5 ms·

I've been thinking about going with Mikrotik at least twice but never pulled the trigger because I am sort of a chicken shit. Is it easy for a noob to setup th

I've been thinking about going with Mikrotik at least twice but never pulled the trigger because I am sort of a chicken shit. Is it easy for a noob to setup things like port forwarding and vlans on a router/ap box?

grenoire 5y ago
Yeah, got hAP ac^2 and it's literally plug and play. Port forwarding etc. are all really easy.
minimaul 5y ago
Their firewall is essentially iptables. If you can work iptables, you can work the routeros firewall.
thequux 5y ago
Most of their devices come out of the box in a sensible configuration for a home router, and port forwarding/vlans are very straightforward to set up. If you're really worried, you can run the cloud-hosted router software in a VM to play around with it and find out if it will meet your needs.
28304283409234 5y ago
I would suggest looking at their wiki and screenshots or youtube of their UI. I've managed cisco amd juniper routers. And I can't make heads nor tails of it. As soon as you wonder off the default track, you're expected to understand deep level networking terminology abstracted in a UI tailored for experts.
- dcow 5y ago
  To setup port forwarding you have to understand how to configure the firewall, yes. This is both a drawback for simple use cases but a boon for more advanced ones. It cuts both ways. Personally I think it’s rather unfair to call the UI unintelligible. If you don't like it just ssh to it and configure it that way. Everything you can do is packaged up in a nice command structure.
mindslight 5y ago
I've got a few Mikrotik devices (CRS328, CSS326). Maybe I just haven't gotten it, but I find their RouterOS WebUI extremely confusing. Like go into three separate top-level tabs to assign a VLAN to a port. The CLI is okay, once you get stuff working and just need to duplicate/modify lines. Mikrotik's SwOS is alright and has most of the options you'd expect from a switch, but is missing the ability to have a human readable text config. I've got a Netgear switch as well, and I'd label its obtuseness on par with RouterOS. At the end of the day it seems every network vendor has their own bespoke proprietary UI that you have to suffer through. In general I'm much more at home with Linux's iproute2/bridge-utils/nft. What I really want is some low power switches that can run OpenFlow or the like so I can centralize all the config back to my Linux router. On a home network, most devices shouldn't be talking directly among themselves anyway! Another thing I really want is for network switches to have an RGB LED on each port that can indicate what VLAN it's configured for.
- minimaul 5y ago
  I find that Winbox is much more usable than the WebUI - it runs well under wine (and even on m1, you can run it under wine64 under rosetta).
- iso1210 5y ago
  Yes, mikrotiks separate bridges, vlans, interfaces. If you want to set ether 3, 4 and 5 to untagged vlan called "Alf" with ID 11, ether 6 to untablled vlan "Bob" (id 12), and ether 7 and 8 to a trunk of both Alf and Bob, you can do 1) Create a bridge for Alf, and a bridge for Bob 2) Assign IPs for them (assuming your mikrotik is the router), and maybe dhcp pools, server etc 3) add ether3, 4 and 5 as bridge ports for Alf, and ether6 for Bob 4) Create a vlan interface on ether7 for Alf with vlanid=11, add to bridge Alf 5) Create a vlan interface on ether8 for Alf with vlanid=11, add to bridge Alf 6) Create a vlan interface on ether7 for Bob with vlanid=21, add to bridge Bob 7) Create a vlan interface on ether8 for Bob with vlanid=21, add to bridge Bob But the killer is there are two different recommended ways to do it depending on the hardware.
  - mindslight 5y ago
sandGorgon 5y ago
yes. but more importantly, they are extremely popular - big ecosystem of freelancers. you can go on fiverr and upwork and get someone to remotely configure/manage it for you.
- trulyme 5y ago
  Curious, would you trust someone to do that? For me when it comes to network, my paranoia level is sky high. I would definitely not allow some random person to configure my network...
  - sandGorgon 5y ago
    It's no different than devops. I'm not quite sure what you mean here. Everyone from banks to small shops use IT configuration services. Most people will supply you a resume, contact details and sign a NDA. That's quite good enough.
tguvot 5y ago
worked for me. one suggestion though, get a serial cable, so in case you creative some too creative vlan config that will lock you out, you could fix it without having to reset entire box
- Sebb767 5y ago
  Alternatively, make a backup before screwing with the VLAN. Then resetting the box is not as much of a set-back.
  - tguvot 5y ago
    this is too. i guess ultimate solution is mix of backup and serial<>bt or serial<>wifi dongle. this is in case you gonna mess configuration frequently
  - Railander 5y ago
    Also alternatively, turn on Safe Mode so if you lose access the router will revert to the configuration state when Safe Mode was turned on.
Moeancurly 5y ago
I've been using a MikroTik router at home for 6+ years; I would say that RouterOS is absolutely NOT "easy for a noob". It's on the prosumer side of things, but you need to be willing to sink your teeth into some fairly gritty network configuration workflows. Anyone posting on HN will likely be able to figure out the basics, but it is definitely much less polished than other prosumer products such as Ubiquiti and the documentation can be a little rough around the edges.
Toutouxc 5y ago
Both the GUI and their CLI are among the most unintuitive systems I've ever seen. I definitely spent more than one evening trying to configure my Mikrotik from scratch as a typical home router + switch + AP. I'm no networking guru, I only did some Cisco stuff a few years ago at uni, but I didn't understand 80 % of the terms used in their OS.
- Railander 5y ago
  Agreed, MikroTik is extremely complex due to how feature-rich it is and because they run the same OS across all their devices, regardless of router/switch/AP/generation. Definitely not for the faint of heart that simply want to do some basic networking. On the other hand, I'm not sure "unintuitive" is the correct word here. Having had the (dis)pleasure of setting up complex topologies on other manufactures like Cisco I found MikroTik to be considerably more intuitive (or perhaps "less unintuitive" would be more appropriate), possibly because Cisco has been built on for many decades and new features were constantly added on top of existing systems for compatibility purposes instead of redoing the CLI from scratch to make a more consistent user experience.
blibble 5y ago
it's basically a (somewhat) pretty gui around iptables and /etc/network/interfaces everything more or less maps directly onto raw Linux functionality
izacus 5y ago
Nope, it's really not for noobs. Basics things you can get via click on other SoHo routers like sane default firewall configuration, NAT loopback or simple VPN setup do not exist here. Setting up a Mikrotik is more akin to setting up a DSL connection on 1992 Linux - it's all "technically" available in the UI, but the UI is just a clickable version of all the CLI complexity and you need to know network terminology to get to capability of a default SoHo router configuration. Having said that - if you know network setup very well, then Mikrotiks are very powerful and allow for network setups that are much more flexible than consumer equipment.
- groone 5y ago
  But once you know that you need a NAT loopback, you can quickly follow instructions on internet to create that rule.
  - izacus 5y ago
    Well, I've been fighting this for two years now and it still doesn't work, sooooo :) (Also configuring IPv6 correctly is also a special hell that's far away from clicking "enable IPv6" on my previous ASUS)
    - Railander 5y ago
      Their firewall is iptables wrapped in a really nice GUI. The criticism on their firewall might as well be a criticism on iptables (which IMO is completely valid, even after years I still have doubts about what a certain rules structure is going to do). iptables itself is extremely unintuitive (although extremely powerful and flexible), but their GUI makes it more manageable.
core-utility 5y ago
As someone with moderate networking experience in a Cisco environment, and having set up Ubiquiti products and a pfsense router, MikroTik tops the cake for worst learning curve. I wasn't even trying to use it as a router, I just wanted a basic L2/L3 switch with some VLANs. It's set up now and I'm happy with it, but prepare for lots of trial, error, and head scratching.
james_in_the_uk 5y ago
It depends on your expectations of "easy". When compared to consumer router devices, then no. When compared to configuring enterprise networking kit using the CLI ... well ... perhaps. Mikrotik does have some short cuts / UI features. But if you want to do anything vaguely complex, you're going to need to put some serious time into getting your head around the way the system processes packets. If getting to grips with how packets flow through different subsystems in your router doesn't really appeal (check out https://wiki.mikrotik.com/wiki/Manual:Packet_Flow https://wiki.mikrotik.com/wiki/Manual:Packet_Flow) then there are better, simpler options which are still powerful.

grenoire 5y ago

Yeah, got hAP ac^2 and it's literally plug and play. Port forwarding etc. are all really easy.

minimaul 5y ago

Their firewall is essentially iptables. If you can work iptables, you can work the routeros firewall.

thequux 5y ago

Most of their devices come out of the box in a sensible configuration for a home router, and port forwarding/vlans are very straightforward to set up. If you're really worried, you can run the cloud-hosted router software in a VM to play around with it and find out if it will meet your needs.

28304283409234 5y ago

I would suggest looking at their wiki and screenshots or youtube of their UI. I've managed cisco amd juniper routers. And I can't make heads nor tails of it. As soon as you wonder off the default track, you're expected to understand deep level networking terminology abstracted in a UI tailored for experts.

dcow 5y ago
To setup port forwarding you have to understand how to configure the firewall, yes. This is both a drawback for simple use cases but a boon for more advanced ones. It cuts both ways. Personally I think it’s rather unfair to call the UI unintelligible. If you don't like it just ssh to it and configure it that way. Everything you can do is packaged up in a nice command structure.

mindslight 5y ago

I've got a few Mikrotik devices (CRS328, CSS326). Maybe I just haven't gotten it, but I find their RouterOS WebUI extremely confusing. Like go into three separate top-level tabs to assign a VLAN to a port. The CLI is okay, once you get stuff working and just need to duplicate/modify lines. Mikrotik's SwOS is alright and has most of the options you'd expect from a switch, but is missing the ability to have a human readable text config. I've got a Netgear switch as well, and I'd label its obtuseness on par with RouterOS. At the end of the day it seems every network vendor has their own bespoke proprietary UI that you have to suffer through. In general I'm much more at home with Linux's iproute2/bridge-utils/nft. What I really want is some low power switches that can run OpenFlow or the like so I can centralize all the config back to my Linux router. On a home network, most devices shouldn't be talking directly among themselves anyway! Another thing I really want is for network switches to have an RGB LED on each port that can indicate what VLAN it's configured for.

minimaul 5y ago
I find that Winbox is much more usable than the WebUI - it runs well under wine (and even on m1, you can run it under wine64 under rosetta).
iso1210 5y ago
Yes, mikrotiks separate bridges, vlans, interfaces. If you want to set ether 3, 4 and 5 to untagged vlan called "Alf" with ID 11, ether 6 to untablled vlan "Bob" (id 12), and ether 7 and 8 to a trunk of both Alf and Bob, you can do 1) Create a bridge for Alf, and a bridge for Bob 2) Assign IPs for them (assuming your mikrotik is the router), and maybe dhcp pools, server etc 3) add ether3, 4 and 5 as bridge ports for Alf, and ether6 for Bob 4) Create a vlan interface on ether7 for Alf with vlanid=11, add to bridge Alf 5) Create a vlan interface on ether8 for Alf with vlanid=11, add to bridge Alf 6) Create a vlan interface on ether7 for Bob with vlanid=21, add to bridge Bob 7) Create a vlan interface on ether8 for Bob with vlanid=21, add to bridge Bob But the killer is there are two different recommended ways to do it depending on the hardware.
- mindslight 5y ago

sandGorgon 5y ago

yes. but more importantly, they are extremely popular - big ecosystem of freelancers. you can go on fiverr and upwork and get someone to remotely configure/manage it for you.

trulyme 5y ago
Curious, would you trust someone to do that? For me when it comes to network, my paranoia level is sky high. I would definitely not allow some random person to configure my network...
- sandGorgon 5y ago
  It's no different than devops. I'm not quite sure what you mean here. Everyone from banks to small shops use IT configuration services. Most people will supply you a resume, contact details and sign a NDA. That's quite good enough.

tguvot 5y ago

worked for me. one suggestion though, get a serial cable, so in case you creative some too creative vlan config that will lock you out, you could fix it without having to reset entire box

Sebb767 5y ago
Alternatively, make a backup before screwing with the VLAN. Then resetting the box is not as much of a set-back.
- tguvot 5y ago
  this is too. i guess ultimate solution is mix of backup and serial<>bt or serial<>wifi dongle. this is in case you gonna mess configuration frequently
- Railander 5y ago
  Also alternatively, turn on Safe Mode so if you lose access the router will revert to the configuration state when Safe Mode was turned on.

Moeancurly 5y ago

I've been using a MikroTik router at home for 6+ years; I would say that RouterOS is absolutely NOT "easy for a noob". It's on the prosumer side of things, but you need to be willing to sink your teeth into some fairly gritty network configuration workflows. Anyone posting on HN will likely be able to figure out the basics, but it is definitely much less polished than other prosumer products such as Ubiquiti and the documentation can be a little rough around the edges.

Toutouxc 5y ago

Both the GUI and their CLI are among the most unintuitive systems I've ever seen. I definitely spent more than one evening trying to configure my Mikrotik from scratch as a typical home router + switch + AP. I'm no networking guru, I only did some Cisco stuff a few years ago at uni, but I didn't understand 80 % of the terms used in their OS.

Railander 5y ago
Agreed, MikroTik is extremely complex due to how feature-rich it is and because they run the same OS across all their devices, regardless of router/switch/AP/generation. Definitely not for the faint of heart that simply want to do some basic networking. On the other hand, I'm not sure "unintuitive" is the correct word here. Having had the (dis)pleasure of setting up complex topologies on other manufactures like Cisco I found MikroTik to be considerably more intuitive (or perhaps "less unintuitive" would be more appropriate), possibly because Cisco has been built on for many decades and new features were constantly added on top of existing systems for compatibility purposes instead of redoing the CLI from scratch to make a more consistent user experience.

blibble 5y ago

it's basically a (somewhat) pretty gui around iptables and /etc/network/interfaces everything more or less maps directly onto raw Linux functionality

izacus 5y ago

Nope, it's really not for noobs. Basics things you can get via click on other SoHo routers like sane default firewall configuration, NAT loopback or simple VPN setup do not exist here. Setting up a Mikrotik is more akin to setting up a DSL connection on 1992 Linux - it's all "technically" available in the UI, but the UI is just a clickable version of all the CLI complexity and you need to know network terminology to get to capability of a default SoHo router configuration. Having said that - if you know network setup very well, then Mikrotiks are very powerful and allow for network setups that are much more flexible than consumer equipment.

groone 5y ago
But once you know that you need a NAT loopback, you can quickly follow instructions on internet to create that rule.
- izacus 5y ago
  Well, I've been fighting this for two years now and it still doesn't work, sooooo :) (Also configuring IPv6 correctly is also a special hell that's far away from clicking "enable IPv6" on my previous ASUS)
  - Railander 5y ago
    Their firewall is iptables wrapped in a really nice GUI. The criticism on their firewall might as well be a criticism on iptables (which IMO is completely valid, even after years I still have doubts about what a certain rules structure is going to do). iptables itself is extremely unintuitive (although extremely powerful and flexible), but their GUI makes it more manageable.

core-utility 5y ago

As someone with moderate networking experience in a Cisco environment, and having set up Ubiquiti products and a pfsense router, MikroTik tops the cake for worst learning curve. I wasn't even trying to use it as a router, I just wanted a basic L2/L3 switch with some VLANs. It's set up now and I'm happy with it, but prepare for lots of trial, error, and head scratching.

james_in_the_uk 5y ago

It depends on your expectations of "easy". When compared to consumer router devices, then no. When compared to configuring enterprise networking kit using the CLI ... well ... perhaps. Mikrotik does have some short cuts / UI features. But if you want to do anything vaguely complex, you're going to need to put some serious time into getting your head around the way the system processes packets. If getting to grips with how packets flow through different subsystems in your router doesn't really appeal (check out https://wiki.mikrotik.com/wiki/Manual:Packet_Flow https://wiki.mikrotik.com/wiki/Manual:Packet_Flow) then there are better, simpler options which are still powerful.