9 ms·

HomeLab #1: MikroTik as a Home Router

rafal_opilowski 3mo ago
From some time, I had a though about getting my home-lab. Prior to that, I've decided to prepare my networking for it and ditch the router given by my ISP for MikroTik to optimise the network. It turned out it's not easy - why? Check it out on my latest blog post!
zulux 3mo ago
For me, the era of MikroTik is sort of... now. Don't get me wrong, they make powerful and feature-complete stuff, but their UI sort of assumes you really know what you're doing. I don't know what I'm doing. But my LLM does. I've been able to set up site-to-site VPNs with Mikrotik in fifteen minutes now, rather than the day-long exercise of googling and praying.
- rafal_opilowski 3mo ago
  LLMs certainly help out - in my case, agent helped with searching through various web forums about how my ISP authenticates and sets up Internet connection. Nevertheless let's give MikroTik, where it's due: * new documentation page is much cleaner to browse * tutorials on their YouTube channel are quite informative * WinBox v4 has in my opinion much more pleasent UX/UI than v3
  - bombcar 3mo ago
    I’m going to admit it took me too many years to realize there is a Mac Winbox client - I assumed it was a windows only thing.
    - ZPrimed 3mo ago
      It was, until they came up with v4 around a year ago or so. It's possible to run v3 under Wine on a Mac but it was kind of clunky. V4 is much nicer (also runs on Linux too).
- sam_lowry_ 3mo ago
  Mikrotik makes great hardware that shines under Openvrt )
- qudat 3mo ago
  It’s been great for llm + cli usage on mikrotik
- hk1337 3mo ago
  I used claude to manage an ansible playbook for managing the mikrotik router. That way I can see the changes being done.
- gregsadetsky 3mo ago
  Shameless plug - a blog post re: LLMs and Mikrotiks from days ago! https://news.ycombinator.com/item?id=48927915 https://news.ycombinator.com/item?id=48927915
- graton 3mo ago
  Related they let you download the entire documentation in an LLM friendly format. https://manual.mikrotik.com/llms-full.txt https://manual.mikrotik.com/llms-full.txt Their front page documentation specifically mentions it: https://manual.mikrotik.com/docs/introduction#machine-readable-access-for-ai-tools https://manual.mikrotik.com/docs/introduction#machine-readab...
  - tenacious_tuna 3mo ago
    > LLM friendly format Is that not just markdown? is there a specific way of formatting docs that's "friendly" to LLMs now?
    - Bric3d 3mo ago
      I did not know about it, but it's actually linked in the LLM friendly doc [1]. Seems like some rules around being able to use parsing tools such as regex, and general formatting. [1]: https://llmstxt.org/ https://llmstxt.org/
    - justsomehnguy 3mo ago
      It's just a lazy export of their wiki/Confluence in a .md format. Ctrl+F in it for 'command provides information about RF' and the same on https://help.mikrotik.com/docs/spaces/ROS/pages/224559120/WiFi https://help.mikrotik.com/docs/spaces/ROS/pages/224559120/Wi...
- mmis1000 3mo ago
  Plus the routeros supports exporting all settings directly as text file. so you can really export the whole system, send it to llm and ask it to edit. install the new rule. in worst case you just install the old rule back if it fuck up, no really damage can happen.
  - 28304283409234 3mo ago
    Plus, safe mode. You can enable safe mode, mess around, and with a reboot you are back to known-good state.
- mrweasel 3mo ago
  > I don't know what I'm doing. That's also my problem. My colleague tells me that it's very easy to setup, but he's a network engineer and knows what things are. Mikrotik seems to operate in an interesting area between high-end home-labing and the SME market. Without preexisting networking knowledge at a certain level, their documentation isn't all that helpful. I'm sure you can learn from the documentation, YouTube videos and trial and error, but if like me you get a few hours once in a while to take down your home network and get it back up it's going to take a while to gain the required knowledge. I really want an addition internet connection so I can play with this stuff. On the negative, I'd say it's pretty clear that Mikrotik want you do buy training. It feels like some information is withheld by those with the certifications and Mikrotik and the UI isn't helping you much to figure out stuff on your own.
cyberax 3mo ago
Mikrotik is really a sweet spot for routers. It's feature-rich and it has a nice Web UI (or WinBox that is now cross-platform). And Mikrotik as a company is just amazing; they still support hardware that is almost 15 years old. Other routers: 1. OpenWRT is a bit too basic, and updates are hit-and-miss. 2. Ubiquity is a bit too Apple-like, with its reliance on apps and integration. 3. Cisco is WAY too expensive, and too complicated to set up without having Cisco experience. I'm now eagerly waiting for them to release the next generation of their routers. hEX Pro looks perfect to replace my aging CCR2004.
- m463 3mo ago
  on the other hand i got a mikrotik a while back and while setting it up it was silently phoning home. I installed openwrt and then installed it on many mikrotik routers over the years. to be honest, not so much traditional routers (wifi+4-5 ports) but on ~10 port mikrotik switches for my infra. i've since been switching to zyxel gs1900-* switches (up to 48 ports with openwrt)
  - znpy 3mo ago
    > i've since been switching to zyxel gs1900-* switches (up to 48 ports with openwrt) I’m sorry what? You can run openwrt on that line of switches? I just have a 24-port one at home running stock firmware…
    - m463 3mo ago
      they have all kinds of stuff that runs openwrt like: https://www.amazon.com/dp/B0978TF8K3/ https://www.amazon.com/dp/B0978TF8K3/ https://openwrt.org/toh/zyxel/gs1900-24hp_a1 https://openwrt.org/toh/zyxel/gs1900-24hp_a1 or: https://www.amazon.com/dp/B08TC3VJ61 https://www.amazon.com/dp/B08TC3VJ61 https://openwrt.org/toh/hwdata/zyxel/zyxel_xgs1250-12_b1 https://openwrt.org/toh/hwdata/zyxel/zyxel_xgs1250-12_b1
      - znpy 3mo ago
        lovely, thank you!
hendry 3mo ago
Switched to Ubiquiti, I'm quite happy except for their lack of a sane MCP.
- esseph 3mo ago
  Ubiquiti unifi has struggled to integrate routing as reliably and as well as the wireless and switching piece. Mikrotik router and unifi everything else has kind of been my go-to for at least 10 or 12y now.
  - byhemechi 3mo ago
    I can't speak for the more "entreprise-y" unifi stuff but the routing on the ubiquiti gear i've used is actually just FRR and if you SSH in you can do a whole lot more than is surfaced through the UI - for example, I have VXLAN running on my UDR7 right now. It's not something I've tried but I imagine you could actually expose FRR directly and configure through that
    - esseph 3mo ago
      For a long time if you made any changes through the web UI it would overwrite the config. Then you could make changes and it would save. Then they removed it. Then they added it back but it didn't always work. Not sure the current state. I have like a ~15y history of working with their stuff.
- oDot 3mo ago
  What's the state of FOSS licensing compliance? Have they repented?
  - hendry 3mo ago
    Mikrotik's FOSS story is as bad.
    - oDot 3mo ago
      Do expand
1over137 3mo ago
I’ve been very happy with Mikrotik. Chose them partly to reduce dependence on US tech too.
redlewel 3mo ago
I'm more than happy with VyOS. Throw that in proxmox and you have an open source JunOS with zero license headache. I do use Mikrotik for 2.5g switching though, zero complaints.
- donmcronald 3mo ago
  > zero license headache Isn’t it a subscription? And super expensive? $3k/year/device was the cheapest thing I saw on their site or $12k/5 years. 25k/year for an MSP. On a 5 year cycle we’d need to manage thousands on devices to make it more attractive than pfsense (cost wise). I really wanted to try it a few years ago but they seem like just another tech company that only wants millionaire customers.
  - graton 3mo ago
    I think they are saying if you use VyOs on Proxmox it gives you something equivalent to JunOs. I have no idea if that is true or not though.
  - redlewel 3mo ago
    Rolling release has zero issues for me and is completely free. If you want LTS(or you can just pin a rolling release around the same build) you can pay for a support contract. Similar to proxmox. The no-subscription product works just fine.
- davkan 3mo ago
  How are you managing updates? I absolutely loved vyos but after their repeated hostility towards non paying users I moved to mikrotik for my routers (already had mikrotik switches). First they stopped publishing LTS images, telling users to build from source. So people built gh repos you could clone and build with actions. Then they stopped making lts builds reproducible and told free users to use the preview release. But the preview release doesn’t get security updates. So if there’s a vulnerability you’re SOL until the next release which could be months. Not really tenable for an edge device for me and I’m not very interested in being a user of a product that does not want me.
bdavbdav 3mo ago
Frustratingly I couldn’t find a Mikrotik that would offer me a few SFPs, and a 2.5 or two. I wanted ideally just 3 SFPs - two WAN for LB / Failover and one up to switch. 2.5g WAN would do but would rather SFP for future use. UDM-SE it is for now.
- bombcar 3mo ago
  What exactly did you need and how did https://mikrotik.com/product/crs305_1g_4s_in https://mikrotik.com/product/crs305_1g_4s_in not do it? It says switch but it runs routerOS and can route at some speed - not 10G tho.
  - ZPrimed 3mo ago
    crs305 will choke when you start asking it to do NAT. it's a switch. It should be able to hardware-route between VLANs but it's not made for "home router" duties.
  - protocolture 3mo ago
    CRS is the switch product line and you would not believe how many professional network engineers do exactly as you have suggested and installed a CRS and asked why it locks up when routing.
    - walrus01 3mo ago
      I really would question any "professional" network engineer that can't tell the difference between a switch and a router... https://mikrotik.com/product/crs305_1g_4s_in https://mikrotik.com/product/crs305_1g_4s_in Each of the mikrotik switches even comes with a block diagram linked on its product page, showing for instance a single 1.3 Gbps between its L2 switch chip and its CPU. https://cdn.mikrotik.com/web-assets/product_files/CRS305-1G-4S_220955.png https://cdn.mikrotik.com/web-assets/product_files/CRS305-1G-...
      - protocolture 3mo ago
        >I really would question any "professional" network engineer that can't tell the difference between a switch and a router... Oh the stories I could tell you. I once had to work with a guy who didnt believe in dynamic routing. Which wouldn't have been too bad but he also didnt believe in route summarisation or any kind of planning. So the network was carved up into random unpredictable blocks. He sadly did very much believe in Mikrotik scripting, and so had scripts setup to disable/enable static routes based on very broad (often external) reachability criteria. Whenever googles DNS had an issue the whole network would start flapping scripts like nobodies business. The network was a large wisp with more than 600 pops and more than 10000 customers on its various services. That engineer had been gainfully employed by multiple ISPs over 20 years.
SlavikCA 3mo ago
About 2 years ago I tried to use Mikrotik, as the router for my ATT Fiber. It's royal pain. Basic router setup is not hard. Port forward to expose web server? Can be done after heavy docs&forum reading, but hair pinning never worked for me. I checked their WiFi AP. It's UI is hard even for senior software engineer. In the end I got opnSense installed in VM on Proxmox and it's my router for last 2 years. I'm using 2 Mikrotik switches with their simplified UI to operate VLANs. Zero complains.
- bombcar 3mo ago
  It wasn’t terribly complicated for me but I seem to be built for the old Cisco style iOS. But with an LLM it’s easier than falling off a log and the command line means it can do everything easily.
  - SlavikCA 3mo ago
    The router probably should work without relying on LLM: I remember I misconfigured it, and can't really Google around or ask LLM to fix it, because my Internet is down now. Of course I can use Internet on my phone, but it's not really convenient setup to ask LLM to troubleshoot the router.
    - Jnr 3mo ago
      There is a safe mode built in. If you enable it and you loose connection to the router due to some misconfiguration, it will reset within 15 minutes to the point of where you started the safe mode session. Also if you mess up the IP layer, there is a chance that you can still connect and configure RouterOS through their WinBox program using the mac address.
    - Hikikomori 3mo ago
      Their products aren't really for consumers, maybe prosumers, but mainly smaller companies or ISPs that don't want to pay for Cisco.
    - ssl-3 3mo ago
Jnr 3mo ago
I just got a backup ISP at home and connected fiber directly to Mikoritk using SFP dongle instead of the box provided by ISP. Scripts on RouterOS handle network checks for failover, DNS updates, etc. I got that Mikrotik home router 10 years ago and it is still performing great and handles most of the use cases without issues.
BLKNSLVR 3mo ago
I can't read the nearly-white (or super-thin font) text on the white background. Is that representative of using mikrotik hardware?
- niccl 3mo ago
  and reader-mode doesn't show the text
- rafal_opilowski 3mo ago
  Apologies, fix should be live now
  - BLKNSLVR 3mo ago
    Wow, wasn't really expecting a response, but got a quick response along with a fix. Thank you, excellent support! Nice detailed write-up too, and great explanatory diagrams.
stroebs 3mo ago
I've been a MikroTik fan since the beginning of my career some 15 years ago now. I have used the MikroTik router and Ubiquiti AP combination ever since. With that said, I can absolutely agree that their UX is terrible for anyone who doesn't specifically know how to configure a MikroTik router. The fact that you have to configure FQ-CoDel yourself and some bufferbloat protection isn't just a built-in option is absurd for anyone using it as a home router.
- parl_match 3mo ago
  They have an increasingly capable "simple" UI for casual users. It seems like improving it is on their roadmap, as they've been delivering vast improvements in functionality with each major release. Also, shipping winbox on all platforms has been a huge QoL improvement
  - int0x29 3mo ago
    Not sure how I missed the Linux binary. I can stop booting into Windows for it
    - davkan 3mo ago
      It always worked fine with wine for me.
  - flimflamm 3mo ago
    I configure it by copy pasting the pages to chatgpt and asking questions. Dumb? Maybe but seems to work.
    - brookst 3mo ago
      If you use codex or Claude code or similar you can just have it ssh in.
luizfelberti 3mo ago
I love MikroTik, but ffs just let me install something else on it. SONiC or any other Linux would be awesome. I love their hardware, but their software is absolutely awful. Is there any manufacturer out there who produces high quality hardware that is not locked down?
- cassianoleal 3mo ago
  The opnSense Deciso boxes are very nice and open - if a bit on the expensive side. https://shop.opnsense.com/product-categorie/hardware-appliances/ https://shop.opnsense.com/product-categorie/hardware-applian...
  - BLKNSLVR 3mo ago
    > if a bit on the expensive side. chokes on coffee From my old-man, everything-is-stupidly-expensive point of view, this is my scale: cheap side | reasonable | expensive side | Deciso boxes
    - cassianoleal 3mo ago
      I'm not disagreeing but they are quite powerful and fanless, with generous networking ports and both RAM and SSD can be upgraded. I haven't been able to find many other devices that tick so many boxes. These seem to exist on a class of their own.
      - BLKNSLVR 3mo ago
        Yep, and I can't disagree with that either, they know their niche (and know they're niche) and are catering to it. Having said that, mikrotik hardware running OpenWRT feels like something that might scratch one of my itches.
        cassianoleal 3mo ago
        Yeah all fair. I actually got a Dec740 second-hand (I think it belonged to a small company that either folded or grew out of it) for a reasonable price, upped the SSD and the RAM, and now I'm building a router "platform" on top of Incus. The idea is to run OpenWRT passing through the ISP NIC and one (or both) of the SFP+ ones going to the switch, and also run other services in isolated containers. I'm even thinking about putting Home Assistant on a VM on it but I'm not sure yet what impact it will have on routing performance so that's on hold for now. It's so much more powerful than what I need for the router/firewall that it should be comfortable to run quite a few things on it, and I can start moving them off it to other devices if Internet speeds catch up to it in the future.
mistic92 3mo ago
I went with omada and I'm happy for now
nubinetwork 3mo ago
I hope there is a part 2, where they make sure the internet can't access their management interfaces...
- rafal_opilowski 3mo ago
  I did more research and I've decided to start part #2 from hardening of my MikroTik prior to home-lab setup. Part #2 is live now!: https://justsomebody.dev/blog/gitops-k3s-flux https://justsomebody.dev/blog/gitops-k3s-flux
HackerThemAll 3mo ago
Mikrotik is not a mere replacement for plug and play routers such as TP-Link and the like. It's a very advanced device offering countless networking features, including multiple VPN server options, advanced Layer 2/bridging/switching features - VLANs, nested VLANs (Q-in-Q), VXLAN, spanning tree protocols (STP, RSTP, MSTP), 802.1x authentication, bridge-based firewall and bridge-based NAT, data center bridging (a.k.a. "lossless Ethernet"). Advanced Layer 3 features such as BGP, policy routing, traffic shaping, VRRP, hardware layer 3 acceleration. Then containers, matter/thread protocols, mesh networking, advanced wi-fi features such as centrally-managed network (CAPSMAN), multiple/virtual access points, hotspots, and many many more. Advanced firewall for both IPv4 and IPv6. On top of that scripting, SSH server, NTP server, DNS cache. API client for advanced integrations, and built-in scheduler, packet sniffer for troubleshooting, safe mode for automatic rollbacks of recent changes in case when the admin gets cut off due to a dangerous change. It'd be really hard to enumerate all that RouterOS offers. And all that is available from tiny home/SMB office devices starting at 40 USD, through dedicated wireless point to point bridges, to a big Ethernet switches/routers with 400G interfaces. Of course it doesn't compete with high end NVIDIA Spectrum-X, Cisco or Juniper, but is good enough for 95% of networks. It works great as a plug&play home/office router, too thanks to Quick Set, but for more sophisticated setups, a knowledge of networking protocols is mandatory. The more fancy setup, the more in-depth knowledge is required. Just like with programming and all stuff in life.
- bjoli 3mo ago
  One of their newer APs has thread radio. That is the best idea anyone has had since the mid 90s.
  - blurrybird 3mo ago
    How is the performance of their newer APs? That was always what was holding me back from switching off a 2.5GbE / WiFi 7 UniFi stack.
    - HackerThemAll 3mo ago
      There's the hAP be3 in the making, I'm hunting it since the announcement back in spring, but it's still unavailable in my area. :)
denkmoon 3mo ago
Just use linux! Why use someone else's non FOSS, locked down linux, when you could truly own your router? It's a great educational experience I would recommend to anyone interested in networking. Grab debian, grab a system with 2 NICs, make it your router/firewall/gateway.
- d3Xt3r 3mo ago
  > Grab debian, grab a system with 2 NICs, make it your router/firewall/gateway. The problem with this (assuming you meant a generic (x86?) system) is that you won't get wire speed processing (no hardware offloading), so network performance will suffer. Unless you buy a dedicated router board (which is typically ARM), like say something like the Banana Pi BPI-R4. But installing/configuring a standard distro line Debian for such a board would be a PITA (if you want to do it right and set it up optimally), so you're better off using a dedicated router distro like OpenWRT.
  - kogir 3mo ago
    I’ve not tried with 10gbps or faster links, but since we’re talking home use my success with 2.5 gbps links on standard amd64 hardware would suggest you’re wrong. Modern CPUs are quite capable. The problem isn’t performance, but power use.
  - rpcope1 3mo ago
    That's bogus unless you're talking above 10G, in which case the only things typically doing wire level performance are expensive and sold by vendors like Cisco, Juniper or Arista (and maybe it's higher than 10G now). Frankly, the vast majority of ARM based routers, unless you go out of your way, are garbage. Any x86 built in the last 15+ years with a NIC that's also not trash _will_ push at least 1G routed with a non-trivial firewall on a modern Linux kernel no problem. I've still got half a dozen PC Engines APU2 boards that unequivocally will get right at 1G on Debian Trixie; newer ewaste like Dell Wyse thin clients or Optiplexes would absolutely smoke those boards on performance. Setting up a router with Debian is really kind of overstated in terms of difficulty, and frankly half of everything wraps Debian anyways (looking at you Ubiquiti/Vyatta), so why learn someone else's half cooked configuration language when you can just do the real thing.
hk1337 3mo ago
I am glad, I am 99% sure it's the case, that I don't have to do CGNAT with ATT. Sounds like a pain. I like ipv6 but I have been thinking of disabling it lately because i cannot technically setup static leases with ipv6 like i can with ipv4, so technically the ipv6 for one of the services in my homelab could change and cause problems.
- self_awareness 3mo ago
  Android (phones, tv boxes) doesn't respect DHCPv6 IA_NA, but it should respect DHCPv6 IA_PD. Unless you have some other system that doesn't respect DHCP? Linuxes, Windowses, Playstation 5's support DHCPv6 IA_NA without problems. But also, even if a device doens't support DHCPv6 IA_NA, you can always also have a DNS server in your network, and you can bind SLAAC-generated Android addresses to simple subdomains. This seems better than DHCP anyway.
- Dagger2 3mo ago
  SLAAC-generated addresses will stay the same so long as the prefix and your MAC address stay the same, so there should be no need to do static leases. Also... service discovery. Needing static addresses is a kludge.
self_awareness 3mo ago
In Poland, Play.pl sets up IPv6 by default. One phone call to ISP to disable the hidden firewall on their router gives us full IPv6 network transparency, no NATs are needed anymore. I highly recommend after installing a firewall appliance (for example OPNsense, but probably Mikrotik should have it as well). IPv6 "feels" like how networks should work since the beginning. IPv4 feels like a legacy technology. They of course also have a DS-Lite AFTR gateways to tunnel the IPv4 traffic. In practice, everything works (for me at least).
h4kunamata 3mo ago
MikroTik is a nightmare from what I have heard, companies who invested hundreds of thousands of dollars cannot wait for the contract to expire to replace everything. For homelab, you are far better served buying a second hand Sophos baremetal/server rack mounted, and installing OPNSense in it. I have a 2nd hand Sophos SG210 Rev3 from eBay, replaced the Celeron CPU with an i7 one, 16GB, new SSD, dual 10G NIC, it had been running like a dream.
- bloqs 3mo ago
  Power consumption?
- AndroTux 3mo ago
  > cannot wait for the contract to expire There is no contract with MikroTik. You buy the hardware, that's it. The software and updates are free.
  - alt227 3mo ago
    Assuming OP is meaning the ISP contract they are in which requires them to use the ISP provided Microtik router.
- sdsdssweew213 3mo ago
  Another option is to just buy some used enterprise mini PC (google project tinyminimicro) with PCIE slot, and use that. Probably lower power consumption than a full rack mounted server, definitely takes much less space (unless you already have the rack).
mintflow 3mo ago
I am using a tiny mini pc j6412 with fd.io vpp(with dpdk enabled) and some customized plugins for pppoe and overlay tunnel, it works quite well and it's cheap and fully customized, and powerful For me when building homelab, customizability maybe important
alexdns 3mo ago
step 1 buy openwrt hardware accelerated NAT compatible device step 2 throw the mikrotik in the garbage
sp0ck 3mo ago
I love Mikrotik products but they are lacking what I need at home. I need basic IPS/IDS, notification when something is wrong without writing mikrotik scripts, easy backup failover, etc not VxLAN, QinQ and BGP extensive filtering :) I moved to Unifi Cloud Gateways as home/small soho routers and can't be happier. But Mikrotik stays as emergency hardware backup ..
onel 3mo ago
So good to see so many articles pop up on hn regarding self-hosting and home labbing
chpatrick 3mo ago
I gave it a shot but I really didn't see any benefit over OpenWRT which is plain old Linux. There's also some really good value hardware that you can install OpenWRT on, I picked up a Xiaomi AP for like $30, flashed OpenWRT and it works great.
- nopurpose 3mo ago
  Any recommendations for hardware?
  - chpatrick 3mo ago
    I got Xiaomi AX3000T, but I heard newer versions can't be flashed.
soggybread 3mo ago
mikrotik is great for the tech enthusiast who wants to test things out or use enterprise grade hardware but without the enterprise grade cost (no license fees) but this also means you're missing the enterprise grade support. The equipment is a fantastic deal for what you get but you need to know what you're doing to get the best performance out of it.
Saris 3mo ago
One thing that frustrates me about MikroTik and OpenWRT too, is a lot of things require multiple steps to set up, like adding a port forward with hairpin isn't just one click, adding a VLAN requires adding stuff in like 5+ different places. I really liked using Opnsense before I switched to Openwrt and I always want to go back, because it was just so much more streamlined and easy to configure from a 'geek but not a network engineer' perspective.
- brookst 3mo ago
  I use a mikrotik at home, and I always get a review from Claude after making config changes. I actually used to be a network engineer (many decades and career reinventions ago), and I appreciate that Mikrotik exposes all of the layers and connections between them. But damn if Claude doesn’t always find something I got wrong in the config.
batrat 3mo ago
I use tp-link everything. I have all of them connected to self-hosted Omada controller in docker. Works like a breeze, including notifications. Used MikroTik before but "the dude" or whatever is called now was hit and miss. Probably you don't need it anymore if get llm to configure it.
rafal_opilowski 3mo ago
Part #2 is live now!: https://news.ycombinator.com/item?id=49055917 https://news.ycombinator.com/item?id=49055917

From some time, I had a though about getting my home-lab. Prior to that, I've decided to prepare my networking for it and ditch the router given by my ISP for MikroTik to optimise the network. It turned out it's not easy - why? Check it out on my latest blog post!

zulux 3mo ago

For me, the era of MikroTik is sort of... now. Don't get me wrong, they make powerful and feature-complete stuff, but their UI sort of assumes you really know what you're doing. I don't know what I'm doing. But my LLM does. I've been able to set up site-to-site VPNs with Mikrotik in fifteen minutes now, rather than the day-long exercise of googling and praying.

rafal_opilowski 3mo ago
LLMs certainly help out - in my case, agent helped with searching through various web forums about how my ISP authenticates and sets up Internet connection. Nevertheless let's give MikroTik, where it's due: * new documentation page is much cleaner to browse * tutorials on their YouTube channel are quite informative * WinBox v4 has in my opinion much more pleasent UX/UI than v3
- bombcar 3mo ago
  I’m going to admit it took me too many years to realize there is a Mac Winbox client - I assumed it was a windows only thing.
  - ZPrimed 3mo ago
    It was, until they came up with v4 around a year ago or so. It's possible to run v3 under Wine on a Mac but it was kind of clunky. V4 is much nicer (also runs on Linux too).
sam_lowry_ 3mo ago
Mikrotik makes great hardware that shines under Openvrt )
qudat 3mo ago
It’s been great for llm + cli usage on mikrotik
hk1337 3mo ago
I used claude to manage an ansible playbook for managing the mikrotik router. That way I can see the changes being done.
gregsadetsky 3mo ago
Shameless plug - a blog post re: LLMs and Mikrotiks from days ago! https://news.ycombinator.com/item?id=48927915 https://news.ycombinator.com/item?id=48927915
graton 3mo ago
Related they let you download the entire documentation in an LLM friendly format. https://manual.mikrotik.com/llms-full.txt https://manual.mikrotik.com/llms-full.txt Their front page documentation specifically mentions it: https://manual.mikrotik.com/docs/introduction#machine-readable-access-for-ai-tools https://manual.mikrotik.com/docs/introduction#machine-readab...
- tenacious_tuna 3mo ago
  > LLM friendly format Is that not just markdown? is there a specific way of formatting docs that's "friendly" to LLMs now?
  - Bric3d 3mo ago
    I did not know about it, but it's actually linked in the LLM friendly doc [1]. Seems like some rules around being able to use parsing tools such as regex, and general formatting. [1]: https://llmstxt.org/ https://llmstxt.org/
  - justsomehnguy 3mo ago
    It's just a lazy export of their wiki/Confluence in a .md format. Ctrl+F in it for 'command provides information about RF' and the same on https://help.mikrotik.com/docs/spaces/ROS/pages/224559120/WiFi https://help.mikrotik.com/docs/spaces/ROS/pages/224559120/Wi...
mmis1000 3mo ago
Plus the routeros supports exporting all settings directly as text file. so you can really export the whole system, send it to llm and ask it to edit. install the new rule. in worst case you just install the old rule back if it fuck up, no really damage can happen.
- 28304283409234 3mo ago
  Plus, safe mode. You can enable safe mode, mess around, and with a reboot you are back to known-good state.
mrweasel 3mo ago
> I don't know what I'm doing. That's also my problem. My colleague tells me that it's very easy to setup, but he's a network engineer and knows what things are. Mikrotik seems to operate in an interesting area between high-end home-labing and the SME market. Without preexisting networking knowledge at a certain level, their documentation isn't all that helpful. I'm sure you can learn from the documentation, YouTube videos and trial and error, but if like me you get a few hours once in a while to take down your home network and get it back up it's going to take a while to gain the required knowledge. I really want an addition internet connection so I can play with this stuff. On the negative, I'd say it's pretty clear that Mikrotik want you do buy training. It feels like some information is withheld by those with the certifications and Mikrotik and the UI isn't helping you much to figure out stuff on your own.

cyberax 3mo ago

Mikrotik is really a sweet spot for routers. It's feature-rich and it has a nice Web UI (or WinBox that is now cross-platform). And Mikrotik as a company is just amazing; they still support hardware that is almost 15 years old. Other routers: 1. OpenWRT is a bit too basic, and updates are hit-and-miss. 2. Ubiquity is a bit too Apple-like, with its reliance on apps and integration. 3. Cisco is WAY too expensive, and too complicated to set up without having Cisco experience. I'm now eagerly waiting for them to release the next generation of their routers. hEX Pro looks perfect to replace my aging CCR2004.

m463 3mo ago
on the other hand i got a mikrotik a while back and while setting it up it was silently phoning home. I installed openwrt and then installed it on many mikrotik routers over the years. to be honest, not so much traditional routers (wifi+4-5 ports) but on ~10 port mikrotik switches for my infra. i've since been switching to zyxel gs1900-* switches (up to 48 ports with openwrt)
- znpy 3mo ago
  > i've since been switching to zyxel gs1900-* switches (up to 48 ports with openwrt) I’m sorry what? You can run openwrt on that line of switches? I just have a 24-port one at home running stock firmware…
  - m463 3mo ago
    they have all kinds of stuff that runs openwrt like: https://www.amazon.com/dp/B0978TF8K3/ https://www.amazon.com/dp/B0978TF8K3/ https://openwrt.org/toh/zyxel/gs1900-24hp_a1 https://openwrt.org/toh/zyxel/gs1900-24hp_a1 or: https://www.amazon.com/dp/B08TC3VJ61 https://www.amazon.com/dp/B08TC3VJ61 https://openwrt.org/toh/hwdata/zyxel/zyxel_xgs1250-12_b1 https://openwrt.org/toh/hwdata/zyxel/zyxel_xgs1250-12_b1
    - znpy 3mo ago
      lovely, thank you!

hendry 3mo ago

Switched to Ubiquiti, I'm quite happy except for their lack of a sane MCP.

esseph 3mo ago
Ubiquiti unifi has struggled to integrate routing as reliably and as well as the wireless and switching piece. Mikrotik router and unifi everything else has kind of been my go-to for at least 10 or 12y now.
- byhemechi 3mo ago
  I can't speak for the more "entreprise-y" unifi stuff but the routing on the ubiquiti gear i've used is actually just FRR and if you SSH in you can do a whole lot more than is surfaced through the UI - for example, I have VXLAN running on my UDR7 right now. It's not something I've tried but I imagine you could actually expose FRR directly and configure through that
  - esseph 3mo ago
    For a long time if you made any changes through the web UI it would overwrite the config. Then you could make changes and it would save. Then they removed it. Then they added it back but it didn't always work. Not sure the current state. I have like a ~15y history of working with their stuff.
oDot 3mo ago
What's the state of FOSS licensing compliance? Have they repented?
- hendry 3mo ago
  Mikrotik's FOSS story is as bad.
  - oDot 3mo ago
    Do expand

1over137 3mo ago

I’ve been very happy with Mikrotik. Chose them partly to reduce dependence on US tech too.

redlewel 3mo ago

I'm more than happy with VyOS. Throw that in proxmox and you have an open source JunOS with zero license headache. I do use Mikrotik for 2.5g switching though, zero complaints.

donmcronald 3mo ago
> zero license headache Isn’t it a subscription? And super expensive? $3k/year/device was the cheapest thing I saw on their site or $12k/5 years. 25k/year for an MSP. On a 5 year cycle we’d need to manage thousands on devices to make it more attractive than pfsense (cost wise). I really wanted to try it a few years ago but they seem like just another tech company that only wants millionaire customers.
- graton 3mo ago
  I think they are saying if you use VyOs on Proxmox it gives you something equivalent to JunOs. I have no idea if that is true or not though.
- redlewel 3mo ago
  Rolling release has zero issues for me and is completely free. If you want LTS(or you can just pin a rolling release around the same build) you can pay for a support contract. Similar to proxmox. The no-subscription product works just fine.
davkan 3mo ago
How are you managing updates? I absolutely loved vyos but after their repeated hostility towards non paying users I moved to mikrotik for my routers (already had mikrotik switches). First they stopped publishing LTS images, telling users to build from source. So people built gh repos you could clone and build with actions. Then they stopped making lts builds reproducible and told free users to use the preview release. But the preview release doesn’t get security updates. So if there’s a vulnerability you’re SOL until the next release which could be months. Not really tenable for an edge device for me and I’m not very interested in being a user of a product that does not want me.

bdavbdav 3mo ago

Frustratingly I couldn’t find a Mikrotik that would offer me a few SFPs, and a 2.5 or two. I wanted ideally just 3 SFPs - two WAN for LB / Failover and one up to switch. 2.5g WAN would do but would rather SFP for future use. UDM-SE it is for now.

bombcar 3mo ago
What exactly did you need and how did https://mikrotik.com/product/crs305_1g_4s_in https://mikrotik.com/product/crs305_1g_4s_in not do it? It says switch but it runs routerOS and can route at some speed - not 10G tho.
- ZPrimed 3mo ago
  crs305 will choke when you start asking it to do NAT. it's a switch. It should be able to hardware-route between VLANs but it's not made for "home router" duties.
- protocolture 3mo ago
  CRS is the switch product line and you would not believe how many professional network engineers do exactly as you have suggested and installed a CRS and asked why it locks up when routing.
  - walrus01 3mo ago
    I really would question any "professional" network engineer that can't tell the difference between a switch and a router... https://mikrotik.com/product/crs305_1g_4s_in https://mikrotik.com/product/crs305_1g_4s_in Each of the mikrotik switches even comes with a block diagram linked on its product page, showing for instance a single 1.3 Gbps between its L2 switch chip and its CPU. https://cdn.mikrotik.com/web-assets/product_files/CRS305-1G-4S_220955.png https://cdn.mikrotik.com/web-assets/product_files/CRS305-1G-...
    - protocolture 3mo ago
      >I really would question any "professional" network engineer that can't tell the difference between a switch and a router... Oh the stories I could tell you. I once had to work with a guy who didnt believe in dynamic routing. Which wouldn't have been too bad but he also didnt believe in route summarisation or any kind of planning. So the network was carved up into random unpredictable blocks. He sadly did very much believe in Mikrotik scripting, and so had scripts setup to disable/enable static routes based on very broad (often external) reachability criteria. Whenever googles DNS had an issue the whole network would start flapping scripts like nobodies business. The network was a large wisp with more than 600 pops and more than 10000 customers on its various services. That engineer had been gainfully employed by multiple ISPs over 20 years.

SlavikCA 3mo ago

About 2 years ago I tried to use Mikrotik, as the router for my ATT Fiber. It's royal pain. Basic router setup is not hard. Port forward to expose web server? Can be done after heavy docs&forum reading, but hair pinning never worked for me. I checked their WiFi AP. It's UI is hard even for senior software engineer. In the end I got opnSense installed in VM on Proxmox and it's my router for last 2 years. I'm using 2 Mikrotik switches with their simplified UI to operate VLANs. Zero complains.

bombcar 3mo ago
It wasn’t terribly complicated for me but I seem to be built for the old Cisco style iOS. But with an LLM it’s easier than falling off a log and the command line means it can do everything easily.
- SlavikCA 3mo ago
  The router probably should work without relying on LLM: I remember I misconfigured it, and can't really Google around or ask LLM to fix it, because my Internet is down now. Of course I can use Internet on my phone, but it's not really convenient setup to ask LLM to troubleshoot the router.
  - Jnr 3mo ago
    There is a safe mode built in. If you enable it and you loose connection to the router due to some misconfiguration, it will reset within 15 minutes to the point of where you started the safe mode session. Also if you mess up the IP layer, there is a chance that you can still connect and configure RouterOS through their WinBox program using the mac address.
  - Hikikomori 3mo ago
    Their products aren't really for consumers, maybe prosumers, but mainly smaller companies or ISPs that don't want to pay for Cisco.
  - ssl-3 3mo ago

Jnr 3mo ago

I just got a backup ISP at home and connected fiber directly to Mikoritk using SFP dongle instead of the box provided by ISP. Scripts on RouterOS handle network checks for failover, DNS updates, etc. I got that Mikrotik home router 10 years ago and it is still performing great and handles most of the use cases without issues.

BLKNSLVR 3mo ago

I can't read the nearly-white (or super-thin font) text on the white background. Is that representative of using mikrotik hardware?

niccl 3mo ago
and reader-mode doesn't show the text
rafal_opilowski 3mo ago
Apologies, fix should be live now
- BLKNSLVR 3mo ago
  Wow, wasn't really expecting a response, but got a quick response along with a fix. Thank you, excellent support! Nice detailed write-up too, and great explanatory diagrams.

stroebs 3mo ago

I've been a MikroTik fan since the beginning of my career some 15 years ago now. I have used the MikroTik router and Ubiquiti AP combination ever since. With that said, I can absolutely agree that their UX is terrible for anyone who doesn't specifically know how to configure a MikroTik router. The fact that you have to configure FQ-CoDel yourself and some bufferbloat protection isn't just a built-in option is absurd for anyone using it as a home router.

parl_match 3mo ago
They have an increasingly capable "simple" UI for casual users. It seems like improving it is on their roadmap, as they've been delivering vast improvements in functionality with each major release. Also, shipping winbox on all platforms has been a huge QoL improvement
- int0x29 3mo ago
  Not sure how I missed the Linux binary. I can stop booting into Windows for it
  - davkan 3mo ago
    It always worked fine with wine for me.
- flimflamm 3mo ago
  I configure it by copy pasting the pages to chatgpt and asking questions. Dumb? Maybe but seems to work.
  - brookst 3mo ago
    If you use codex or Claude code or similar you can just have it ssh in.

luizfelberti 3mo ago

I love MikroTik, but ffs just let me install something else on it. SONiC or any other Linux would be awesome. I love their hardware, but their software is absolutely awful. Is there any manufacturer out there who produces high quality hardware that is not locked down?

cassianoleal 3mo ago
The opnSense Deciso boxes are very nice and open - if a bit on the expensive side. https://shop.opnsense.com/product-categorie/hardware-appliances/ https://shop.opnsense.com/product-categorie/hardware-applian...
- BLKNSLVR 3mo ago
  > if a bit on the expensive side. chokes on coffee From my old-man, everything-is-stupidly-expensive point of view, this is my scale: cheap side | reasonable | expensive side | Deciso boxes
  - cassianoleal 3mo ago
    I'm not disagreeing but they are quite powerful and fanless, with generous networking ports and both RAM and SSD can be upgraded. I haven't been able to find many other devices that tick so many boxes. These seem to exist on a class of their own.
    - BLKNSLVR 3mo ago
      Yep, and I can't disagree with that either, they know their niche (and know they're niche) and are catering to it. Having said that, mikrotik hardware running OpenWRT feels like something that might scratch one of my itches.
      - cassianoleal 3mo ago
        Yeah all fair. I actually got a Dec740 second-hand (I think it belonged to a small company that either folded or grew out of it) for a reasonable price, upped the SSD and the RAM, and now I'm building a router "platform" on top of Incus. The idea is to run OpenWRT passing through the ISP NIC and one (or both) of the SFP+ ones going to the switch, and also run other services in isolated containers. I'm even thinking about putting Home Assistant on a VM on it but I'm not sure yet what impact it will have on routing performance so that's on hold for now. It's so much more powerful than what I need for the router/firewall that it should be comfortable to run quite a few things on it, and I can start moving them off it to other devices if Internet speeds catch up to it in the future.

mistic92 3mo ago

I went with omada and I'm happy for now

nubinetwork 3mo ago

I hope there is a part 2, where they make sure the internet can't access their management interfaces...

rafal_opilowski 3mo ago
I did more research and I've decided to start part #2 from hardening of my MikroTik prior to home-lab setup. Part #2 is live now!: https://justsomebody.dev/blog/gitops-k3s-flux https://justsomebody.dev/blog/gitops-k3s-flux

HackerThemAll 3mo ago

Mikrotik is not a mere replacement for plug and play routers such as TP-Link and the like. It's a very advanced device offering countless networking features, including multiple VPN server options, advanced Layer 2/bridging/switching features - VLANs, nested VLANs (Q-in-Q), VXLAN, spanning tree protocols (STP, RSTP, MSTP), 802.1x authentication, bridge-based firewall and bridge-based NAT, data center bridging (a.k.a. "lossless Ethernet"). Advanced Layer 3 features such as BGP, policy routing, traffic shaping, VRRP, hardware layer 3 acceleration. Then containers, matter/thread protocols, mesh networking, advanced wi-fi features such as centrally-managed network (CAPSMAN), multiple/virtual access points, hotspots, and many many more. Advanced firewall for both IPv4 and IPv6. On top of that scripting, SSH server, NTP server, DNS cache. API client for advanced integrations, and built-in scheduler, packet sniffer for troubleshooting, safe mode for automatic rollbacks of recent changes in case when the admin gets cut off due to a dangerous change. It'd be really hard to enumerate all that RouterOS offers. And all that is available from tiny home/SMB office devices starting at 40 USD, through dedicated wireless point to point bridges, to a big Ethernet switches/routers with 400G interfaces. Of course it doesn't compete with high end NVIDIA Spectrum-X, Cisco or Juniper, but is good enough for 95% of networks. It works great as a plug&play home/office router, too thanks to Quick Set, but for more sophisticated setups, a knowledge of networking protocols is mandatory. The more fancy setup, the more in-depth knowledge is required. Just like with programming and all stuff in life.

bjoli 3mo ago
One of their newer APs has thread radio. That is the best idea anyone has had since the mid 90s.
- blurrybird 3mo ago
  How is the performance of their newer APs? That was always what was holding me back from switching off a 2.5GbE / WiFi 7 UniFi stack.
  - HackerThemAll 3mo ago
    There's the hAP be3 in the making, I'm hunting it since the announcement back in spring, but it's still unavailable in my area. :)

denkmoon 3mo ago

Just use linux! Why use someone else's non FOSS, locked down linux, when you could truly own your router? It's a great educational experience I would recommend to anyone interested in networking. Grab debian, grab a system with 2 NICs, make it your router/firewall/gateway.

d3Xt3r 3mo ago
> Grab debian, grab a system with 2 NICs, make it your router/firewall/gateway. The problem with this (assuming you meant a generic (x86?) system) is that you won't get wire speed processing (no hardware offloading), so network performance will suffer. Unless you buy a dedicated router board (which is typically ARM), like say something like the Banana Pi BPI-R4. But installing/configuring a standard distro line Debian for such a board would be a PITA (if you want to do it right and set it up optimally), so you're better off using a dedicated router distro like OpenWRT.
- kogir 3mo ago
  I’ve not tried with 10gbps or faster links, but since we’re talking home use my success with 2.5 gbps links on standard amd64 hardware would suggest you’re wrong. Modern CPUs are quite capable. The problem isn’t performance, but power use.
- rpcope1 3mo ago
  That's bogus unless you're talking above 10G, in which case the only things typically doing wire level performance are expensive and sold by vendors like Cisco, Juniper or Arista (and maybe it's higher than 10G now). Frankly, the vast majority of ARM based routers, unless you go out of your way, are garbage. Any x86 built in the last 15+ years with a NIC that's also not trash _will_ push at least 1G routed with a non-trivial firewall on a modern Linux kernel no problem. I've still got half a dozen PC Engines APU2 boards that unequivocally will get right at 1G on Debian Trixie; newer ewaste like Dell Wyse thin clients or Optiplexes would absolutely smoke those boards on performance. Setting up a router with Debian is really kind of overstated in terms of difficulty, and frankly half of everything wraps Debian anyways (looking at you Ubiquiti/Vyatta), so why learn someone else's half cooked configuration language when you can just do the real thing.

hk1337 3mo ago

I am glad, I am 99% sure it's the case, that I don't have to do CGNAT with ATT. Sounds like a pain. I like ipv6 but I have been thinking of disabling it lately because i cannot technically setup static leases with ipv6 like i can with ipv4, so technically the ipv6 for one of the services in my homelab could change and cause problems.

self_awareness 3mo ago
Android (phones, tv boxes) doesn't respect DHCPv6 IA_NA, but it should respect DHCPv6 IA_PD. Unless you have some other system that doesn't respect DHCP? Linuxes, Windowses, Playstation 5's support DHCPv6 IA_NA without problems. But also, even if a device doens't support DHCPv6 IA_NA, you can always also have a DNS server in your network, and you can bind SLAAC-generated Android addresses to simple subdomains. This seems better than DHCP anyway.
Dagger2 3mo ago
SLAAC-generated addresses will stay the same so long as the prefix and your MAC address stay the same, so there should be no need to do static leases. Also... service discovery. Needing static addresses is a kludge.

self_awareness 3mo ago

In Poland, Play.pl sets up IPv6 by default. One phone call to ISP to disable the hidden firewall on their router gives us full IPv6 network transparency, no NATs are needed anymore. I highly recommend after installing a firewall appliance (for example OPNsense, but probably Mikrotik should have it as well). IPv6 "feels" like how networks should work since the beginning. IPv4 feels like a legacy technology. They of course also have a DS-Lite AFTR gateways to tunnel the IPv4 traffic. In practice, everything works (for me at least).

h4kunamata 3mo ago

MikroTik is a nightmare from what I have heard, companies who invested hundreds of thousands of dollars cannot wait for the contract to expire to replace everything. For homelab, you are far better served buying a second hand Sophos baremetal/server rack mounted, and installing OPNSense in it. I have a 2nd hand Sophos SG210 Rev3 from eBay, replaced the Celeron CPU with an i7 one, 16GB, new SSD, dual 10G NIC, it had been running like a dream.

bloqs 3mo ago
Power consumption?
AndroTux 3mo ago
> cannot wait for the contract to expire There is no contract with MikroTik. You buy the hardware, that's it. The software and updates are free.
- alt227 3mo ago
  Assuming OP is meaning the ISP contract they are in which requires them to use the ISP provided Microtik router.
sdsdssweew213 3mo ago
Another option is to just buy some used enterprise mini PC (google project tinyminimicro) with PCIE slot, and use that. Probably lower power consumption than a full rack mounted server, definitely takes much less space (unless you already have the rack).

mintflow 3mo ago

I am using a tiny mini pc j6412 with fd.io vpp(with dpdk enabled) and some customized plugins for pppoe and overlay tunnel, it works quite well and it's cheap and fully customized, and powerful For me when building homelab, customizability maybe important

alexdns 3mo ago

step 1 buy openwrt hardware accelerated NAT compatible device step 2 throw the mikrotik in the garbage

sp0ck 3mo ago

I love Mikrotik products but they are lacking what I need at home. I need basic IPS/IDS, notification when something is wrong without writing mikrotik scripts, easy backup failover, etc not VxLAN, QinQ and BGP extensive filtering :) I moved to Unifi Cloud Gateways as home/small soho routers and can't be happier. But Mikrotik stays as emergency hardware backup ..

onel 3mo ago

So good to see so many articles pop up on hn regarding self-hosting and home labbing

chpatrick 3mo ago

I gave it a shot but I really didn't see any benefit over OpenWRT which is plain old Linux. There's also some really good value hardware that you can install OpenWRT on, I picked up a Xiaomi AP for like $30, flashed OpenWRT and it works great.

nopurpose 3mo ago
Any recommendations for hardware?
- chpatrick 3mo ago
  I got Xiaomi AX3000T, but I heard newer versions can't be flashed.

soggybread 3mo ago

mikrotik is great for the tech enthusiast who wants to test things out or use enterprise grade hardware but without the enterprise grade cost (no license fees) but this also means you're missing the enterprise grade support. The equipment is a fantastic deal for what you get but you need to know what you're doing to get the best performance out of it.

Saris 3mo ago

One thing that frustrates me about MikroTik and OpenWRT too, is a lot of things require multiple steps to set up, like adding a port forward with hairpin isn't just one click, adding a VLAN requires adding stuff in like 5+ different places. I really liked using Opnsense before I switched to Openwrt and I always want to go back, because it was just so much more streamlined and easy to configure from a 'geek but not a network engineer' perspective.

brookst 3mo ago
I use a mikrotik at home, and I always get a review from Claude after making config changes. I actually used to be a network engineer (many decades and career reinventions ago), and I appreciate that Mikrotik exposes all of the layers and connections between them. But damn if Claude doesn’t always find something I got wrong in the config.

batrat 3mo ago

I use tp-link everything. I have all of them connected to self-hosted Omada controller in docker. Works like a breeze, including notifications. Used MikroTik before but "the dude" or whatever is called now was hit and miss. Probably you don't need it anymore if get llm to configure it.

rafal_opilowski 3mo ago

Part #2 is live now!: https://news.ycombinator.com/item?id=49055917 https://news.ycombinator.com/item?id=49055917