tool mac-server mac-winbox
set allowed-interface-list=mac-winbox
/tool romon port
add
/tool sniffer
set file-limit=10000KiB filter-interface=all filter-port=15000 memory-limit=\
1000KiB
