Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Mikrotik router as OpenVPN Client

github.com

Post reply on HN
Print view View original

21–30 of 50 posts

Re: Mikrotik router as OpenVPN Client

#21

Post by kyrra »

fluential wrote: post #14

Be aware that very few routers actually have enough power to do openvpn encryption with higher bandwith (20Mbit+) links and 256CBC encryption. You may get better results by downgrading your cipher (not every vpn provider supports that) To achieve good performance you are looking for hardware with Intel QuickAssist, I would recommend putting pfsense on something like http://store.netgate.com/ADI/RCC-VE-2440.aspx

I actually just built one with a C2758 (8 core atom) supermicro board. I put PFsense on it and it's been running great. I have gigabit internet at home, so I opted for the more powerful box. A lot of people on the pfsense forums seem to use one form of these boards.

2 core: http://www.supermicro.com/products/motherboard/Atom/X10/A1SR...

4 core: http://www.supermicro.com/products/motherboard/Atom/X10/A1SR...

8 core: http://www.supermicro.com/products/motherboard/Atom/X10/A1SR...

Re: Mikrotik router as OpenVPN Client

#22

Post by sathackr »

ausjke wrote: post #15

Mikrotik was pre-Ubnt and had excellent hardware lineups. These days Ubnt is miles ahead in the router/wireless-board field, which puzzled me. While Mikrotick sells its RouterOS, it's not that hard to install Openwrt on it. Ubnt was quite Openwrt friendly at the start, not so any more. These days I'm just assembling my own x86 routers. PCengines and Soekris do not have the best performance/price ratio nowadays, and t…

I have personally deployed about 100 Mikrotik routers and can say they work well for what they do.

They're not designed to be a home router and the learning curve if you want to use one like that would be similar to someone without Cisco IOS knowledge trying to configure a Cisco IOS device as a home router.

Not many routers can do 5-10gb/s+ throughput for the price. Their most recent model has 8x10Gb ports, costs USD $2,500 and will route the full 80gb/s [1]

They have come a long way since the RB433 and running on Soekris/PCEngines boards. UBNT is just getting started in the real router field(Not their Radio-with-a-router, those are quite mature now but very limited in features) and I do not care for their current EdgeRouter UI. It's a mess. For example: You need local access just to add the interface you're accessing it from to a bridge. (Because you can't add an interface WITH an IP on it to a bridge, and you can't remove the IP from the interface without losing access. You can apply multiple commands at once, but the command validation doesn't honor the order that you enter them, thus tosses an error because it tries to add the interface to the bridge before removing the IP)

Sure you can put something x86 together and run one of the many many firewall/routing OSes, or even roll your own with (pick your flavor)Linux, Zebra and IPTables, but I don't have time to make something work and prefer something that just works and isn't priced at the Cisco/Juniper level.

I wouldn't recommend either for mission-critical ENTERPRISE grade routing, without significant planning into redundancy, but, if you are doing things at that level, then you probably have the funds to purchase enterprise grade gear.

[1] http://www.stubarea51.net/2015/10/09/mikrotik-ccr1072-1g-8s-...

Re: Mikrotik router as OpenVPN Client

#23

Post by sathackr »

nathanvanfleet wrote: post #16

At one point I was kind of excited about Mikrotik routers. They seemed pretty beefy, a bit pricey, but cool as a device support OpenWRT and having an OS that they said was "even better" than OpenWRT. However everything I looked at was somewhat disappointing. One router I was looking at had an unpowered USB port, that was a low speed (USB 1), which just seemed to be a weird caveat when consumer routers of the time wer…

Mikrotik routers are not designed to be a consumer router. The average consumer would pull his/her hair out trying to configure one. Providing network attached storage is generally not a feature requested of anything but the full-consumer line home routers of the type that you purchase from Best Buy etc...

Re: Mikrotik router as OpenVPN Client

#24

Post by tomaac »

sathackr wrote: post #23
nathanvanfleet wrote: post #16

At one point I was kind of excited about Mikrotik routers. They seemed pretty beefy, a bit pricey, but cool as a device support OpenWRT and having an OS that they said was "even better" than OpenWRT. However everything I looked at was somewhat disappointing. One router I was looking at had an unpowered USB port, that was a low speed (USB 1), which just seemed to be a weird caveat when consumer routers of the time wer…

Mikrotik routers are not designed to be a consumer router. The average consumer would pull his/her hair out trying to configure one. Providing network attached storage is generally not a feature requested of anything but the full-consumer line home routers of the type that you purchase from Best Buy etc...

That is not quite true. They have soho product group: http://routerboard.com/products/group/20

Re: Mikrotik router as OpenVPN Client

#25

Post by sathackr »

tomaac wrote: post #24
sathackr wrote: post #23

Earlier quoted context omitted.

Mikrotik routers are not designed to be a consumer router. The average consumer would pull his/her hair out trying to configure one. Providing network attached storage is generally not a feature requested of anything but the full-consumer line home routers of the type that you purchase from Best Buy etc...

That is not quite true. They have soho product group: http://routerboard.com/products/group/20

I was not aware they were marketing in that direction...imo they shouldn't be, for the reasons listed by others. The UI just isn't quite intuitive enough for the average-joe that's expecting something like a Linksys/Beldin interface.

Re: Mikrotik router as OpenVPN Client

#26

Post by zippergz »

nathanvanfleet wrote: post #16

At one point I was kind of excited about Mikrotik routers. They seemed pretty beefy, a bit pricey, but cool as a device support OpenWRT and having an OS that they said was "even better" than OpenWRT. However everything I looked at was somewhat disappointing. One router I was looking at had an unpowered USB port, that was a low speed (USB 1), which just seemed to be a weird caveat when consumer routers of the time wer…

I guess I'm too used to Cisco and Juniper pricing, but "pricey" is the last thing that comes to mind when I think of Microtik... When you say "good commercial routers" that are cheaper, are you talking about consumer hardware? I'm curious what you prefer.

I don't have any Microtik hardware at all, so I don't have any vested interest here - I am just curious what people are liking these days. The vast majority of the consumer networking gear I've tried has been terrible, even with alternate firmware (e.g. OpenWRT doesn't keep crappy Linksys routers from overheating).

Re: Mikrotik router as OpenVPN Client

#27

Post by snowwindwaves »

r1ch wrote: post #12
Mic92 wrote: post #4

Mikrotik's support for OpenVPN/IPsec is a joke. They should just allow to specify plain openvpn configuration instead. I would not recommend these routers with original firmware.

No UDP support after all these years is really quite shameful. Tunneling TCP over TCP is insanely bad, the slightest packet loss and your connections are toast.

still not? I was moaning about this in 2006. I can't imagine why Mikrotik can't be bothered to implement UDP for OpenVPN when they have added so many other features.

This is my #1 gripe with mikrotik, you can't figure out if the feature you want to use is half-baked or not without testing it. And then once it works you had better not upgrade versions or it may very well break.

Finding a version which has all the features you need working used to be a nightmare.

Re: Mikrotik router as OpenVPN Client

#28

Post by tjohns »

snowwindwaves wrote: post #27
r1ch wrote: post #12

Earlier quoted context omitted.

No UDP support after all these years is really quite shameful. Tunneling TCP over TCP is insanely bad, the slightest packet loss and your connections are toast.

still not? I was moaning about this in 2006. I can't imagine why Mikrotik can't be bothered to implement UDP for OpenVPN when they have added so many other features. This is my #1 gripe with mikrotik, you can't figure out if the feature you want to use is half-baked or not without testing it. And then once it works you had better not upgrade versions or it may very well break. Finding a version which has all the feat…

My understanding is that MikroTik isn't a fan of OpenVPN (for whatever reason), and doesn't want to spend any more development time on the feature. Which is a shame, because it really is a poor choice without UDP support.

On the plus side, you can use the VM ("Metarouter") feature to host a real OpenVPN client inside an OpenWRT instance. But you don't get the nice admin console if you do that.

Re: Mikrotik router as OpenVPN Client

#29

Post by tjohns »

vxxzy wrote: post #5

You can run OpenWRT as a virtual router (MetaRouter) on top of Mikrotik. That would allow you to get around the TCP limit. Does anyone have any experience with running OpenWRT as a MetaRouter?

I've done it. It works fine. You just have to keep in mind that most of the Routerboard products have limited RAM, like any other embedded device.

The only catch is that anything done inside of OpenWRT has to be configured by hand from a terminal (obviously), instead of through Mikrotik's admin console.

Re: Mikrotik router as OpenVPN Client

#30

Post by atombender »

zippergz wrote: post #26
nathanvanfleet wrote: post #16

At one point I was kind of excited about Mikrotik routers. They seemed pretty beefy, a bit pricey, but cool as a device support OpenWRT and having an OS that they said was "even better" than OpenWRT. However everything I looked at was somewhat disappointing. One router I was looking at had an unpowered USB port, that was a low speed (USB 1), which just seemed to be a weird caveat when consumer routers of the time wer…

I guess I'm too used to Cisco and Juniper pricing, but "pricey" is the last thing that comes to mind when I think of Microtik... When you say "good commercial routers" that are cheaper, are you talking about consumer hardware? I'm curious what you prefer. I don't have any Microtik hardware at all, so I don't have any vested interest here - I am just curious what people are liking these days. The vast majority of the…

I'm using a $50 Mikrotik hAP AC Lite (RB952Ui-5ac2nD-US) as a home router. It's not the most high-powered router — it only has a single 5GHz radio, no antenna, and the Ethernet port is 10/100 only — but it's stunningly solid.

Previously I had, over the span of 18 months, an ASUS "Dark Knight" (whose 5GHz network slowly faded and then _disappeared_, apparently a known issue), an ASUS RT-AC66U (frequently just choked, requiring a reboot), an a Netgear Nighthawk AC1900 (same, and also issues with unstable wifi).

By contrast, the Mikrotik has been rock stable for the time I've had it (6 months). I also love the WebFig UI. It's a lot more technical than consumer routers, but it's responsive, consistent and doesn't hide any technical details from me. I don't need 90% of the RouterOS features, but I know that if I needed something obscure, I could set it up. You basically get an industrial-quality Linux-based router/switch OS for almost nothing.

(I do like the fine-grained metrics, though. You can get bandwith and connection data not just per interface, but also per NAT rule, for example.)

Post reply on HN