DE version is available. Content is displayed in original English for accuracy.
Advertisement
Advertisement
⚡ Community Insights
Discussion Sentiment
71% Positive
Analyzed from 3657 words in the discussion.
Trending Topics
#mikrotik#router#openwrt#home#hardware#linux#https#network#more#years
Discussion (122 Comments)Read Original on HackerNews
Also, shipping winbox on all platforms has been a huge QoL improvement
Don't get me wrong, they make powerful and feature-complete stuff, but their UI sort of assumes you really know what you're doing. I don't know what I'm doing.
But my LLM does. I've been able to set up site-to-site VPNs with Mikrotik in fifteen minutes now, rather than the day-long exercise of googling and praying.
https://manual.mikrotik.com/llms-full.txt
Their front page documentation specifically mentions it: https://manual.mikrotik.com/docs/introduction#machine-readab...
Nevertheless let's give MikroTik, where it's due:
* new documentation page is much cleaner to browse
* tutorials on their YouTube channel are quite informative
* WinBox v4 has in my opinion much more pleasent UX/UI than v3
It's possible to run v3 under Wine on a Mac but it was kind of clunky. V4 is much nicer (also runs on Linux too).
in worst case you just install the old rule back if it fuck up, no really damage can happen.
I do use Mikrotik for 2.5g switching though, zero complaints.
I absolutely loved vyos but after their repeated hostility towards non paying users I moved to mikrotik for my routers (already had mikrotik switches).
First they stopped publishing LTS images, telling users to build from source. So people built gh repos you could clone and build with actions. Then they stopped making lts builds reproducible and told free users to use the preview release. But the preview release doesn’t get security updates. So if there’s a vulnerability you’re SOL until the next release which could be months. Not really tenable for an edge device for me and I’m not very interested in being a user of a product that does not want me.
Isn’t it a subscription? And super expensive? $3k/year/device was the cheapest thing I saw on their site or $12k/5 years. 25k/year for an MSP. On a 5 year cycle we’d need to manage thousands on devices to make it more attractive than pfsense (cost wise).
I really wanted to try it a few years ago but they seem like just another tech company that only wants millionaire customers.
It's royal pain.
Basic router setup is not hard.
Port forward to expose web server? Can be done after heavy docs&forum reading, but hair pinning never worked for me.
I checked their WiFi AP. It's UI is hard even for senior software engineer.
In the end I got opnSense installed in VM on Proxmox and it's my router for last 2 years.
I'm using 2 Mikrotik switches with their simplified UI to operate VLANs. Zero complains.
But with an LLM it’s easier than falling off a log and the command line means it can do everything easily.
I remember I misconfigured it, and can't really Google around or ask LLM to fix it, because my Internet is down now.
Of course I can use Internet on my phone, but it's not really convenient setup to ask LLM to troubleshoot the router.
But the degree of inconvenience is up to the beholder.
One way is using something like ChatGPT with a pocket supercomputer. It's tedious to get technical stuff done that way, but it can be accomplished. (For those who haven't tried it, the bot can be spooky-good at correctly interpreting cell phone photos of technical text on a screen. This saves a ton of transcription effort.)
Another way is with the phone's hotspot and just about any random computer. Laptops have wifi. Wifi dongles for desktops can be stupid-cheap, and it's useful to have a few scattered around. It works fine (unless one's hotspot data is ridiculously-limited, I guess).
The best way is probably by being prepared with procedural fall-back methods. Keep backups of your configs, and keep the recovery instructions with them. Test recovery; an untested backup isn't necessarily better than having no backup at all. Keep as many historical versions as one wishes, and automate it because procrastination is part of the human condition.
After that: When the router's config gets stuffed up, then the backups and the restore instructions are right there. Just pick an appropriate backup and use it.
We should probably be keeping backups of important stuff like that even in the absence of LLMs. Humans also err, and stuff does break, and what seemed obvious six months ago when we were in the groove might be impossible to remember when we need it today.
I ended up switching to back to Ubiquti.
Ubiquiti sucks nowadays but Microtik is simply insane.
I really liked using Opnsense before I switched to Openwrt and I always want to go back, because it was just so much more streamlined and easy to configure from a 'geek but not a network engineer' perspective.
I actually used to be a network engineer (many decades and career reinventions ago), and I appreciate that Mikrotik exposes all of the layers and connections between them.
But damn if Claude doesn’t always find something I got wrong in the config.
It's a great educational experience I would recommend to anyone interested in networking. Grab debian, grab a system with 2 NICs, make it your router/firewall/gateway.
The problem with this (assuming you meant a generic (x86?) system) is that you won't get wire speed processing (no hardware offloading), so network performance will suffer. Unless you buy a dedicated router board (which is typically ARM), like say something like the Banana Pi BPI-R4. But installing/configuring a standard distro line Debian for such a board would be a PITA (if you want to do it right and set it up optimally), so you're better off using a dedicated router distro like OpenWRT.
Modern CPUs are quite capable. The problem isn’t performance, but power use.
real-world OPNsense (yea, that's not Debian) benchmarks show that even low-power Xeon-D (Skylake-D SoC) with 10G SFP+ NICs:
pushed 9.40 Gbps in plain router mode
7 Gbps with packet filtering and no rules
7 Gbps in NAT mode
5.5 Gbps with a default ruleset
Setting up a router with Debian is really kind of overstated in terms of difficulty, and frankly half of everything wraps Debian anyways (looking at you Ubiquiti/Vyatta), so why learn someone else's half cooked configuration language when you can just do the real thing.
Setting up Debian as a router might take some effort but it's certainly not difficult. Enabling routing is a single line config change, install dhcpd and you're almost there. I'd certainly recommend the router OS.
- 1x10GB SFP+
- 1x2.5GB Ethernet w/ PoE In
- 7x1GB Ethernet w/ PoE In/Out
- powered by DC jack, 2 pin, or PoE
- Similarly sized to 220 Ă— 125 Ă— 22 mm (approx 8.66 Ă— 4.92 Ă— 0.86 inches)
- Max power consumption 150W
- Silent
- ~$300
And I can replace my RB5009Upr+S+IN.
All my life I have had to make do with junk I could get at Walmart or Best Buy. Got tired of it. Cheap plastic shit that would inevitably shit the bed just a month or two after the warranty expired. I'm not making the IT helpdesk wages I was making 30 years ago... fuck that. While I couldn't spend ten grand on home networking, I could finally spend a little something on hardware that's not total shit.
Got the CCR2004-16G-2S+. No stupid ONTs, either, just the SFP+ modules. Plenty of backup 1gig ports if I get a third WAN (thinking about getting Starlink on standby). Actual proper fucking APs that do seamless handoff (hell, one of them probably covers the footprint of my house, if I'm honest). And no more shitty GUI configuration pages. I just shell in and band out commands on the command line (at least three times til I get the syntax right, but who gives a fuck).
Wish they made something with 3 or 4 SFP+ ports that I didn't need a rack for.
There's also some really good value hardware that you can install OpenWRT on, I picked up a Xiaomi AP for like $30, flashed OpenWRT and it works great.
It's not something I've tried but I imagine you could actually expose FRR directly and configure through that
I have like a ~15y history of working with their stuff.
I like ipv6 but I have been thinking of disabling it lately because i cannot technically setup static leases with ipv6 like i can with ipv4, so technically the ipv6 for one of the services in my homelab could change and cause problems.
But also, even if a device doens't support DHCPv6 IA_NA, you can always also have a DNS server in your network, and you can bind SLAAC-generated Android addresses to simple subdomains. This seems better than DHCP anyway.
Chose them partly to reduce dependence on US tech too.
and it's cheap and fully customized, and powerful
For me when building homelab, customizability maybe important
And all that is available from tiny home/SMB office devices starting at 40 USD, through dedicated wireless point to point bridges, to a big Ethernet switches/routers with 400G interfaces.
Of course it doesn't compete with high end NVIDIA Spectrum-X, Cisco or Juniper, but is good enough for 95% of networks.
It works great as a plug&play home/office router, too thanks to Quick Set, but for more sophisticated setups, a knowledge of networking protocols is mandatory. The more fancy setup, the more in-depth knowledge is required. Just like with programming and all stuff in life.
Other routers:
1. OpenWRT is a bit too basic, and updates are hit-and-miss.
2. Ubiquity is a bit too Apple-like, with its reliance on apps and integration.
3. Cisco is WAY too expensive, and too complicated to set up without having Cisco experience.
I'm now eagerly waiting for them to release the next generation of their routers. hEX Pro looks perfect to replace my aging CCR2004.
I tried Mikrotik and the UI was wasting so much of my time, it was worth switching to Netgate, for me.
I installed openwrt and then installed it on many mikrotik routers over the years. to be honest, not so much traditional routers (wifi+4-5 ports) but on ~10 port mikrotik switches for my infra.
i've since been switching to zyxel gs1900-* switches (up to 48 ports with openwrt)
Yes, I think it connects to the mikrotik cloud automatically to setup a usable external DNS to your device, but I believe access to it is turned off by default unless you turn it on.
https://manual.mikrotik.com/docs/network-management/cloud/
https://help.mikrotik.com/docs/spaces/ROS/pages/197984280/Ba...
The other reason is for updates, it can check periodically for firmware updates.
But outside of that it's not like streaming network telemetry or anything like that.
I’m sorry what? You can run openwrt on that line of switches?
I just have a 24-port one at home running stock firmware…
like:
https://www.amazon.com/dp/B0978TF8K3/
https://openwrt.org/toh/zyxel/gs1900-24hp_a1
or:
https://www.amazon.com/dp/B08TC3VJ61
https://openwrt.org/toh/hwdata/zyxel/zyxel_xgs1250-12_b1
Is that representative of using mikrotik hardware?
Nice detailed write-up too, and great explanatory diagrams.
Scripts on RouterOS handle network checks for failover, DNS updates, etc.
I got that Mikrotik home router 10 years ago and it is still performing great and handles most of the use cases without issues.
UDM-SE it is for now.
The one thing that it frustratingly does not support that I wish it did is stateless bgp with ipv4 prefixes. It cant offload an ipv4 packet with an ipv6 next hop.
https://mikrotik.com/product/crs305_1g_4s_in
Each of the mikrotik switches even comes with a block diagram linked on its product page, showing for instance a single 1.3 Gbps between its L2 switch chip and its CPU.
https://cdn.mikrotik.com/web-assets/product_files/CRS305-1G-...
They of course also have a DS-Lite AFTR gateways to tunnel the IPv4 traffic. In practice, everything works (for me at least).
step 2 throw the mikrotik in the garbage
Is there any manufacturer out there who produces high quality hardware that is not locked down?
But if you still want it, MikroTik doesn't try too hard to prevent you from running modified software. You can port OpenWrt, and most modern MikroTik devices use modern enough Linux to use a device tree blob. Try pulling out a dtb from your firmware and ask an LLM to do the initial porting - just don't forget to backup your RouterOS license key first, they are device specific.
https://openwrt.org/toh/mikrotik/rb5009ug_s_in
https://shop.opnsense.com/product-categorie/hardware-applian...
chokes on coffee
From my old-man, everything-is-stupidly-expensive point of view, this is my scale:
cheap side | reasonable | expensive side | Deciso boxes
I haven't been able to find many other devices that tick so many boxes. These seem to exist on a class of their own.
For homelab, you are far better served buying a second hand Sophos baremetal/server rack mounted, and installing OPNSense in it.
I have a 2nd hand Sophos SG210 Rev3 from eBay, replaced the Celeron CPU with an i7 one, 16GB, new SSD, dual 10G NIC, it had been running like a dream.
There is no contract with MikroTik. You buy the hardware, that's it. The software and updates are free.