6 ms·

Amazing work and another warning that Microtik remains subpar when it comes to security and doubly worrying because their strategy seems obfuscation rather than

Amazing work and another warning that Microtik remains subpar when it comes to security and doubly worrying because their strategy seems obfuscation rather than engaging the community. It’s a shame because their hardware seems great for the price point (especially their point to point mmWave gear)

cyounkins 5y ago
There doesn't seem to be any security issue here, other than an undocumented protocol.
- yardstick 5y ago
  MAC-then-Encrypt is used, should be Encrypt-then-MAC.
yabones 5y ago
That's been my experience as well. Fantastic hardware value, but not great software. And not just "insecure" libraries etc, just... strange design decisions. For example, SwitchOS doesn't allow configuration of a default gateway on the management interface, instead it just returns the request on whatever interface/vlan it gets it from. It leads to some very very strange behaviour when setting up firewall rules... It's a shame, because the hardware is absolutely brilliant. I just wish they would open enough of their bootloader/hardware platform to allow 3rd party firmware to run easily.
- jareds 5y ago
  What would a basic home Wi-Fi network with two access points, a router, and a switch look like? I attempted to figure this out since I wanted to set up a network with multiple VLANs to separate work machines, IOT devices, and trusted devices once I started working remote. I couldn't figure it out so just bought Ubiquity gear. They were the sweet spot for configurability with out spending weeks learning how to configure network equipment as far as I could tell.
  - jhot 5y ago
    I picked up a RB750 and a TP-Link AP several years back to enhance my networking knowledge. Took me several days of trial, error, and figuring out the right search terms to get a network like you described. I enjoyed the process but it's not for everyone. But for about $130 the speed and stability blows away any equivalent-priced consumer technology with the added bonus of being much more configurable.
- dheera 5y ago
  Also, just the need to support two different OSes on the same hardware. Network hardware should be rock solid appliances that live up to their specs on every front that I can just set and forget, and maybe occasionally need to do a security update. I shouldn't have to think of the pros and cons of one firmware choice over another, I don't have time for that crap. Just make a fully-featured switch and fully-featured router and release them as such, instead of a crippled SwitchOS and crippled RouterOS, neither of which live up to the hardware's full potential.
- doubled112 5y ago
  I'm almost positive they rewrite everything possible, and this leads to some of these issues too. You can't assume that all of the features from upstream are in whatever they put in RouterOS. For example, OpenVPN UDP support was finally added to the stable stream this year after 10 years of asking about it.
- kazen44 5y ago
  not allowing routing on the management interface is a big deal breaker for anyone trying to seperate their management networks from their revenue traffic. This, including a couple of other issues, is keeping me from adapting mikrotik for anything more then a homelab.
  - freeopinion 5y ago
    How do you feel about OpenWRT on Mikrotik?
    - sam_lowry_ 5y ago
      Not OP, but... using daily at home on a few hAP AC boxes.
    - dicknuckle 5y ago
      I've been using it for about a year in a RBM11G for my home internet. it's been as stable as the Cradlepoint CBA750B it replaced. I reused the outdoor ABS box, still mounted on a 10ft steel pipe above my roof latitude 38 Eastern US, we get some pretty hot summers.
mwambua 5y ago
Out of curiosity... What hardware do you recommend for a better balance between affordable hardware and quality software?
- rfraile 5y ago
  Hard to beat Mikrotik
- LeonM 5y ago
  My answer here _used_ to be the Ubiquity Edgerouter-X series, but unfortunately Ubiquity has killed that line of products and they don't seem to be in the prosumer grade affordable router market anymore. I still enjoy my little Edgerouter-X SFP, it's fast, compact, power efficient and I can plug my fiber internet connection straight into the SFP slot. Management can be done via SSH. What's not to like? Edit: and yes, I know the edgerouters are still listed in the ubnt shop, but they have been 'sold out' for the past 3 years now. I don't think they'll ever return.
  - selectodude 5y ago
    I bought an Edgerouter 4 last year so they’re selling something to somebody…
- sam_lowry_ 5y ago
  hAP AC running Openwrt.
- luckman212 5y ago
  Netgate[0] (pfSense) is what I use, for edge routing at least. They had a big and long-awaited release today. [0] https://netgate.com https://netgate.com
- yobert 5y ago
  I've bought three Protectli servers/routers and put OpenBSD on all of them with great success. (With coreboot!) I highly recommend taking a look at https://protectli.com/product-comparison/ https://protectli.com/product-comparison/ though they do cost more than the microtik routers. Another option if you don't need tremendous performance is https://pcengines.ch/ https://pcengines.ch/ which also runs OpenBSD very well.
caycep 5y ago
are they one of the supported devices for one of the open source router firmwares?
- m463 5y ago
  Many mikrotik devices are supported by openwrt. I have several mikrotik 8 or 10-port switches running openwrt (rb2011* and rb3011*) https://openwrt.org/toh/mikrotik/rb2011 https://openwrt.org/toh/mikrotik/rb2011 https://github.com/adron-s/openwrt-rb3011 https://github.com/adron-s/openwrt-rb3011 others: https://openwrt.org/toh/mikrotik/start https://openwrt.org/toh/mikrotik/start

cyounkins 5y ago

There doesn't seem to be any security issue here, other than an undocumented protocol.

yardstick 5y ago
MAC-then-Encrypt is used, should be Encrypt-then-MAC.

yabones 5y ago

That's been my experience as well. Fantastic hardware value, but not great software. And not just "insecure" libraries etc, just... strange design decisions. For example, SwitchOS doesn't allow configuration of a default gateway on the management interface, instead it just returns the request on whatever interface/vlan it gets it from. It leads to some very very strange behaviour when setting up firewall rules... It's a shame, because the hardware is absolutely brilliant. I just wish they would open enough of their bootloader/hardware platform to allow 3rd party firmware to run easily.

jareds 5y ago
What would a basic home Wi-Fi network with two access points, a router, and a switch look like? I attempted to figure this out since I wanted to set up a network with multiple VLANs to separate work machines, IOT devices, and trusted devices once I started working remote. I couldn't figure it out so just bought Ubiquity gear. They were the sweet spot for configurability with out spending weeks learning how to configure network equipment as far as I could tell.
- jhot 5y ago
  I picked up a RB750 and a TP-Link AP several years back to enhance my networking knowledge. Took me several days of trial, error, and figuring out the right search terms to get a network like you described. I enjoyed the process but it's not for everyone. But for about $130 the speed and stability blows away any equivalent-priced consumer technology with the added bonus of being much more configurable.
dheera 5y ago
Also, just the need to support two different OSes on the same hardware. Network hardware should be rock solid appliances that live up to their specs on every front that I can just set and forget, and maybe occasionally need to do a security update. I shouldn't have to think of the pros and cons of one firmware choice over another, I don't have time for that crap. Just make a fully-featured switch and fully-featured router and release them as such, instead of a crippled SwitchOS and crippled RouterOS, neither of which live up to the hardware's full potential.
doubled112 5y ago
I'm almost positive they rewrite everything possible, and this leads to some of these issues too. You can't assume that all of the features from upstream are in whatever they put in RouterOS. For example, OpenVPN UDP support was finally added to the stable stream this year after 10 years of asking about it.
kazen44 5y ago
not allowing routing on the management interface is a big deal breaker for anyone trying to seperate their management networks from their revenue traffic. This, including a couple of other issues, is keeping me from adapting mikrotik for anything more then a homelab.
- freeopinion 5y ago
  How do you feel about OpenWRT on Mikrotik?
  - sam_lowry_ 5y ago
    Not OP, but... using daily at home on a few hAP AC boxes.
  - dicknuckle 5y ago
    I've been using it for about a year in a RBM11G for my home internet. it's been as stable as the Cradlepoint CBA750B it replaced. I reused the outdoor ABS box, still mounted on a 10ft steel pipe above my roof latitude 38 Eastern US, we get some pretty hot summers.

mwambua 5y ago

Out of curiosity... What hardware do you recommend for a better balance between affordable hardware and quality software?

rfraile 5y ago
Hard to beat Mikrotik
LeonM 5y ago
My answer here _used_ to be the Ubiquity Edgerouter-X series, but unfortunately Ubiquity has killed that line of products and they don't seem to be in the prosumer grade affordable router market anymore. I still enjoy my little Edgerouter-X SFP, it's fast, compact, power efficient and I can plug my fiber internet connection straight into the SFP slot. Management can be done via SSH. What's not to like? Edit: and yes, I know the edgerouters are still listed in the ubnt shop, but they have been 'sold out' for the past 3 years now. I don't think they'll ever return.
- selectodude 5y ago
  I bought an Edgerouter 4 last year so they’re selling something to somebody…
sam_lowry_ 5y ago
hAP AC running Openwrt.
luckman212 5y ago
Netgate[0] (pfSense) is what I use, for edge routing at least. They had a big and long-awaited release today. [0] https://netgate.com https://netgate.com
yobert 5y ago
I've bought three Protectli servers/routers and put OpenBSD on all of them with great success. (With coreboot!) I highly recommend taking a look at https://protectli.com/product-comparison/ https://protectli.com/product-comparison/ though they do cost more than the microtik routers. Another option if you don't need tremendous performance is https://pcengines.ch/ https://pcengines.ch/ which also runs OpenBSD very well.

caycep 5y ago

are they one of the supported devices for one of the open source router firmwares?

m463 5y ago
Many mikrotik devices are supported by openwrt. I have several mikrotik 8 or 10-port switches running openwrt (rb2011* and rb3011*) https://openwrt.org/toh/mikrotik/rb2011 https://openwrt.org/toh/mikrotik/rb2011 https://github.com/adron-s/openwrt-rb3011 https://github.com/adron-s/openwrt-rb3011 others: https://openwrt.org/toh/mikrotik/start https://openwrt.org/toh/mikrotik/start