They have an increasingly capable "simple" UI for casual users. It seems like improving it is on their roadmap, as they've been delivering vast improvements in functionality with each major release.

Also, shipping winbox on all platforms has been a huge QoL improvement

Related they let you download the entire documentation in an LLM friendly format.

https://manual.mikrotik.com/llms-full.txt

Their front page documentation specifically mentions it: https://manual.mikrotik.com/docs/introduction#machine-readab...

LLMs certainly help out - in my case, agent helped with searching through various web forums about how my ISP authenticates and sets up Internet connection.

Nevertheless let's give MikroTik, where it's due:

* new documentation page is much cleaner to browse

* tutorials on their YouTube channel are quite informative

* WinBox v4 has in my opinion much more pleasent UX/UI than v3

> I don't know what I'm doing.

That's also my problem. My colleague tells me that it's very easy to setup, but he's a network engineer and knows what things are.

Mikrotik seems to operate in an interesting area between high-end home-labing and the SME market. Without preexisting networking knowledge at a certain level, their documentation isn't all that helpful. I'm sure you can learn from the documentation, YouTube videos and trial and error, but if like me you get a few hours once in a while to take down your home network and get it back up it's going to take a while to gain the required knowledge. I really want an addition internet connection so I can play with this stuff.

On the negative, I'd say it's pretty clear that Mikrotik want you do buy training. It feels like some information is withheld by those with the certifications and Mikrotik and the UI isn't helping you much to figure out stuff on your own.

Mikrotik makes great hardware that shines under Openvrt )

Plus the routeros supports exporting all settings directly as text file. so you can really export the whole system, send it to llm and ask it to edit. install the new rule.

in worst case you just install the old rule back if it fuck up, no really damage can happen.

Shameless plug - a blog post re: LLMs and Mikrotiks from days ago! https://news.ycombinator.com/item?id=48927915

I used claude to manage an ansible playbook for managing the mikrotik router. That way I can see the changes being done.

It’s been great for llm + cli usage on mikrotik

In which way is OpenWRT basic?

Where would Netgate pfSense+ fit on that list?

I tried Mikrotik and the UI was wasting so much of my time, it was worth switching to Netgate, for me.

on the other hand i got a mikrotik a while back and while setting it up it was silently phoning home.

I installed openwrt and then installed it on many mikrotik routers over the years. to be honest, not so much traditional routers (wifi+4-5 ports) but on ~10 port mikrotik switches for my infra.

i've since been switching to zyxel gs1900-* switches (up to 48 ports with openwrt)

Check out Glinet.

How are you managing updates?

I absolutely loved vyos but after their repeated hostility towards non paying users I moved to mikrotik for my routers (already had mikrotik switches).

First they stopped publishing LTS images, telling users to build from source. So people built gh repos you could clone and build with actions. Then they stopped making lts builds reproducible and told free users to use the preview release. But the preview release doesn’t get security updates. So if there’s a vulnerability you’re SOL until the next release which could be months. Not really tenable for an edge device for me and I’m not very interested in being a user of a product that does not want me.

> zero license headache

Isn’t it a subscription? And super expensive? $3k/year/device was the cheapest thing I saw on their site or $12k/5 years. 25k/year for an MSP. On a 5 year cycle we’d need to manage thousands on devices to make it more attractive than pfsense (cost wise).

I really wanted to try it a few years ago but they seem like just another tech company that only wants millionaire customers.

It should be doable by most software engineers. They did teach some basic CCNA course in the university as part of computer science studies and the concepts taught there should help a lot with configuring any router, including RouterOS. It could also be helpful to watch some guides on routing and firewall on Linux, since RouterOS is just Linux with a very specific UI on top.

Port forwarding is a simple dstnat rule and hairpinning is just a srcnat rule.

It wasn’t terribly complicated for me but I seem to be built for the old Cisco style iOS.

But with an LLM it’s easier than falling off a log and the command line means it can do everything easily.

Agreed. I tried Microtik. Seemed like it was written by DOS people from the 70s or 80s, made difficult on purpose.

I ended up switching to back to Ubiquti.

> Grab debian, grab a system with 2 NICs, make it your router/firewall/gateway.

The problem with this (assuming you meant a generic (x86?) system) is that you won't get wire speed processing (no hardware offloading), so network performance will suffer. Unless you buy a dedicated router board (which is typically ARM), like say something like the Banana Pi BPI-R4. But installing/configuring a standard distro line Debian for such a board would be a PITA (if you want to do it right and set it up optimally), so you're better off using a dedicated router distro like OpenWRT.

Please link a SFF box or SoC with:

- 1x10GB SFP+

- 1x2.5GB Ethernet w/ PoE In

- 7x1GB Ethernet w/ PoE In/Out

- powered by DC jack, 2 pin, or PoE

- Similarly sized to 220 × 125 × 22 mm (approx 8.66 × 4.92 × 0.86 inches)

- Max power consumption 150W

- Silent

- ~$300

And I can replace my RB5009Upr+S+IN.

Bingo. I use Mikrotik for my switches. They were the first I found that had 10Gb uplinks, inexpensively and with low power usage. L2 configuration is janky (like every other switch) but workable. I use both SwOS and ROS, but moving towards ROS for dot1x (unfortunately inescapable to have that functionality on the switch).

But the actual router? That lives on NixOS in a virtual machine on a generic amd64 machine that also runs NixOS. I'd rather design / perfect my config once in terms of iproute2/nftables and know I can swap in any hardware. I've got a full policy routing setup that let's me define for each device what Internet horizon it can see (along with what other local devices it can access).

I also find the sibling comment mentioning routing speed to be funny. I've found that unencrypted gigabit WAN is easily handled by most amd64 computers. 10Gb LAN->LAN hairpin routing seems fine. But the big thing is doing gigabit OpenVPN/wireguard, which off the shelf hardware-accelerated routers just don't really do unless you spend a lot. (coupled with the above policy routing, I can configure things like this particular web browsing VM goes out a data center IP that rotates every day).

Wireless APs are similarly handled by hostapd on NixOS, driving (mostly) Mikrotik MiniPCIe Wifi cards. I don't really need the latest and greatest wifi gen, rather I just need them to work and be as maintenance-free as possible.

>Why use someone else's non FOSS, locked down linux, when you could

All my life I have had to make do with junk I could get at Walmart or Best Buy. Got tired of it. Cheap plastic shit that would inevitably shit the bed just a month or two after the warranty expired. I'm not making the IT helpdesk wages I was making 30 years ago... fuck that. While I couldn't spend ten grand on home networking, I could finally spend a little something on hardware that's not total shit.

Got the CCR2004-16G-2S+. No stupid ONTs, either, just the SFP+ modules. Plenty of backup 1gig ports if I get a third WAN (thinking about getting Starlink on standby). Actual proper fucking APs that do seamless handoff (hell, one of them probably covers the footprint of my house, if I'm honest). And no more shitty GUI configuration pages. I just shell in and band out commands on the command line (at least three times til I get the syntax right, but who gives a fuck).

Wish they made something with 3 or 4 SFP+ ports that I didn't need a rack for.

Ubiquiti unifi has struggled to integrate routing as reliably and as well as the wireless and switching piece. Mikrotik router and unifi everything else has kind of been my go-to for at least 10 or 12y now.

What's the state of FOSS licensing compliance? Have they repented?

How is the ipv6 situation these days? I left Ubiquiti 2 years ago because I needed to be able to configure the /56 I got from my isp. The unifi controller was pathetic in what it could do.

SLAAC-generated addresses will stay the same so long as the prefix and your MAC address stay the same, so there should be no need to do static leases.

Also... service discovery. Needing static addresses is a kludge.

Android (phones, tv boxes) doesn't respect DHCPv6 IA_NA, but it should respect DHCPv6 IA_PD. Unless you have some other system that doesn't respect DHCP? Linuxes, Windowses, Playstation 5's support DHCPv6 IA_NA without problems.

But also, even if a device doens't support DHCPv6 IA_NA, you can always also have a DNS server in your network, and you can bind SLAAC-generated Android addresses to simple subdomains. This seems better than DHCP anyway.

Any recommendations for hardware?

I use a mikrotik at home, and I always get a review from Claude after making config changes.

I actually used to be a network engineer (many decades and career reinventions ago), and I appreciate that Mikrotik exposes all of the layers and connections between them.

But damn if Claude doesn’t always find something I got wrong in the config.

One of their newer APs has thread radio. That is the best idea anyone has had since the mid 90s.

Apologies, fix should be live now

and reader-mode doesn't show the text

What exactly did you need and how did https://mikrotik.com/product/crs305_1g_4s_in not do it? It says switch but it runs routerOS and can route at some speed - not 10G tho.

You can easily install openwrt on most of MikroTik routers. Rb5009 is also supported now if you need more powerful router.

https://openwrt.org/toh/mikrotik/rb5009ug_s_in

Sometimes having generic Linux capabilities on network equipment makes it hard to understand the configuration. On RouterOS you can just /export the configuration and read a single file. On Linux/SONiC there are multiple ways to do the same thing - you can do one part of configuration using ifupdown, then make some changes in systemd-networkd, a bunch of shell-script DHCP client hooks, rc.local, cron @reboot. Imagine being handed over a router that someone has fixed by doing some runtime reconfiguration (like `ip ro replace default via 192.168.0.1 advmss 1410`) that would vanish with almost no trace (except maybe .bash_histotry) when you reboot it - that won't be possible (without doing very special scheduler/script trickery) on RouterOS.

But if you still want it, MikroTik doesn't try too hard to prevent you from running modified software. You can port OpenWrt, and most modern MikroTik devices use modern enough Linux to use a device tree blob. Try pulling out a dtb from your firmware and ask an LLM to do the initial porting - just don't forget to backup your RouterOS license key first, they are device specific.

The opnSense Deciso boxes are very nice and open - if a bit on the expensive side.

https://shop.opnsense.com/product-categorie/hardware-applian...

> cannot wait for the contract to expire

There is no contract with MikroTik. You buy the hardware, that's it. The software and updates are free.

Another option is to just buy some used enterprise mini PC (google project tinyminimicro) with PCIE slot, and use that. Probably lower power consumption than a full rack mounted server, definitely takes much less space (unless you already have the rack).

Power consumption?