5 ms·

It's worth pointing out that the default configuration of almost every Mikrotik router these days comes with a firewall that blocks inbound access to all ports.

by r1ch 8y ago

It's worth pointing out that the default configuration of almost every Mikrotik router these days comes with a firewall that blocks inbound access to all ports. Admins have to go out of their way to expose winbox to the internet (as many did - including myself - under the belief the protocol was somewhat secure running over TLS). Unfortunately NIH syndrome runs at an all time high at Mikrotik. Even the RouterOS webserver and SMB implementations were custom written, and both were later found to contain remotely exploitable bugs. I'm sure there are other holes lurking in their implementations of ipsec, openvpn, etc, so I no longer open up anything and rely on port forwarding to more secure and battle-tested services like OpenSSH / Wireguard for remote management.

eps 8y ago
This explains a lot. Mikrotik boxes are really quirky. They basically have user-facing bugs, symptoms of which can have no explanation except for them fronting some massive clusterfuck on the inside. They used to do bizarre things with timestamps of freshly copied files, when the modified time would oscillate around some convergence point. Some wierd directory names (like .popup ?) were reserved for no apparent reason and an attempt to create them failed with "file not found". That sort of thing. And we even didn't own any of their devices, we were just in a splatter zone from our clients constantly walking into Mikrotik issues. It was few years ago though, so perhaps things have improved since then.
- r1ch 8y ago
  I've been using MT gear for about 10 years now. I actually think the devices themselves are very solid once they're up and running. I've had some running for years without any issues (try that with most other SOHO router brands!), though reboots are much more frequent these days due to security updates. I do agree though that the software side of things can be a bit quirky and the recent security issues are a worrying glimpse into the quality of their code. In general I wish the platform was more open (you can't even get a shell without rooting the device), but it's something I can live with at this price point. Unfortunately given their affordability and feature set, Mikrotik routers are often times administered by people who don't really have a solid grasp of networking. I've seen some downright awful advice posted on their user forums over the years, stuff that could easily cause connectivity issues under the right circumstances. Who knows how much of that gets copy/pasted into configs after a quick Google search.
philamonster 8y ago
>...so I no longer open up anything and rely on port forwarding to more secure and battle-tested services like OpenSSH / Wireguard for remote management. Absolutely. I purchased an rb2011uiasrm when I got gig fiber at home. I enjoyed hardening the router and ran IPsec VPN for a bit but prefer using another box w/OpenVPN and HMAC auth. I just don't see no matter the promise of security a good reason for explicitly allowing remote access from internet to a core device, MikroTik or otherwise.

by r1ch 8y ago

eps 8y ago

This explains a lot. Mikrotik boxes are really quirky. They basically have user-facing bugs, symptoms of which can have no explanation except for them fronting some massive clusterfuck on the inside. They used to do bizarre things with timestamps of freshly copied files, when the modified time would oscillate around some convergence point. Some wierd directory names (like .popup ?) were reserved for no apparent reason and an attempt to create them failed with "file not found". That sort of thing. And we even didn't own any of their devices, we were just in a splatter zone from our clients constantly walking into Mikrotik issues. It was few years ago though, so perhaps things have improved since then.

r1ch 8y ago
I've been using MT gear for about 10 years now. I actually think the devices themselves are very solid once they're up and running. I've had some running for years without any issues (try that with most other SOHO router brands!), though reboots are much more frequent these days due to security updates. I do agree though that the software side of things can be a bit quirky and the recent security issues are a worrying glimpse into the quality of their code. In general I wish the platform was more open (you can't even get a shell without rooting the device), but it's something I can live with at this price point. Unfortunately given their affordability and feature set, Mikrotik routers are often times administered by people who don't really have a solid grasp of networking. I've seen some downright awful advice posted on their user forums over the years, stuff that could easily cause connectivity issues under the right circumstances. Who knows how much of that gets copy/pasted into configs after a quick Google search.

philamonster 8y ago

>...so I no longer open up anything and rely on port forwarding to more secure and battle-tested services like OpenSSH / Wireguard for remote management. Absolutely. I purchased an rb2011uiasrm when I got gig fiber at home. I enjoyed hardening the router and ran IPsec VPN for a bit but prefer using another box w/OpenVPN and HMAC auth. I just don't see no matter the promise of security a good reason for explicitly allowing remote access from internet to a core device, MikroTik or otherwise.