Установлен RB3011UiAS. За ним 2 неуправляемых свитча гигабитных на 24 порта. Порядка 35 компьютеров. Интернет 300Мегабит/с.
Конфиг крайне простой:
Код: Выделить всё
# 2024-05-09 15:16:07 by RouterOS 7.10.2
# software id = PFH3-RU29
#
# model = RB3011UiAS
# serial number = XXXXX
/interface bridge
add admin-mac=2C:C8:1B:0C:45:43 auto-mac=no comment=defconf name=bridge \
protocol-mode=none
/interface ethernet
set [ find default-name=ether1 ] comment=WAN
set [ find default-name=ether2 ] comment="tp-link small switch"
set [ find default-name=ether3 ] disabled=yes
set [ find default-name=ether4 ] disabled=yes
set [ find default-name=ether5 ] disabled=yes
set [ find default-name=ether6 ] disabled=yes
set [ find default-name=ether7 ] disabled=yes
set [ find default-name=ether8 ] comment=nvr
set [ find default-name=ether9 ] comment=switch_big
set [ find default-name=ether10 ] comment="lan cache"
set [ find default-name=sfp1 ] disabled=yes
/interface list
add comment=defconf name=WAN
add comment=defconf name=LAN
/interface lte apn
set [ find default=yes ] ip-type=ipv4 use-network-apn=no
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
/ip pool
add name=default-dhcp ranges=192.168.88.10-192.168.88.254
/ip dhcp-server
add address-pool=default-dhcp interface=bridge lease-time=10m name=defconf
/port
set 0 name=serial0
/queue type
add kind=pcq name=pcq-download pcq-classifier=dst-address \
pcq-dst-address6-mask=64 pcq-src-address6-mask=64
add kind=pcq name=pcq-upload pcq-classifier=src-address \
pcq-dst-address6-mask=64 pcq-src-address6-mask=64
/queue simple
add dst=ether1 max-limit=250M/250M name=queue1 priority=1/1 queue=\
pcq-upload-default/pcq-download-default target=192.168.88.0/24 \
total-queue=default
/routing bgp template
set default disabled=no output.network=bgp-networks
/routing ospf instance
add disabled=no name=default-v2
/routing ospf area
add disabled=yes instance=default-v2 name=backbone-v2
/interface bridge port
add bridge=bridge comment=defconf ingress-filtering=no interface=ether2
add bridge=bridge comment=defconf ingress-filtering=no interface=ether3
add bridge=bridge comment=defconf ingress-filtering=no interface=ether4
add bridge=bridge comment=defconf ingress-filtering=no interface=ether5
add bridge=bridge comment=defconf ingress-filtering=no interface=ether6
add bridge=bridge comment=defconf ingress-filtering=no interface=ether7
add bridge=bridge comment=defconf ingress-filtering=no interface=ether8
add bridge=bridge comment=defconf ingress-filtering=no interface=ether9
add bridge=bridge comment=defconf ingress-filtering=no interface=ether10
/ip neighbor discovery-settings
set discover-interface-list=LAN
/ip settings
set max-neighbor-entries=8192
/ipv6 settings
set disable-ipv6=yes max-neighbor-entries=8192
/interface list member
add comment=defconf interface=bridge list=LAN
add comment=defconf interface=ether1 list=WAN
/interface ovpn-server server
set auth=sha1,md5
/ip address
add address=192.168.88.1/24 comment=LAN interface=bridge network=192.168.88.0
add address=XXX.XXX.XX.XX/30 comment=WAN interface=ether1 network=\
XX.XX.XXX.XXX
/ip dhcp-client
add comment=defconf interface=ether1
/ip dhcp-server lease
add address=192.168.88.236 mac-address=2C:F0:5D:CD:91:07 server=defconf
add address=192.168.88.225 mac-address=2C:F0:5D:DE:F4:1B server=defconf
add address=192.168.88.226 mac-address=2C:F0:5D:DE:DF:38 server=defconf
add address=192.168.88.227 mac-address=2C:F0:5D:DE:F3:6C server=defconf
add address=192.168.88.228 mac-address=2C:F0:5D:CD:7F:34 server=defconf
add address=192.168.88.229 mac-address=2C:F0:5D:DE:F2:EA server=defconf
add address=192.168.88.231 mac-address=1C:3B:F3:0F:55:07 server=defconf
add address=192.168.88.233 mac-address=2C:F0:5D:DE:F3:63 server=defconf
add address=192.168.88.232 mac-address=54:E1:40:DD:B6:12 server=defconf
add address=192.168.88.234 mac-address=2C:F0:5D:CD:7F:19 server=defconf
add address=192.168.88.235 mac-address=2C:F0:5D:CD:8A:B6 server=defconf
add address=192.168.88.237 mac-address=2C:F0:5D:CD:91:0E server=defconf
add address=192.168.88.238 mac-address=2C:F0:5D:D0:73:45 server=defconf
add address=192.168.88.239 mac-address=2C:F0:5D:D0:73:3E server=defconf
add address=192.168.88.240 mac-address=2C:F0:5D:CD:91:1A server=defconf
add address=192.168.88.245 mac-address=2C:F0:5D:CD:89:11 server=defconf
add address=192.168.88.246 mac-address=2C:F0:5D:D0:73:41 server=defconf
add address=192.168.88.247 mac-address=2C:F0:5D:DE:F4:45 server=defconf
add address=192.168.88.248 mac-address=2C:F0:5D:DE:F3:B4 server=defconf
add address=192.168.88.251 mac-address=2C:F0:5D:CD:88:9F server=defconf
add address=192.168.88.253 mac-address=2C:F0:5D:DE:F4:66 server=defconf
/ip dhcp-server network
add address=192.168.88.0/24 comment=defconf gateway=192.168.88.1
/ip dns
set servers=192.168.88.90,192.168.88.91,192.168.88.92,192.168.88.93
/ip firewall filter
add action=accept chain=input comment=\
"defconf: accept established,related,untracked" connection-state=\
established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=\
invalid
add action=accept chain=input comment=WinBOX dst-port=8291 in-interface=\
ether1 protocol=tcp
add action=accept chain=input comment=\
"defconf: accept to local loopback (for CAPsMAN)" dst-address=127.0.0.1
add action=drop chain=input comment="defconf: drop all not coming from LAN" \
in-interface-list=!LAN
add action=accept chain=forward comment="defconf: accept in ipsec policy" \
ipsec-policy=in,ipsec
add action=accept chain=forward comment="defconf: accept out ipsec policy" \
ipsec-policy=out,ipsec
add action=accept chain=forward comment=\
"defconf: accept established,related, untracked" connection-state=\
established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" \
connection-state=invalid
add action=drop chain=forward comment=\
"defconf: drop all from WAN not DSTNATed" connection-nat-state=!dstnat \
connection-state=new in-interface-list=WAN
/ip firewall nat
add action=src-nat chain=srcnat comment=srcnat ipsec-policy=out,none \
out-interface-list=WAN to-addresses=XX.XX.XX.XX
/ip route
add disabled=no dst-address=0.0.0.0/0 gateway=XX.XX.XX.XX
/ip service
set telnet disabled=yes
set ftp disabled=yes
set www disabled=yes
set ssh disabled=yes
set api disabled=yes
set winbox port=8291
set api-ssl disabled=yes
/lcd
set default-screen=interfaces touch-screen=disabled
/lcd interface
set ether2 disabled=yes
set ether3 disabled=yes
set ether4 disabled=yes
set ether5 disabled=yes
set sfp1 disabled=yes
set ether6 disabled=yes
set ether7 disabled=yes
set ether8 disabled=yes
set ether9 disabled=yes
set ether10 disabled=yes
/routing bfd configuration
add disabled=no interfaces=all min-rx=200us min-tx=200us multiplier=5
/system clock
set time-zone-name=Europe/Moscow
/system note
set show-at-login=no
/tool mac-server
set allowed-interface-list=LAN
/tool mac-server mac-winbox
set allowed-interface-list=LANБыл настроен примитивный QoS в виде Simple Queues (ограничение 250Мегабит) для равномерного распределения скорости между пользователями.
Так же в сети присутствует lancache сервер, который так же выполняет роль DNSа (подключен в 1гигабитный порт)
Периодически происходят проблема: один из пользователей начинает что-то качать (например, обновления WoT). Качает на скорости порядка 150Мегабит/c. По статистике в torch видно что ему не вся полоса отдается, но у остальных пользователей проиходит ухудшение пинга вплоть до потери пакетов. Загрузка CPU порядка 90%. По profile в меню CPU видно, что процессоры (2ядра, вкладка All) загружены от networking ~40%, firewall ~20% и queuing ~30%. Ошибок и дропов по портам нет.
Можно как-то улучшить ситуацию или роутер слабоват?
Правильно ли настроен QoS или лучше по каждому пользователю ограничивать скорость?
Спасибо!