Mikrotik NAT halves WAN speed
I have a 951G-2HnD as a router. All connections are via ethernet cables. I observe the following:
- When I connect to the ISP via router, speed is about 270 Mbit/s, while ISP claims my plan has 500 Mbit/s speed limit.
- When I connect cable from ISP directly to ethernet port on my PC, I indeed get about 500 Mbit/s download speed.
- When I download files from another PC connected to the same router, the speed is about 900 Mbit/s which is correct for gigabit LAN.
Now because of 3, I think that the problem is not in router processing power. I suppose something is wrong with NAT processing. How do I improve speed so NAT connection is as fast as direct one? Or at least how do I debug the problem?
Just in case, I disabled all NAT rules except the main one:
/ip firewall nat chain=srcnat action=masquerade out-interface=ether1-gateway
This did not improve the speed.
David's answer is correct. To summarize, the hardware is capable of switching at the speed you got, but only routing at a fraction of that. Therefore, the problem is the routing, not just the NAT, although that probably doesn't help.
Take a look at these results for routers that should be capable of routing that much traffic:
https://mikrotik.com/product/RB750Gr3#fndtn-testresults
https://mikrotik.com/product/RB3011UiAS-RM#fndtn-testresults
Any of these three should be enough unless you're doing a large amount of very small packet routing.
Another possibility is the CHR product - you can run your router in a VM and give it as much CPU and RAM as you need. $30 covers the cost for a 1Gbps cap.
EDIT: Somehow https://mikrotik.com/product/hap_ac2#fndtn-testresults has better results than the 3011 for non-full-size packets despite having significantly less CPU and RAM, and being on the same architecture.
The 951G-2HnD has a rated peak routing speed of 250-300Mbps. It does its switching in hardware and should be able to switch at wire speed. So it sounds like you're getting roughly the performance the hardware is capable of.