I've been a MikroTik fan since the beginning of my career some 15 years ago now. I have used the MikroTik router and Ubiquiti AP combination ever since. With that said, I can absolutely agree that their UX is terrible for anyone who doesn't specifically know how to configure a MikroTik router. The fact that you have to configure FQ-CoDel yourself and some bufferbloat protection isn't just a built-in option is absurd for anyone using it as a home router.
They have an increasingly capable "simple" UI for casual users. It seems like improving it is on their roadmap, as they've been delivering vast improvements in functionality with each major release.
Also, shipping winbox on all platforms has been a huge QoL improvement
Don't get me wrong, they make powerful and feature-complete stuff, but their UI sort of assumes you really know what you're doing. I don't know what I'm doing.
But my LLM does. I've been able to set up site-to-site VPNs with Mikrotik in fifteen minutes now, rather than the day-long exercise of googling and praying.
I did not know about it, but it's actually linked in the LLM friendly doc [1].
Seems like some rules around being able to use parsing tools such as regex, and general formatting.
LLMs certainly help out - in my case, agent helped with searching through various web forums about how my ISP authenticates and sets up Internet connection.
Nevertheless let's give MikroTik, where it's due:
* new documentation page is much cleaner to browse
* tutorials on their YouTube channel are quite informative
* WinBox v4 has in my opinion much more pleasent UX/UI than v3
That's also my problem. My colleague tells me that it's very easy to setup, but he's a network engineer and knows what things are.
Mikrotik seems to operate in an interesting area between high-end home-labing and the SME market. Without preexisting networking knowledge at a certain level, their documentation isn't all that helpful. I'm sure you can learn from the documentation, YouTube videos and trial and error, but if like me you get a few hours once in a while to take down your home network and get it back up it's going to take a while to gain the required knowledge. I really want an addition internet connection so I can play with this stuff.
On the negative, I'd say it's pretty clear that Mikrotik want you do buy training. It feels like some information is withheld by those with the certifications and Mikrotik and the UI isn't helping you much to figure out stuff on your own.
Plus the routeros supports exporting all settings directly as text file. so you can really export the whole system, send it to llm and ask it to edit. install the new rule.
in worst case you just install the old rule back if it fuck up, no really damage can happen.
Mikrotik is really a sweet spot for routers. It's feature-rich and it has a nice Web UI (or WinBox that is now cross-platform). And Mikrotik as a company is just amazing; they still support hardware that is almost 15 years old.
Other routers:
1. OpenWRT is a bit too basic, and updates are hit-and-miss.
2. Ubiquity is a bit too Apple-like, with its reliance on apps and integration.
3. Cisco is WAY too expensive, and too complicated to set up without having Cisco experience.
I'm now eagerly waiting for them to release the next generation of their routers. hEX Pro looks perfect to replace my aging CCR2004.
I was thinking the same thing. I switched from Mikrotik to OWRT because I wanted actual Linux, not a nerfed version of it that made scripting miserable.
on the other hand i got a mikrotik a while back and while setting it up it was silently phoning home.
I installed openwrt and then installed it on many mikrotik routers over the years. to be honest, not so much traditional routers (wifi+4-5 ports) but on ~10 port mikrotik switches for my infra.
i've since been switching to zyxel gs1900-* switches (up to 48 ports with openwrt)
> on the other hand i got a mikrotik a while back and while setting it up it was silently phoning home
Yes, I think it connects to the mikrotik cloud automatically to setup a usable external DNS to your device, but I believe access to it is turned off by default unless you turn it on.
I absolutely loved vyos but after their repeated hostility towards non paying users I moved to mikrotik for my routers (already had mikrotik switches).
First they stopped publishing LTS images, telling users to build from source. So people built gh repos you could clone and build with actions. Then they stopped making lts builds reproducible and told free users to use the preview release. But the preview release doesn’t get security updates. So if there’s a vulnerability you’re SOL until the next release which could be months. Not really tenable for an edge device for me and I’m not very interested in being a user of a product that does not want me.
Rolling release is actually the closer to bleeding edge version, I have been running fine with it. You can just set VyOS to auto update in the config if you want.
Isn’t it a subscription? And super expensive? $3k/year/device was the cheapest thing I saw on their site or $12k/5 years. 25k/year for an MSP. On a 5 year cycle we’d need to manage thousands on devices to make it more attractive than pfsense (cost wise).
I really wanted to try it a few years ago but they seem like just another tech company that only wants millionaire customers.
Rolling release has zero issues for me and is completely free.
If you want LTS(or you can just pin a rolling release around the same build) you can pay for a support contract. Similar to proxmox. The no-subscription product works just fine.
It should be doable by most software engineers. They did teach some basic CCNA course in the university as part of computer science studies and the concepts taught there should help a lot with configuring any router, including RouterOS. It could also be helpful to watch some guides on routing and firewall on Linux, since RouterOS is just Linux with a very specific UI on top.
There is a safe mode built in. If you enable it and you loose connection to the router due to some misconfiguration, it will reset within 15 minutes to the point of where you started the safe mode session. Also if you mess up the IP layer, there is a chance that you can still connect and configure RouterOS through their WinBox program using the mac address.
Yeah, it's inconvenient when the [effectively] black-box router device that only the bot understands goes out to lunch, and takes access to the bot along with it.
But the degree of inconvenience is up to the beholder.
One way is using something like ChatGPT with a pocket supercomputer. It's tedious to get technical stuff done that way, but it can be accomplished. (For those who haven't tried it, the bot can be spooky-good at correctly interpreting cell phone photos of technical text on a screen. This saves a ton of transcription effort.)
Another way is with the phone's hotspot and just about any random computer. Laptops have wifi. Wifi dongles for desktops can be stupid-cheap, and it's useful to have a few scattered around. It works fine (unless one's hotspot data is ridiculously-limited, I guess).
The best way is probably by being prepared with procedural fall-back methods. Keep backups of your configs, and keep the recovery instructions with them. Test recovery; an untested backup isn't necessarily better than having no backup at all. Keep as many historical versions as one wishes, and automate it because procrastination is part of the human condition.
After that: When the router's config gets stuffed up, then the backups and the restore instructions are right there. Just pick an appropriate backup and use it.
We should probably be keeping backups of important stuff like that even in the absence of LLMs. Humans also err, and stuff does break, and what seemed obvious six months ago when we were in the groove might be impossible to remember when we need it today.
Just use linux! Why use someone else's non FOSS, locked down linux, when you could truly own your router?
It's a great educational experience I would recommend to anyone interested in networking. Grab debian, grab a system with 2 NICs, make it your router/firewall/gateway.
> Grab debian, grab a system with 2 NICs, make it your router/firewall/gateway.
The problem with this (assuming you meant a generic (x86?) system) is that you won't get wire speed processing (no hardware offloading), so network performance will suffer. Unless you buy a dedicated router board (which is typically ARM), like say something like the Banana Pi BPI-R4. But installing/configuring a standard distro line Debian for such a board would be a PITA (if you want to do it right and set it up optimally), so you're better off using a dedicated router distro like OpenWRT.
I’ve not tried with 10gbps or faster links, but since we’re talking home use my success with 2.5 gbps links on standard amd64 hardware would suggest you’re wrong.
Modern CPUs are quite capable. The problem isn’t performance, but power use.
That's bogus unless you're talking above 10G, in which case the only things typically doing wire level performance are expensive and sold by vendors like Cisco, Juniper or Arista (and maybe it's higher than 10G now). Frankly, the vast majority of ARM based routers, unless you go out of your way, are garbage. Any x86 built in the last 15+ years with a NIC that's also not trash _will_ push at least 1G routed with a non-trivial firewall on a modern Linux kernel no problem. I've still got half a dozen PC Engines APU2 boards that unequivocally will get right at 1G on Debian Trixie; newer ewaste like Dell Wyse thin clients or Optiplexes would absolutely smoke those boards on performance.
Setting up a router with Debian is really kind of overstated in terms of difficulty, and frankly half of everything wraps Debian anyways (looking at you Ubiquiti/Vyatta), so why learn someone else's half cooked configuration language when you can just do the real thing.
Is this a problem with home networks? I have pfsense installed on some mini PC I bought off Amazon.
Setting up Debian as a router might take some effort but it's certainly not difficult. Enabling routing is a single line config change, install dhcpd and you're almost there. I'd certainly recommend the router OS.
I’ve been running a Supermicro X10SLH-LN6TF as my router, and it’s very well suited for the job. Power use is very high for a home router, but reasonable for a 1U router - especially considering the era it’s from and its capabilities (routing 5-8Gbps per stream depending on firewall config, able to handle a couple active streams, and line rate routing with no firewall).
I wouldn’t suggest anyone buy something like this today for home use, but 6 years ago when I purchased it there were not many 10GbE routers to be had period, let alone for the price ($300 roughly if I remember correctly ). Even considering the cost of power over the last 6 years, I still come out much cheaper than if I’d bought something more power efficient new at the time.
FWIW, I got 10 Gbit at home 2 years ago and built my router for $100 using a ThinkCentre M720q Tiny running on a Core i3-8100T (a mini-PC from 2019).
It draws around 15W idle, going up to 30W at full bore. For comparison, the 10G rental router from the ISP drew 15W no matter what (idle or full bore routing). This is with a 10GBase-T SFP+ which probably influences the power draw vs using a DAC.
It has no issues maxing out at 9.4 Gbit routing with a single or multiple streams of iperf3 with your basic IPv4 NAT+some port forwards config.
A 15 year old 1ghz quad core (apu2) can route gigabit just fine, passively cooled. An N150 can do 2.5gbit, probably 10gbit but i haven’t personally tried.
Using Openwrt is fine but doesn’t quite match the educational experience of starting from a scratch Debian.
Yeah, I will concede the hardware is nice and they offer things nobody else really does. Which makes it even more of a shame that I can’t install my own OS properly on it.
Fwiw I like protectli’s boxes. Not quite as featureful nor as cheap but it’s great kit.
Bingo. I use Mikrotik for my switches. They were the first I found that had 10Gb uplinks, inexpensively and with low power usage. L2 configuration is janky (like every other switch) but workable. I use both SwOS and ROS, but moving towards ROS for dot1x (unfortunately inescapable to have that functionality on the switch).
But the actual router? That lives on NixOS in a virtual machine on a generic amd64 machine that also runs NixOS. I'd rather design / perfect my config once in terms of iproute2/nftables and know I can swap in any hardware. I've got a full policy routing setup that let's me define for each device what Internet horizon it can see (along with what other local devices it can access).
I also find the sibling comment mentioning routing speed to be funny. I've found that unencrypted gigabit WAN is easily handled by most amd64 computers. 10Gb LAN->LAN hairpin routing seems fine. But the big thing is doing gigabit OpenVPN/wireguard, which off the shelf hardware-accelerated routers just don't really do unless you spend a lot. (coupled with the above policy routing, I can configure things like this particular web browsing VM goes out a data center IP that rotates every day).
Wireless APs are similarly handled by hostapd on NixOS, driving (mostly) Mikrotik MiniPCIe Wifi cards. I don't really need the latest and greatest wifi gen, rather I just need them to work and be as maintenance-free as possible.
>Why use someone else's non FOSS, locked down linux, when you could
All my life I have had to make do with junk I could get at Walmart or Best Buy. Got tired of it. Cheap plastic shit that would inevitably shit the bed just a month or two after the warranty expired. I'm not making the IT helpdesk wages I was making 30 years ago... fuck that. While I couldn't spend ten grand on home networking, I could finally spend a little something on hardware that's not total shit.
Got the CCR2004-16G-2S+. No stupid ONTs, either, just the SFP+ modules. Plenty of backup 1gig ports if I get a third WAN (thinking about getting Starlink on standby). Actual proper fucking APs that do seamless handoff (hell, one of them probably covers the footprint of my house, if I'm honest). And no more shitty GUI configuration pages. I just shell in and band out commands on the command line (at least three times til I get the syntax right, but who gives a fuck).
Wish they made something with 3 or 4 SFP+ ports that I didn't need a rack for.
Ubiquiti unifi has struggled to integrate routing as reliably and as well as the wireless and switching piece. Mikrotik router and unifi everything else has kind of been my go-to for at least 10 or 12y now.
I can't speak for the more "entreprise-y" unifi stuff but the routing on the ubiquiti gear i've used is actually just FRR and if you SSH in you can do a whole lot more than is surfaced through the UI - for example, I have VXLAN running on my UDR7 right now.
It's not something I've tried but I imagine you could actually expose FRR directly and configure through that
For a long time if you made any changes through the web UI it would overwrite the config. Then you could make changes and it would save. Then they removed it. Then they added it back but it didn't always work. Not sure the current state.
I have like a ~15y history of working with their stuff.
How is the ipv6 situation these days? I left Ubiquiti 2 years ago because I needed to be able to configure the /56 I got from my isp. The unifi controller was pathetic in what it could do.
I'm new to Ubiquiti routers, but I had no problem dividing the /60 I got from my ISP and assign /64s to VLANs.
You might be interested in https://www.youtube.com/watch?v=KZpJvpm1Ris (title: Does UniFi FINALLY support IPv6 Properly? State of IPv6 with Unifi Network v9). The video is about a year old, but from the looks it's not terribly outdated.
I use tp-link everything. I have all of them connected to self-hosted Omada controller in docker. Works like a breeze, including notifications. Used MikroTik before but "the dude" or whatever is called now was hit and miss. Probably you don't need it anymore if get llm to configure it.
I am glad, I am 99% sure it's the case, that I don't have to do CGNAT with ATT. Sounds like a pain.
I like ipv6 but I have been thinking of disabling it lately because i cannot technically setup static leases with ipv6 like i can with ipv4, so technically the ipv6 for one of the services in my homelab could change and cause problems.
Android (phones, tv boxes) doesn't respect DHCPv6 IA_NA, but it should respect DHCPv6 IA_PD. Unless you have some other system that doesn't respect DHCP? Linuxes, Windowses, Playstation 5's support DHCPv6 IA_NA without problems.
But also, even if a device doens't support DHCPv6 IA_NA, you can always also have a DNS server in your network, and you can bind SLAAC-generated Android addresses to simple subdomains. This seems better than DHCP anyway.
I gave it a shot but I really didn't see any benefit over OpenWRT which is plain old Linux.
There's also some really good value hardware that you can install OpenWRT on, I picked up a Xiaomi AP for like $30, flashed OpenWRT and it works great.
One thing that frustrates me about MikroTik and OpenWRT too, is a lot of things require multiple steps to set up, like adding a port forward with hairpin isn't just one click, adding a VLAN requires adding stuff in like 5+ different places.
I really liked using Opnsense before I switched to Openwrt and I always want to go back, because it was just so much more streamlined and easy to configure from a 'geek but not a network engineer' perspective.
I use a mikrotik at home, and I always get a review from Claude after making config changes.
I actually used to be a network engineer (many decades and career reinventions ago), and I appreciate that Mikrotik exposes all of the layers and connections between them.
But damn if Claude doesn’t always find something I got wrong in the config.
From some time, I had a though about getting my home-lab. Prior to that, I've decided to prepare my networking for it and ditch the router given by my ISP for MikroTik to optimise the network. It turned out it's not easy - why? Check it out on my latest blog post!
I love Mikrotik products but they are lacking what I need at home.
I need basic IPS/IDS, notification when something is wrong without writing mikrotik scripts, easy backup failover, etc not VxLAN, QinQ and BGP extensive filtering :)
I moved to Unifi Cloud Gateways as home/small soho routers and can't be happier.
But Mikrotik stays as emergency hardware backup ..
Mikrotik is not a mere replacement for plug and play routers such as TP-Link and the like. It's a very advanced device offering countless networking features, including multiple VPN server options, advanced Layer 2/bridging/switching features - VLANs, nested VLANs (Q-in-Q), VXLAN, spanning tree protocols (STP, RSTP, MSTP), 802.1x authentication, bridge-based firewall and bridge-based NAT, data center bridging (a.k.a. "lossless Ethernet"). Advanced Layer 3 features such as BGP, policy routing, traffic shaping, VRRP, hardware layer 3 acceleration. Then containers, matter/thread protocols, mesh networking, advanced wi-fi features such as centrally-managed network (CAPSMAN), multiple/virtual access points, hotspots, and many many more. Advanced firewall for both IPv4 and IPv6. On top of that scripting, SSH server, NTP server, DNS cache. API client for advanced integrations, and built-in scheduler, packet sniffer for troubleshooting, safe mode for automatic rollbacks of recent changes in case when the admin gets cut off due to a dangerous change. It'd be really hard to enumerate all that RouterOS offers.
And all that is available from tiny home/SMB office devices starting at 40 USD, through dedicated wireless point to point bridges, to a big Ethernet switches/routers with 400G interfaces.
Of course it doesn't compete with high end NVIDIA Spectrum-X, Cisco or Juniper, but is good enough for 95% of networks.
It works great as a plug&play home/office router, too thanks to Quick Set, but for more sophisticated setups, a knowledge of networking protocols is mandatory. The more fancy setup, the more in-depth knowledge is required. Just like with programming and all stuff in life.
mikrotik is great for the tech enthusiast who wants to test things out or use enterprise grade hardware but without the enterprise grade cost (no license fees) but this also means you're missing the enterprise grade support. The equipment is a fantastic deal for what you get but you need to know what you're doing to get the best performance out of it.
Frustratingly I couldn’t find a Mikrotik that would offer me a few SFPs, and a 2.5 or two. I wanted ideally just 3 SFPs - two WAN for LB / Failover and one up to switch. 2.5g WAN would do but would rather SFP for future use.
crs305 will choke when you start asking it to do NAT. it's a switch. It should be able to hardware-route between VLANs but it's not made for "home router" duties.
CRS is the switch product line and you would not believe how many professional network engineers do exactly as you have suggested and installed a CRS and asked why it locks up when routing.
CRS are L3 switches; they are supposed to route and run dynamic routing protocols and do ECMP and all the good stuff so long as you dont configure features like nat and firewall that require the cpu and cant be offloaded.
The one thing that it frustratingly does not support that I wish it did is stateless bgp with ipv4 prefixes. It cant offload an ipv4 packet with an ipv6 next hop.
Each of the mikrotik switches even comes with a block diagram linked on its product page, showing for instance a single 1.3 Gbps between its L2 switch chip and its CPU.
>I really would question any "professional" network engineer that can't tell the difference between a switch and a router...
Oh the stories I could tell you.
I once had to work with a guy who didnt believe in dynamic routing.
Which wouldn't have been too bad but he also didnt believe in route summarisation or any kind of planning. So the network was carved up into random unpredictable blocks.
He sadly did very much believe in Mikrotik scripting, and so had scripts setup to disable/enable static routes based on very broad (often external) reachability criteria.
Whenever googles DNS had an issue the whole network would start flapping scripts like nobodies business.
The network was a large wisp with more than 600 pops and more than 10000 customers on its various services.
That engineer had been gainfully employed by multiple ISPs over 20 years.
I've had supposedly credible professional network engineers send me their PRIVATE ssh keys for access to something more than once. As a response to "please send me your ssh key for access to $THING"
It's not, really, it's a basic commodity CPU with some RAM for the purposes of running the OS and management plane, glued to a layer 2 switch chip by a very narrow bandwidth path. A mikrotik switch such as this isn't intended to be used for any of the real layer 3 features of mikrotik routeros like routing, nat, ospf, bgp, mikrotik's own weird EoIP tunnels, etc.
The problem is that people might login to it for the first time and see all of the feature set of RouterOS v7 available to them to start configuring things from the ssh CLI or web GUI. It might look the same at first glance as something that is actually a small router like the RB760IGS.
It would probably be better if mikrotik included some kind of red text warning "this is not really a router" if people start entering layer 3 stuff into it (other than its own management IP, SNMP, NTP servers, etc).
Same concept for the other very cheap mikrotik switches that are like 4 or 8 ports of 1000BaseT.
It's still that, capability matters. Even with enterprise products like Cisco you'll need to look at hardware diagrams to understand limitations, some you won't find out unless you test or pay for an expensive support contract and can ask specific questions.
If you enable Queues AND Firewall Filters you will be down below 500M of throughput. Potentially less. If you ask this thing to do anything complex its going to shit itself.
Now have a look at the block diagram. Note that the internal link between the 800MHz processor and the switch chip shows 1.3G.
It would be an embarrassing cock up to deploy this as a router for a client. Even if you only need 1.3G of routing, there are better products.
Just like most enterprise network products. Sometimes it's not enough to look at hardware diagrams, need to test or have an expensive support contract and the ability to ask the right questions to understand limitations.
In Poland, Play.pl sets up IPv6 by default. One phone call to ISP to disable the hidden firewall on their router gives us full IPv6 network transparency, no NATs are needed anymore. I highly recommend after installing a firewall appliance (for example OPNsense, but probably Mikrotik should have it as well). IPv6 "feels" like how networks should work since the beginning. IPv4 feels like a legacy technology.
They of course also have a DS-Lite AFTR gateways to tunnel the IPv4 traffic. In practice, everything works (for me at least).
I love MikroTik, but ffs just let me install something else on it. SONiC or any other Linux would be awesome. I love their hardware, but their software is absolutely awful.
Is there any manufacturer out there who produces high quality hardware that is not locked down?
Four devices is not "most". You had me excited that I might be able to abandon the proprietary UIs on my CRS326/CSS326. And I know those aren't the "real router" devices, but Mikrotik certainly refers to them as routers.
Oh damn. I had just gone up one level from your first link (to https://openwrt.org/toh/mikrotik/start) and saw a small list of 4. RB450 was on there (which I used to run), so I figured it was mostly accurate.
That table is a much longer list! Still no love for my CRS/CSS, but it does look like that's probably most of the RB devices that Mikrotik actually intends for use as routers (rather than L3 switches).
note: That page has a link "Supported by current OpenWrt release" but it doesn't include the latest version! So it too could lead someone to conclude many fewer devices are supported.
Sometimes having generic Linux capabilities on network equipment makes it hard to understand the configuration. On RouterOS you can just /export the configuration and read a single file. On Linux/SONiC there are multiple ways to do the same thing - you can do one part of configuration using ifupdown, then make some changes in systemd-networkd, a bunch of shell-script DHCP client hooks, rc.local, cron @reboot. Imagine being handed over a router that someone has fixed by doing some runtime reconfiguration (like `ip ro replace default via 192.168.0.1 advmss 1410`) that would vanish with almost no trace (except maybe .bash_histotry) when you reboot it - that won't be possible (without doing very special scheduler/script trickery) on RouterOS.
But if you still want it, MikroTik doesn't try too hard to prevent you from running modified software. You can port OpenWrt, and most modern MikroTik devices use modern enough Linux to use a device tree blob. Try pulling out a dtb from your firmware and ask an LLM to do the initial porting - just don't forget to backup your RouterOS license key first, they are device specific.
Yeah all fair. I actually got a Dec740 second-hand (I think it belonged to a small company that either folded or grew out of it) for a reasonable price, upped the SSD and the RAM, and now I'm building a router "platform" on top of Incus.
The idea is to run OpenWRT passing through the ISP NIC and one (or both) of the SFP+ ones going to the switch, and also run other services in isolated containers.
I'm even thinking about putting Home Assistant on a VM on it but I'm not sure yet what impact it will have on routing performance so that's on hold for now.
It's so much more powerful than what I need for the router/firewall that it should be comfortable to run quite a few things on it, and I can start moving them off it to other devices if Internet speeds catch up to it in the future.
MikroTik is a nightmare from what I have heard, companies who invested hundreds of thousands of dollars cannot wait for the contract to expire to replace everything.
For homelab, you are far better served buying a second hand Sophos baremetal/server rack mounted, and installing OPNSense in it.
I have a 2nd hand Sophos SG210 Rev3 from eBay, replaced the Celeron CPU with an i7 one, 16GB, new SSD, dual 10G NIC, it had been running like a dream.
Another option is to just buy some used enterprise mini PC (google project tinyminimicro) with PCIE slot, and use that. Probably lower power consumption than a full rack mounted server, definitely takes much less space (unless you already have the rack).
I've been a MikroTik fan since the beginning of my career some 15 years ago now. I have used the MikroTik router and Ubiquiti AP combination ever since. With that said, I can absolutely agree that their UX is terrible for anyone who doesn't specifically know how to configure a MikroTik router. The fact that you have to configure FQ-CoDel yourself and some bufferbloat protection isn't just a built-in option is absurd for anyone using it as a home router.
They have an increasingly capable "simple" UI for casual users. It seems like improving it is on their roadmap, as they've been delivering vast improvements in functionality with each major release.
Also, shipping winbox on all platforms has been a huge QoL improvement
Not sure how I missed the Linux binary. I can stop booting into Windows for it
It always worked fine with wine for me.
I configure it by copy pasting the pages to chatgpt and asking questions. Dumb? Maybe but seems to work.
If you use codex or Claude code or similar you can just have it ssh in.
For me, the era of MikroTik is sort of... now.
Don't get me wrong, they make powerful and feature-complete stuff, but their UI sort of assumes you really know what you're doing. I don't know what I'm doing.
But my LLM does. I've been able to set up site-to-site VPNs with Mikrotik in fifteen minutes now, rather than the day-long exercise of googling and praying.
Related they let you download the entire documentation in an LLM friendly format.
https://manual.mikrotik.com/llms-full.txt
Their front page documentation specifically mentions it: https://manual.mikrotik.com/docs/introduction#machine-readab...
> LLM friendly format
Is that not just markdown? is there a specific way of formatting docs that's "friendly" to LLMs now?
I did not know about it, but it's actually linked in the LLM friendly doc [1]. Seems like some rules around being able to use parsing tools such as regex, and general formatting.
[1]: https://llmstxt.org/
It's just a lazy export of their wiki/Confluence in a .md format.
Ctrl+F in it for 'command provides information about RF' and the same on https://help.mikrotik.com/docs/spaces/ROS/pages/224559120/Wi...
LLMs certainly help out - in my case, agent helped with searching through various web forums about how my ISP authenticates and sets up Internet connection.
Nevertheless let's give MikroTik, where it's due:
* new documentation page is much cleaner to browse
* tutorials on their YouTube channel are quite informative
* WinBox v4 has in my opinion much more pleasent UX/UI than v3
I’m going to admit it took me too many years to realize there is a Mac Winbox client - I assumed it was a windows only thing.
It was, until they came up with v4 around a year ago or so.
It's possible to run v3 under Wine on a Mac but it was kind of clunky. V4 is much nicer (also runs on Linux too).
> I don't know what I'm doing.
That's also my problem. My colleague tells me that it's very easy to setup, but he's a network engineer and knows what things are.
Mikrotik seems to operate in an interesting area between high-end home-labing and the SME market. Without preexisting networking knowledge at a certain level, their documentation isn't all that helpful. I'm sure you can learn from the documentation, YouTube videos and trial and error, but if like me you get a few hours once in a while to take down your home network and get it back up it's going to take a while to gain the required knowledge. I really want an addition internet connection so I can play with this stuff.
On the negative, I'd say it's pretty clear that Mikrotik want you do buy training. It feels like some information is withheld by those with the certifications and Mikrotik and the UI isn't helping you much to figure out stuff on your own.
Mikrotik makes great hardware that shines under Openvrt )
Plus the routeros supports exporting all settings directly as text file. so you can really export the whole system, send it to llm and ask it to edit. install the new rule.
in worst case you just install the old rule back if it fuck up, no really damage can happen.
Plus, safe mode. You can enable safe mode, mess around, and with a reboot you are back to known-good state.
Shameless plug - a blog post re: LLMs and Mikrotiks from days ago! https://news.ycombinator.com/item?id=48927915
I used claude to manage an ansible playbook for managing the mikrotik router. That way I can see the changes being done.
It’s been great for llm + cli usage on mikrotik
Mikrotik is really a sweet spot for routers. It's feature-rich and it has a nice Web UI (or WinBox that is now cross-platform). And Mikrotik as a company is just amazing; they still support hardware that is almost 15 years old.
Other routers:
1. OpenWRT is a bit too basic, and updates are hit-and-miss.
2. Ubiquity is a bit too Apple-like, with its reliance on apps and integration.
3. Cisco is WAY too expensive, and too complicated to set up without having Cisco experience.
I'm now eagerly waiting for them to release the next generation of their routers. hEX Pro looks perfect to replace my aging CCR2004.
In which way is OpenWRT basic?
I was thinking the same thing. I switched from Mikrotik to OWRT because I wanted actual Linux, not a nerfed version of it that made scripting miserable.
For things like multiple DHCP/PD servers for multiple networks, subnetting (with dynamic prefixes), firewall rules, etc.
You can actually ditch the GUI and go to the command line with OpenWrt and do custom/weird/power-user stuff to your heart's content.
Well, yes. But I can do that with a nice UI in Mikrotik.
Other things: switch port management and bridging, proxy ARP, and so on.
What about switch port management? I can't remember the last time I couldn't do something with switching on it.
Not sure what you mean about bridging either.
I've never had a use for proxy ARP so wouldn't know, but I do know it's possible to enable it. If not on the GUI, at least on the CLI.
MAC-based VLANs and port-based VLANs primarily.
Where would Netgate pfSense+ fit on that list?
I tried Mikrotik and the UI was wasting so much of my time, it was worth switching to Netgate, for me.
on the other hand i got a mikrotik a while back and while setting it up it was silently phoning home.
I installed openwrt and then installed it on many mikrotik routers over the years. to be honest, not so much traditional routers (wifi+4-5 ports) but on ~10 port mikrotik switches for my infra.
i've since been switching to zyxel gs1900-* switches (up to 48 ports with openwrt)
> on the other hand i got a mikrotik a while back and while setting it up it was silently phoning home
Yes, I think it connects to the mikrotik cloud automatically to setup a usable external DNS to your device, but I believe access to it is turned off by default unless you turn it on.
https://manual.mikrotik.com/docs/network-management/cloud/
https://help.mikrotik.com/docs/spaces/ROS/pages/197984280/Ba...
The other reason is for updates, it can check periodically for firmware updates.
But outside of that it's not like streaming network telemetry or anything like that.
> i've since been switching to zyxel gs1900-* switches (up to 48 ports with openwrt)
I’m sorry what? You can run openwrt on that line of switches?
I just have a 24-port one at home running stock firmware…
they have all kinds of stuff that runs openwrt
like:
https://www.amazon.com/dp/B0978TF8K3/
https://openwrt.org/toh/zyxel/gs1900-24hp_a1
or:
https://www.amazon.com/dp/B08TC3VJ61
https://openwrt.org/toh/hwdata/zyxel/zyxel_xgs1250-12_b1
lovely, thank you!
Check out Glinet.
I'm more than happy with VyOS. Throw that in proxmox and you have an open source JunOS with zero license headache.
I do use Mikrotik for 2.5g switching though, zero complaints.
How are you managing updates?
I absolutely loved vyos but after their repeated hostility towards non paying users I moved to mikrotik for my routers (already had mikrotik switches).
First they stopped publishing LTS images, telling users to build from source. So people built gh repos you could clone and build with actions. Then they stopped making lts builds reproducible and told free users to use the preview release. But the preview release doesn’t get security updates. So if there’s a vulnerability you’re SOL until the next release which could be months. Not really tenable for an edge device for me and I’m not very interested in being a user of a product that does not want me.
Rolling release is actually the closer to bleeding edge version, I have been running fine with it. You can just set VyOS to auto update in the config if you want.
> zero license headache
Isn’t it a subscription? And super expensive? $3k/year/device was the cheapest thing I saw on their site or $12k/5 years. 25k/year for an MSP. On a 5 year cycle we’d need to manage thousands on devices to make it more attractive than pfsense (cost wise).
I really wanted to try it a few years ago but they seem like just another tech company that only wants millionaire customers.
Rolling release has zero issues for me and is completely free.
If you want LTS(or you can just pin a rolling release around the same build) you can pay for a support contract. Similar to proxmox. The no-subscription product works just fine.
I think they are saying if you use VyOs on Proxmox it gives you something equivalent to JunOs. I have no idea if that is true or not though.
About 2 years ago I tried to use Mikrotik, as the router for my ATT Fiber.
It's royal pain.
Basic router setup is not hard.
Port forward to expose web server? Can be done after heavy docs&forum reading, but hair pinning never worked for me.
I checked their WiFi AP. It's UI is hard even for senior software engineer.
In the end I got opnSense installed in VM on Proxmox and it's my router for last 2 years.
I'm using 2 Mikrotik switches with their simplified UI to operate VLANs. Zero complains.
It should be doable by most software engineers. They did teach some basic CCNA course in the university as part of computer science studies and the concepts taught there should help a lot with configuring any router, including RouterOS. It could also be helpful to watch some guides on routing and firewall on Linux, since RouterOS is just Linux with a very specific UI on top.
I dunno. I've worked with linux routers for years and I've had a lot less problems than with mikrotik.
I still like them but it's usually not the networking knowledge that trips people up.
Port forwarding is a simple dstnat rule and hairpinning is just a srcnat rule.
It wasn’t terribly complicated for me but I seem to be built for the old Cisco style iOS.
But with an LLM it’s easier than falling off a log and the command line means it can do everything easily.
The router probably should work without relying on LLM:
I remember I misconfigured it, and can't really Google around or ask LLM to fix it, because my Internet is down now.
Of course I can use Internet on my phone, but it's not really convenient setup to ask LLM to troubleshoot the router.
There is a safe mode built in. If you enable it and you loose connection to the router due to some misconfiguration, it will reset within 15 minutes to the point of where you started the safe mode session. Also if you mess up the IP layer, there is a chance that you can still connect and configure RouterOS through their WinBox program using the mac address.
Yeah, it's inconvenient when the [effectively] black-box router device that only the bot understands goes out to lunch, and takes access to the bot along with it.
But the degree of inconvenience is up to the beholder.
One way is using something like ChatGPT with a pocket supercomputer. It's tedious to get technical stuff done that way, but it can be accomplished. (For those who haven't tried it, the bot can be spooky-good at correctly interpreting cell phone photos of technical text on a screen. This saves a ton of transcription effort.)
Another way is with the phone's hotspot and just about any random computer. Laptops have wifi. Wifi dongles for desktops can be stupid-cheap, and it's useful to have a few scattered around. It works fine (unless one's hotspot data is ridiculously-limited, I guess).
The best way is probably by being prepared with procedural fall-back methods. Keep backups of your configs, and keep the recovery instructions with them. Test recovery; an untested backup isn't necessarily better than having no backup at all. Keep as many historical versions as one wishes, and automate it because procrastination is part of the human condition.
After that: When the router's config gets stuffed up, then the backups and the restore instructions are right there. Just pick an appropriate backup and use it.
We should probably be keeping backups of important stuff like that even in the absence of LLMs. Humans also err, and stuff does break, and what seemed obvious six months ago when we were in the groove might be impossible to remember when we need it today.
True, what MicroTik seems to offer is capability many orders of magnitude under the cost of comparable options.
Their products aren't really for consumers, maybe prosumers, but mainly smaller companies or ISPs that don't want to pay for Cisco.
Agreed. I tried Microtik. Seemed like it was written by DOS people from the 70s or 80s, made difficult on purpose.
I ended up switching to back to Ubiquti.
They run linux and offer ssh but with a custom shell that mirrors the "web shell" in usefulness.
Ubiquiti sucks nowadays but Microtik is simply insane.
> They run linux and offer ssh but with a custom shell
That feels like DOS with short character limits etc. It's attrocious.
> Ubiquiti sucks nowadays
Actually the general consensus is that they are amazing. You're in the minority
DOS was easy.
Just use linux! Why use someone else's non FOSS, locked down linux, when you could truly own your router?
It's a great educational experience I would recommend to anyone interested in networking. Grab debian, grab a system with 2 NICs, make it your router/firewall/gateway.
> Grab debian, grab a system with 2 NICs, make it your router/firewall/gateway.
The problem with this (assuming you meant a generic (x86?) system) is that you won't get wire speed processing (no hardware offloading), so network performance will suffer. Unless you buy a dedicated router board (which is typically ARM), like say something like the Banana Pi BPI-R4. But installing/configuring a standard distro line Debian for such a board would be a PITA (if you want to do it right and set it up optimally), so you're better off using a dedicated router distro like OpenWRT.
I’ve not tried with 10gbps or faster links, but since we’re talking home use my success with 2.5 gbps links on standard amd64 hardware would suggest you’re wrong.
Modern CPUs are quite capable. The problem isn’t performance, but power use.
That's bogus unless you're talking above 10G, in which case the only things typically doing wire level performance are expensive and sold by vendors like Cisco, Juniper or Arista (and maybe it's higher than 10G now). Frankly, the vast majority of ARM based routers, unless you go out of your way, are garbage. Any x86 built in the last 15+ years with a NIC that's also not trash _will_ push at least 1G routed with a non-trivial firewall on a modern Linux kernel no problem. I've still got half a dozen PC Engines APU2 boards that unequivocally will get right at 1G on Debian Trixie; newer ewaste like Dell Wyse thin clients or Optiplexes would absolutely smoke those boards on performance.
Setting up a router with Debian is really kind of overstated in terms of difficulty, and frankly half of everything wraps Debian anyways (looking at you Ubiquiti/Vyatta), so why learn someone else's half cooked configuration language when you can just do the real thing.
Is this a problem with home networks? I have pfsense installed on some mini PC I bought off Amazon.
Setting up Debian as a router might take some effort but it's certainly not difficult. Enabling routing is a single line config change, install dhcpd and you're almost there. I'd certainly recommend the router OS.
from my brief search:
real-world OPNsense (yea, that's not Debian) benchmarks show that even low-power Xeon-D (Skylake-D SoC) with 10G SFP+ NICs:
pushed 9.40 Gbps in plain router mode
7 Gbps with packet filtering and no rules
7 Gbps in NAT mode
5.5 Gbps with a default ruleset
Using a Xeon for a router just because you want to use linux is a wild choice.
I’ve been running a Supermicro X10SLH-LN6TF as my router, and it’s very well suited for the job. Power use is very high for a home router, but reasonable for a 1U router - especially considering the era it’s from and its capabilities (routing 5-8Gbps per stream depending on firewall config, able to handle a couple active streams, and line rate routing with no firewall).
I wouldn’t suggest anyone buy something like this today for home use, but 6 years ago when I purchased it there were not many 10GbE routers to be had period, let alone for the price ($300 roughly if I remember correctly ). Even considering the cost of power over the last 6 years, I still come out much cheaper than if I’d bought something more power efficient new at the time.
FWIW, I got 10 Gbit at home 2 years ago and built my router for $100 using a ThinkCentre M720q Tiny running on a Core i3-8100T (a mini-PC from 2019).
It draws around 15W idle, going up to 30W at full bore. For comparison, the 10G rental router from the ISP drew 15W no matter what (idle or full bore routing). This is with a 10GBase-T SFP+ which probably influences the power draw vs using a DAC.
It has no issues maxing out at 9.4 Gbit routing with a single or multiple streams of iperf3 with your basic IPv4 NAT+some port forwards config.
Any remotely recent generic office PC should be able to handle line rate 10 Gbit routing as long as it has the PCIe lanes for it.
I route my home 10G internet on a ThinkCentre Tiny with a 2018 Core i3-8100T.
A 15 year old 1ghz quad core (apu2) can route gigabit just fine, passively cooled. An N150 can do 2.5gbit, probably 10gbit but i haven’t personally tried.
Using Openwrt is fine but doesn’t quite match the educational experience of starting from a scratch Debian.
Also, power consumption.
Please link a SFF box or SoC with:
- 1x10GB SFP+
- 1x2.5GB Ethernet w/ PoE In
- 7x1GB Ethernet w/ PoE In/Out
- powered by DC jack, 2 pin, or PoE
- Similarly sized to 220 × 125 × 22 mm (approx 8.66 × 4.92 × 0.86 inches)
- Max power consumption 150W
- Silent
- ~$300
And I can replace my RB5009Upr+S+IN.
Looks like OpenWrt supports that model, so going that route would be an option of not having locked down software.
Super interesting, I wouldn’t have thought to check that compatibility
Yeah, I will concede the hardware is nice and they offer things nobody else really does. Which makes it even more of a shame that I can’t install my own OS properly on it.
Fwiw I like protectli’s boxes. Not quite as featureful nor as cheap but it’s great kit.
Bingo. I use Mikrotik for my switches. They were the first I found that had 10Gb uplinks, inexpensively and with low power usage. L2 configuration is janky (like every other switch) but workable. I use both SwOS and ROS, but moving towards ROS for dot1x (unfortunately inescapable to have that functionality on the switch).
But the actual router? That lives on NixOS in a virtual machine on a generic amd64 machine that also runs NixOS. I'd rather design / perfect my config once in terms of iproute2/nftables and know I can swap in any hardware. I've got a full policy routing setup that let's me define for each device what Internet horizon it can see (along with what other local devices it can access).
I also find the sibling comment mentioning routing speed to be funny. I've found that unencrypted gigabit WAN is easily handled by most amd64 computers. 10Gb LAN->LAN hairpin routing seems fine. But the big thing is doing gigabit OpenVPN/wireguard, which off the shelf hardware-accelerated routers just don't really do unless you spend a lot. (coupled with the above policy routing, I can configure things like this particular web browsing VM goes out a data center IP that rotates every day).
Wireless APs are similarly handled by hostapd on NixOS, driving (mostly) Mikrotik MiniPCIe Wifi cards. I don't really need the latest and greatest wifi gen, rather I just need them to work and be as maintenance-free as possible.
>Why use someone else's non FOSS, locked down linux, when you could
All my life I have had to make do with junk I could get at Walmart or Best Buy. Got tired of it. Cheap plastic shit that would inevitably shit the bed just a month or two after the warranty expired. I'm not making the IT helpdesk wages I was making 30 years ago... fuck that. While I couldn't spend ten grand on home networking, I could finally spend a little something on hardware that's not total shit.
Got the CCR2004-16G-2S+. No stupid ONTs, either, just the SFP+ modules. Plenty of backup 1gig ports if I get a third WAN (thinking about getting Starlink on standby). Actual proper fucking APs that do seamless handoff (hell, one of them probably covers the footprint of my house, if I'm honest). And no more shitty GUI configuration pages. I just shell in and band out commands on the command line (at least three times til I get the syntax right, but who gives a fuck).
Wish they made something with 3 or 4 SFP+ ports that I didn't need a rack for.
Buying nice hardware is orthogonal to using debian as your router's OS.
Switched to Ubiquiti, I'm quite happy except for their lack of a sane MCP.
What's the state of FOSS licensing compliance? Have they repented?
Mikrotik's FOSS story is as bad.
Ubiquiti unifi has struggled to integrate routing as reliably and as well as the wireless and switching piece. Mikrotik router and unifi everything else has kind of been my go-to for at least 10 or 12y now.
I can't speak for the more "entreprise-y" unifi stuff but the routing on the ubiquiti gear i've used is actually just FRR and if you SSH in you can do a whole lot more than is surfaced through the UI - for example, I have VXLAN running on my UDR7 right now.
It's not something I've tried but I imagine you could actually expose FRR directly and configure through that
For a long time if you made any changes through the web UI it would overwrite the config. Then you could make changes and it would save. Then they removed it. Then they added it back but it didn't always work. Not sure the current state.
I have like a ~15y history of working with their stuff.
How is the ipv6 situation these days? I left Ubiquiti 2 years ago because I needed to be able to configure the /56 I got from my isp. The unifi controller was pathetic in what it could do.
I'm new to Ubiquiti routers, but I had no problem dividing the /60 I got from my ISP and assign /64s to VLANs.
You might be interested in https://www.youtube.com/watch?v=KZpJvpm1Ris (title: Does UniFi FINALLY support IPv6 Properly? State of IPv6 with Unifi Network v9). The video is about a year old, but from the looks it's not terribly outdated.
I use tp-link everything. I have all of them connected to self-hosted Omada controller in docker. Works like a breeze, including notifications. Used MikroTik before but "the dude" or whatever is called now was hit and miss. Probably you don't need it anymore if get llm to configure it.
I am glad, I am 99% sure it's the case, that I don't have to do CGNAT with ATT. Sounds like a pain.
I like ipv6 but I have been thinking of disabling it lately because i cannot technically setup static leases with ipv6 like i can with ipv4, so technically the ipv6 for one of the services in my homelab could change and cause problems.
SLAAC-generated addresses will stay the same so long as the prefix and your MAC address stay the same, so there should be no need to do static leases.
Also... service discovery. Needing static addresses is a kludge.
Android (phones, tv boxes) doesn't respect DHCPv6 IA_NA, but it should respect DHCPv6 IA_PD. Unless you have some other system that doesn't respect DHCP? Linuxes, Windowses, Playstation 5's support DHCPv6 IA_NA without problems.
But also, even if a device doens't support DHCPv6 IA_NA, you can always also have a DNS server in your network, and you can bind SLAAC-generated Android addresses to simple subdomains. This seems better than DHCP anyway.
I gave it a shot but I really didn't see any benefit over OpenWRT which is plain old Linux.
There's also some really good value hardware that you can install OpenWRT on, I picked up a Xiaomi AP for like $30, flashed OpenWRT and it works great.
Any recommendations for hardware?
I’ve been very happy with Mikrotik.
Chose them partly to reduce dependence on US tech too.
One thing that frustrates me about MikroTik and OpenWRT too, is a lot of things require multiple steps to set up, like adding a port forward with hairpin isn't just one click, adding a VLAN requires adding stuff in like 5+ different places.
I really liked using Opnsense before I switched to Openwrt and I always want to go back, because it was just so much more streamlined and easy to configure from a 'geek but not a network engineer' perspective.
I use a mikrotik at home, and I always get a review from Claude after making config changes.
I actually used to be a network engineer (many decades and career reinventions ago), and I appreciate that Mikrotik exposes all of the layers and connections between them.
But damn if Claude doesn’t always find something I got wrong in the config.
From some time, I had a though about getting my home-lab. Prior to that, I've decided to prepare my networking for it and ditch the router given by my ISP for MikroTik to optimise the network. It turned out it's not easy - why? Check it out on my latest blog post!
I love Mikrotik products but they are lacking what I need at home. I need basic IPS/IDS, notification when something is wrong without writing mikrotik scripts, easy backup failover, etc not VxLAN, QinQ and BGP extensive filtering :) I moved to Unifi Cloud Gateways as home/small soho routers and can't be happier. But Mikrotik stays as emergency hardware backup ..
Mikrotik is not a mere replacement for plug and play routers such as TP-Link and the like. It's a very advanced device offering countless networking features, including multiple VPN server options, advanced Layer 2/bridging/switching features - VLANs, nested VLANs (Q-in-Q), VXLAN, spanning tree protocols (STP, RSTP, MSTP), 802.1x authentication, bridge-based firewall and bridge-based NAT, data center bridging (a.k.a. "lossless Ethernet"). Advanced Layer 3 features such as BGP, policy routing, traffic shaping, VRRP, hardware layer 3 acceleration. Then containers, matter/thread protocols, mesh networking, advanced wi-fi features such as centrally-managed network (CAPSMAN), multiple/virtual access points, hotspots, and many many more. Advanced firewall for both IPv4 and IPv6. On top of that scripting, SSH server, NTP server, DNS cache. API client for advanced integrations, and built-in scheduler, packet sniffer for troubleshooting, safe mode for automatic rollbacks of recent changes in case when the admin gets cut off due to a dangerous change. It'd be really hard to enumerate all that RouterOS offers.
And all that is available from tiny home/SMB office devices starting at 40 USD, through dedicated wireless point to point bridges, to a big Ethernet switches/routers with 400G interfaces.
Of course it doesn't compete with high end NVIDIA Spectrum-X, Cisco or Juniper, but is good enough for 95% of networks.
It works great as a plug&play home/office router, too thanks to Quick Set, but for more sophisticated setups, a knowledge of networking protocols is mandatory. The more fancy setup, the more in-depth knowledge is required. Just like with programming and all stuff in life.
One of their newer APs has thread radio. That is the best idea anyone has had since the mid 90s.
How is the performance of their newer APs?
That was always what was holding me back from switching off a 2.5GbE / WiFi 7 UniFi stack.
I can't read the nearly-white (or super-thin font) text on the white background.
Is that representative of using mikrotik hardware?
Apologies, fix should be live now
Wow, wasn't really expecting a response, but got a quick response along with a fix. Thank you, excellent support!
Nice detailed write-up too, and great explanatory diagrams.
and reader-mode doesn't show the text
I am using a tiny mini pc j6412 with fd.io vpp(with dpdk enabled) and some customized plugins for pppoe and overlay tunnel, it works quite well
and it's cheap and fully customized, and powerful
For me when building homelab, customizability maybe important
I just got a backup ISP at home and connected fiber directly to Mikoritk using SFP dongle instead of the box provided by ISP.
Scripts on RouterOS handle network checks for failover, DNS updates, etc.
I got that Mikrotik home router 10 years ago and it is still performing great and handles most of the use cases without issues.
mikrotik is great for the tech enthusiast who wants to test things out or use enterprise grade hardware but without the enterprise grade cost (no license fees) but this also means you're missing the enterprise grade support. The equipment is a fantastic deal for what you get but you need to know what you're doing to get the best performance out of it.
Frustratingly I couldn’t find a Mikrotik that would offer me a few SFPs, and a 2.5 or two. I wanted ideally just 3 SFPs - two WAN for LB / Failover and one up to switch. 2.5g WAN would do but would rather SFP for future use.
UDM-SE it is for now.
What exactly did you need and how did https://mikrotik.com/product/crs305_1g_4s_in not do it? It says switch but it runs routerOS and can route at some speed - not 10G tho.
crs305 will choke when you start asking it to do NAT. it's a switch. It should be able to hardware-route between VLANs but it's not made for "home router" duties.
CRS is the switch product line and you would not believe how many professional network engineers do exactly as you have suggested and installed a CRS and asked why it locks up when routing.
CRS are L3 switches; they are supposed to route and run dynamic routing protocols and do ECMP and all the good stuff so long as you dont configure features like nat and firewall that require the cpu and cant be offloaded.
The one thing that it frustratingly does not support that I wish it did is stateless bgp with ipv4 prefixes. It cant offload an ipv4 packet with an ipv6 next hop.
I really would question any "professional" network engineer that can't tell the difference between a switch and a router...
https://mikrotik.com/product/crs305_1g_4s_in
Each of the mikrotik switches even comes with a block diagram linked on its product page, showing for instance a single 1.3 Gbps between its L2 switch chip and its CPU.
https://cdn.mikrotik.com/web-assets/product_files/CRS305-1G-...
>I really would question any "professional" network engineer that can't tell the difference between a switch and a router...
Oh the stories I could tell you.
I once had to work with a guy who didnt believe in dynamic routing.
Which wouldn't have been too bad but he also didnt believe in route summarisation or any kind of planning. So the network was carved up into random unpredictable blocks.
He sadly did very much believe in Mikrotik scripting, and so had scripts setup to disable/enable static routes based on very broad (often external) reachability criteria.
Whenever googles DNS had an issue the whole network would start flapping scripts like nobodies business.
The network was a large wisp with more than 600 pops and more than 10000 customers on its various services.
That engineer had been gainfully employed by multiple ISPs over 20 years.
I've had supposedly credible professional network engineers send me their PRIVATE ssh keys for access to something more than once. As a response to "please send me your ssh key for access to $THING"
Amazing.
I mean thats a swouter.
It's not, really, it's a basic commodity CPU with some RAM for the purposes of running the OS and management plane, glued to a layer 2 switch chip by a very narrow bandwidth path. A mikrotik switch such as this isn't intended to be used for any of the real layer 3 features of mikrotik routeros like routing, nat, ospf, bgp, mikrotik's own weird EoIP tunnels, etc.
The problem is that people might login to it for the first time and see all of the feature set of RouterOS v7 available to them to start configuring things from the ssh CLI or web GUI. It might look the same at first glance as something that is actually a small router like the RB760IGS.
It would probably be better if mikrotik included some kind of red text warning "this is not really a router" if people start entering layer 3 stuff into it (other than its own management IP, SNMP, NTP servers, etc).
Same concept for the other very cheap mikrotik switches that are like 4 or 8 ports of 1000BaseT.
It's still that, capability matters. Even with enterprise products like Cisco you'll need to look at hardware diagrams to understand limitations, some you won't find out unless you test or pay for an expensive support contract and can ask specific questions.
Scroll down to the ethernet test results.
In lab optimal conditions it can route 1.2G
It has 4 10G SFP+ ports.
If you enable Queues AND Firewall Filters you will be down below 500M of throughput. Potentially less. If you ask this thing to do anything complex its going to shit itself.
Now have a look at the block diagram. Note that the internal link between the 800MHz processor and the switch chip shows 1.3G.
It would be an embarrassing cock up to deploy this as a router for a client. Even if you only need 1.3G of routing, there are better products.
Just like most enterprise network products. Sometimes it's not enough to look at hardware diagrams, need to test or have an expensive support contract and the ability to ask the right questions to understand limitations.
Caps at at 1500 routing :(
So good to see so many articles pop up on hn regarding self-hosting and home labbing
I hope there is a part 2, where they make sure the internet can't access their management interfaces...
I went with omada and I'm happy for now
In Poland, Play.pl sets up IPv6 by default. One phone call to ISP to disable the hidden firewall on their router gives us full IPv6 network transparency, no NATs are needed anymore. I highly recommend after installing a firewall appliance (for example OPNsense, but probably Mikrotik should have it as well). IPv6 "feels" like how networks should work since the beginning. IPv4 feels like a legacy technology.
They of course also have a DS-Lite AFTR gateways to tunnel the IPv4 traffic. In practice, everything works (for me at least).
I love MikroTik, but ffs just let me install something else on it. SONiC or any other Linux would be awesome. I love their hardware, but their software is absolutely awful.
Is there any manufacturer out there who produces high quality hardware that is not locked down?
You can easily install openwrt on most of MikroTik routers. Rb5009 is also supported now if you need more powerful router.
https://openwrt.org/toh/mikrotik/rb5009ug_s_in
Four devices is not "most". You had me excited that I might be able to abandon the proprietary UIs on my CRS326/CSS326. And I know those aren't the "real router" devices, but Mikrotik certainly refers to them as routers.
Here is complete list -> https://toh.openwrt.org/?view=normal
78 devices in total when you filter for mikrotik -> brand column.
Oh damn. I had just gone up one level from your first link (to https://openwrt.org/toh/mikrotik/start) and saw a small list of 4. RB450 was on there (which I used to run), so I figured it was mostly accurate.
That table is a much longer list! Still no love for my CRS/CSS, but it does look like that's probably most of the RB devices that Mikrotik actually intends for use as routers (rather than L3 switches).
Interesting, didn't check this url before. https://openwrt.org/toh/start
Also has supported release version column, which is useful to have.
note: That page has a link "Supported by current OpenWrt release" but it doesn't include the latest version! So it too could lead someone to conclude many fewer devices are supported.
Sometimes having generic Linux capabilities on network equipment makes it hard to understand the configuration. On RouterOS you can just /export the configuration and read a single file. On Linux/SONiC there are multiple ways to do the same thing - you can do one part of configuration using ifupdown, then make some changes in systemd-networkd, a bunch of shell-script DHCP client hooks, rc.local, cron @reboot. Imagine being handed over a router that someone has fixed by doing some runtime reconfiguration (like `ip ro replace default via 192.168.0.1 advmss 1410`) that would vanish with almost no trace (except maybe .bash_histotry) when you reboot it - that won't be possible (without doing very special scheduler/script trickery) on RouterOS.
But if you still want it, MikroTik doesn't try too hard to prevent you from running modified software. You can port OpenWrt, and most modern MikroTik devices use modern enough Linux to use a device tree blob. Try pulling out a dtb from your firmware and ask an LLM to do the initial porting - just don't forget to backup your RouterOS license key first, they are device specific.
The opnSense Deciso boxes are very nice and open - if a bit on the expensive side.
https://shop.opnsense.com/product-categorie/hardware-applian...
> if a bit on the expensive side.
chokes on coffee
From my old-man, everything-is-stupidly-expensive point of view, this is my scale:
cheap side | reasonable | expensive side | Deciso boxes
I'm not disagreeing but they are quite powerful and fanless, with generous networking ports and both RAM and SSD can be upgraded.
I haven't been able to find many other devices that tick so many boxes. These seem to exist on a class of their own.
Yep, and I can't disagree with that either, they know their niche (and know they're niche) and are catering to it.
Having said that, mikrotik hardware running OpenWRT feels like something that might scratch one of my itches.
Yeah all fair. I actually got a Dec740 second-hand (I think it belonged to a small company that either folded or grew out of it) for a reasonable price, upped the SSD and the RAM, and now I'm building a router "platform" on top of Incus.
The idea is to run OpenWRT passing through the ISP NIC and one (or both) of the SFP+ ones going to the switch, and also run other services in isolated containers.
I'm even thinking about putting Home Assistant on a VM on it but I'm not sure yet what impact it will have on routing performance so that's on hold for now.
It's so much more powerful than what I need for the router/firewall that it should be comfortable to run quite a few things on it, and I can start moving them off it to other devices if Internet speeds catch up to it in the future.
step 1 buy openwrt hardware accelerated NAT compatible device
step 2 throw the mikrotik in the garbage
MikroTik is a nightmare from what I have heard, companies who invested hundreds of thousands of dollars cannot wait for the contract to expire to replace everything.
For homelab, you are far better served buying a second hand Sophos baremetal/server rack mounted, and installing OPNSense in it.
I have a 2nd hand Sophos SG210 Rev3 from eBay, replaced the Celeron CPU with an i7 one, 16GB, new SSD, dual 10G NIC, it had been running like a dream.
> cannot wait for the contract to expire
There is no contract with MikroTik. You buy the hardware, that's it. The software and updates are free.
Assuming OP is meaning the ISP contract they are in which requires them to use the ISP provided Microtik router.
Another option is to just buy some used enterprise mini PC (google project tinyminimicro) with PCIE slot, and use that. Probably lower power consumption than a full rack mounted server, definitely takes much less space (unless you already have the rack).
Power consumption?