alt Hacker News... and kind of slow. I've recently looked at Mikrotik hAP be lite (A42G-HbeP ) [1] and noticed only 2315.1 Mbps for 25 bridge filter rules or 1430.3 Mbps for 25 ip filter rules.
I also heard a horror story about RouterOS coming with an insecure configuration by default, lots of open ports and services running which were recently affected by a vulnerability. Speaking of RouterOS do I have to also buy a license along with the hardware? How about updates?
Replies
- 1430.3 Mbps for 25 ip filter rules in a 70€ Wi-Fi 7 router doesn't sound that bad to me. Also, as sibling comment says, you can enable fast tracking for certain connections.
- Mikrotik doesn't have open ports to the outside since years and years ago, IIRC. They had a CVE on their administration port (not in ssh) in 2023, but you shouldn't open that port to the outside anyway.
- All Mikrotik wireless routers include at least a level 4 license. You only need a higher license level if you need more than 200 VPN tunnels or more than 200 users in the hotspot functionality. A bigger wireless router like the hAP ax³ will already have a level 6 license, the biggest one. You might need a license if you set up a Mikrotik instance in a X86 server, or virtualized, for example to manage a bigger site or as a bigger hotspot controller. Licenses aren't expensive and are paid only once, no subscriptions (by device, I think you get a device ID or something like that).
- All the Mikrotik routers that I own still get updates. The RB750GL, that was released like 15 years ago or more, still updated.
I have hap ax3. They cleaned up their defaults. No extra license costs.
One issue I had was that I was affected (and many others) by wifi bug in firmware which made connections drop randomly. Took them half a year to resolve it. Wouldn't recommend Mikrotik as access point. Otherwise it's good.
That's not really a fair comparison, since any software packet filter on that class of hardware will be slow.
If you need layer 2 or stateless layer 3 filtering at hardware speeds, Mikrotik makes 10G switches that can do it for under $200. Mikrotik APs also support port and WiFi isolation which is enough security for most home networks (e.g. isolating an IOT VLAN).
Mikrotik's "fastpath" stateful connection tracking feature is also fast in my experience; not fully wire speed but good enough for untrusted devices that you want to be fast, like a Fire stick or game console or similar.