Low speeds with Omada ER707 on YouFibre

Hey folks!

I'm after some insight here, and potentially some advice.

I switched to YouFibre from Zen when they rolled out in my area (March 2024), due to them being able to offer decent upload speeds. I signed up for the 2Gbps package.

Initally, I used the supplied ASUS ET12, and as expected, got the advertised speeds. I then switched over to my TP-Link ER707, spoofed the MAC of the ASUS and again, got the expected speeds.

Over the last month, I've noticed things started slowing down quite a bit, so I raised a case with Support, and was told "a few things had been changed" and I should get my advertised speeds. Unfortunately, the issue didn't seem to be resolved. I think tried the ET12 again, and got up around 1Gbps up and down, switched back to the ER707 and got around 200Mbps down, 500Mbps up, switched back to the ET12, and got 2Gbps+ up and down.

I'd REALLY like to stick with my ER707 as the router, as I have a complete Omada LAN with distrbuted APs, VLANs, QoS for various devices, and so on.

Anyone got any ideas here? Thanks in advance!

In reply to a post by therealsn:

I'd REALLY like to stick with my ER707 as the router, as I have a complete Omada LAN with distrbuted APs, VLANs, QoS for various devices, and so on.

Anyone got any ideas here? Thanks in advance!

Forget about the ER707 as a router, use the ET12 for that. But keep the ER707 for all of the stuff you want it for, which is not core router functionality.

To do this, turn off DHCP on the ER707 and connect the ET12 into a LAN port on the ER707. You may need to know some of your network stuff to make this fully work, in essence you are connecting the ER707 and the ET12 on layer 2 rather than layer 3, so that everything is connecting at the MAC address level without requiring routing support. You will probably need to give the ER707 a lan side IP address on your chosen subnet and reserve that address in the DHCP of the ET 12.

Hmmm, I don't generally have any issues with the core router functionality of the ER707, it does everything I need. I'd rather go all Omada, or just go for the ET12 an a few unmanaged switches.

Hi There,
I have Omada Kit on YouFibre.
First question, is IPS / IDS enabled, if so please disable it to test, this feature is notorious for causing slow speeds due to the CPU overhead required.

Please then test again and let us know the speeds you get.

Are you aware of any updates or changes made to the 707, if so please let us know as we may be able to advise if it is a possible cause?

Would you be able to advise if it is also a 707-M2 or other variant and if there is a V number on the box?

Oh, wow, this has absolutely resolved the issue! Thank you so much for the guidance!

Literally, went from 200/600 with IPS/IDS on, and 1980/2006 with it off. Why on earth do TP-Link provide the option to enable a feature that takes THAT much CPU overhead?! To answer one of your questions, my 707 is the M2 version (v1). If I want to have IPS/IDS on AND get my advertised speeds, do I need to go for the 8411?

For just home use, do I need it enabled? I'm fairly good on general networking, but network security isn't something I'm super hot on, so I spotted the setting, and enabled it.

In reply to a post by therealsn:

Oh, wow, this has absolutely resolved the issue! Thank you so much for the guidance!

Literally, went from 200/600 with IPS/IDS on, and 1980/2006 with it off. Why on earth do TP-Link provide the option to enable a feature that takes THAT much CPU overhead?! To answer one of your questions, my 707 is the M2 version (v1). If I want to have IPS/IDS on AND get my advertised speeds, do I need to go for the 8411?

For just home use, do I need it enabled? I'm fairly good on general networking, but network security isn't something I'm super hot on, so I spotted the setting, and enabled it.

So It's funny you mention that, I spoke with TP LInk support about it a while back and was basically told it uses a lot of CPU but without any more details than that.

I have an ER7206 V1 and when the feature was added I wondered the same thing, but it is designed to detect and prevent in a way that normal Access list based firewalls cannot.

So around your IPS/IDS question, It's hard to say, the reason is this, I cannot find any official documentation elsewhere that advises the impact of IPS / IDS on that model.

The real question around security is, are you hosting websites / NAS's etc with public access. If yes I would consider it if possible, that being said my network has a lot of public facing servers etc the only reason I don't have IPS / IDS enabled is because of the detrimental impact to speeds.

I know if I had it on it would highlight a lot of attack attempts as I did have it on for a period of time and could see the volume of attacks being stopped.

At the end of the day if you were a business user I would say go down the Meraki / Sophos route and absolutely have it enabled if the hardware supports it.

The first thing I would look into if you haven't already is setting up implicit deny's etc on your access control lists (ACLs) as that would be a good first line, at least for home use anyway.

I have attached an article below on more details on IPS etc.

Fortinet Article on IPS

Edited by RR_The_IT_Guy (Sun 30-Jun-24 18:44:47)

Thanks so much for the insight! This is literally just home use, I have nothing public open, no ports forwarded, nothing hosted, a few WG instances configured for various devices when I'm away from home, but that's it.

I think I'm good for now, I'll dig into getting some explict ACLs set up at some point.

Not sure if this is the exact model you have.. but the specifications pages here lists the benchmarked throughput speeds for various configurations - https://www.tp-link.com/uk/business-networking/vpn-r...

For IPS it's approx 208Mbps as you have found.

Holy [censored], I didn't realise they published those specifications, thanks so much! I'll be checking those specs in future!