Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Mikrotik router as OpenVPN Client

github.com

Post reply on HN
Print view View original

31–40 of 50 posts

Re: Mikrotik router as OpenVPN Client

#31

Post by zippergz »

atombender wrote: post #30
zippergz wrote: post #26

Earlier quoted context omitted.

I guess I'm too used to Cisco and Juniper pricing, but "pricey" is the last thing that comes to mind when I think of Microtik... When you say "good commercial routers" that are cheaper, are you talking about consumer hardware? I'm curious what you prefer. I don't have any Microtik hardware at all, so I don't have any vested interest here - I am just curious what people are liking these days. The vast majority of the…

I'm using a $50 Mikrotik hAP AC Lite (RB952Ui-5ac2nD-US) as a home router. It's not the most high-powered router — it only has a single 5GHz radio, no antenna, and the Ethernet port is 10/100 only — but it's stunningly solid. Previously I had, over the span of 18 months, an ASUS "Dark Knight" (whose 5GHz network slowly faded and then _disappeared_, apparently a known issue), an ASUS RT-AC66U (frequently just choked,…

Yes, this reliability is why I don't use consumer network hardware when I can avoid it. I got sick of getting calls from my wife when I was traveling and she was trying to work from home but the wireless had stopped working again.

My home network is all Ubiquiti, and is also rock solid. The 10/100 ethernet port is what actually pushed me to move from my Cisco ASA to a Ubiquiti router - the router had become the bottleneck in my internet connection.

Re: Mikrotik router as OpenVPN Client

#32

Post by benjohnson »

tomaac wrote: post #24
sathackr wrote: post #23

Earlier quoted context omitted.

Mikrotik routers are not designed to be a consumer router. The average consumer would pull his/her hair out trying to configure one. Providing network attached storage is generally not a feature requested of anything but the full-consumer line home routers of the type that you purchase from Best Buy etc...

That is not quite true. They have soho product group: http://routerboard.com/products/group/20

The newer firmware also has a single-page setup that let you set the WAN/LAN IP, DHCP server and other basic stuff with ease.

Basic port forwarding is still interesting - it's simple once you understand MikroTik, but there's a learning curve.

Re: Mikrotik router as OpenVPN Client

#33

Post by blacksmith_tb »

atombender wrote: post #30
zippergz wrote: post #26

Earlier quoted context omitted.

I guess I'm too used to Cisco and Juniper pricing, but "pricey" is the last thing that comes to mind when I think of Microtik... When you say "good commercial routers" that are cheaper, are you talking about consumer hardware? I'm curious what you prefer. I don't have any Microtik hardware at all, so I don't have any vested interest here - I am just curious what people are liking these days. The vast majority of the…

I'm using a $50 Mikrotik hAP AC Lite (RB952Ui-5ac2nD-US) as a home router. It's not the most high-powered router — it only has a single 5GHz radio, no antenna, and the Ethernet port is 10/100 only — but it's stunningly solid. Previously I had, over the span of 18 months, an ASUS "Dark Knight" (whose 5GHz network slowly faded and then _disappeared_, apparently a known issue), an ASUS RT-AC66U (frequently just choked,…

Agreed - I'm using a Mikrotik hAP AC at home now, after a series of disappointing high-end consumer devices (ASUS RT-AC3200 most recently). It isn't perfect (AC speeds are temperamental for me), but it does offer a huge amount of configurability - including a Cisco-esque CLI interface via SSH, which is nice.

Re: Mikrotik router as OpenVPN Client

#34

Post by walrus01 »

sathackr wrote: post #22
ausjke wrote: post #15

Mikrotik was pre-Ubnt and had excellent hardware lineups. These days Ubnt is miles ahead in the router/wireless-board field, which puzzled me. While Mikrotick sells its RouterOS, it's not that hard to install Openwrt on it. Ubnt was quite Openwrt friendly at the start, not so any more. These days I'm just assembling my own x86 routers. PCengines and Soekris do not have the best performance/price ratio nowadays, and t…

I have personally deployed about 100 Mikrotik routers and can say they work well for what they do. They're not designed to be a home router and the learning curve if you want to use one like that would be similar to someone without Cisco IOS knowledge trying to configure a Cisco IOS device as a home router. Not many routers can do 5-10gb/s+ throughput for the price. Their most recent model has 8x10Gb ports, costs USD…

"Their most recent model has 8x10Gb ports, costs USD $2,500 and will route the full 80gb/s"

No, it won't route 80Gbps, because any single flow on a CCR uses a single core on their multi core Tilera CPUs. The CCRs struggle to really do 10Gbps of real world IP transit traffic.

If you're pushing 5Gbps+ of your customers' IP traffic in a daily sine wave pattern to/from upstream and adjacent BGP peers (paid IP transit and peering at a local IX), and have $2,500 to spend, you will be MUCH better off buying a proper routing platform that has things like hotswap fan trays, hotswap 1+1 or N+1 power supplies, redundant hotswap routing engines, etc. You can do this with a used/refurb Cisco or Juniper for the same price as the higher end Mikrotiks. I can build a Cisco 7604 or 7606 with dual RSP720 for less than $2000.

The CCRs have a single motherboard in them that is about the same quality as a $85 PC motherboard. If you're running an ISP that is moving multi-Gbps of customer traffic and have potentially thousands of singlehomed customers downstream of you, do you want to rely on a 'core' router that has absolutely zero hardware redundancy?

Mikrotiks have their place at edge and small aggregation but when you start talking about things that are $2,000+, please, buy a real router.

Re: Mikrotik router as OpenVPN Client

#35

Post by machbio »

vetinari wrote: post #20
machbio wrote: post #9

Earlier quoted context omitted.

For a beginner - I would suggest DD-wrt as its more beginner friendly as compared to Open-Wrt; OPENVPN documentation is pretty good - https://www.dd-wrt.com/wiki/index.php/OpenVPN As for Router support - the best one would be the Archer C7 from TPLink ( http://www.dd-wrt.com/wiki/index.php/Supported_Devices#TP-Li... )

Just make sure, what batch of C7s are you buying from. TPLink started to lock down the firmware, due to the new regulation about locking down wifi devices. So if you get an unlocked C7, you are fine, if locked, you get to keep their firmware on the device. Currently, the only safe choices for OpenWRT are Linksys WRT1900ACS and Turris Omnia. Both are a bit pricier.

They are selling the C7 v2's as of now from amazon - dd-wrt has the firmware for it..

Re: Mikrotik router as OpenVPN Client

#36

Post by sathackr »

walrus01 wrote: post #34
sathackr wrote: post #22

Earlier quoted context omitted.

I have personally deployed about 100 Mikrotik routers and can say they work well for what they do. They're not designed to be a home router and the learning curve if you want to use one like that would be similar to someone without Cisco IOS knowledge trying to configure a Cisco IOS device as a home router. Not many routers can do 5-10gb/s+ throughput for the price. Their most recent model has 8x10Gb ports, costs USD…

"Their most recent model has 8x10Gb ports, costs USD $2,500 and will route the full 80gb/s" No, it won't route 80Gbps, because any single flow on a CCR uses a single core on their multi core Tilera CPUs. The CCRs struggle to really do 10Gbps of real world IP transit traffic. If you're pushing 5Gbps+ of your customers' IP traffic in a daily sine wave pattern to/from upstream and adjacent BGP peers (paid IP transit and…

What ISP needs a single flow to exceed 1gb? I would venture to say most non-storage networks don't have single flow requirements in the Gb/s.

I can buy 3 CCR routers and run OSPF/BGP/etc... on them to provide redundancy. The likelyhood of all 3 failing at once is slim and I'm still an order of magnitude cheaper than an equivalent Cisco/Juniper setup. Yes, dynamic routing takes a few seconds to converge, so an unplanned failure will result in a short disruption in connectivity, but planned maintenance can be done seamlessly, including power supply replacement(since only one model has hot-swappable power supplies). I do not deploy any single-power models and have not had a single router fail in the 2 years I have been deploying them. I have had a $6500 Cisco ASA fail, twice.

I am a fan of all 3. Cisco and Juniper make great equipment. So does Mikrotik. Each one is a tool that must be used properly and the right one needs to be selected for the job and requirements.

Re: Mikrotik router as OpenVPN Client

#37

Post by sathackr »

benjohnson wrote: post #32
tomaac wrote: post #24

Earlier quoted context omitted.

That is not quite true. They have soho product group: http://routerboard.com/products/group/20

The newer firmware also has a single-page setup that let you set the WAN/LAN IP, DHCP server and other basic stuff with ease. Basic port forwarding is still interesting - it's simple once you understand MikroTik, but there's a learning curve.

I haven't spent much time in the "Quickset" page...I learned it before they had that function and it never seems to do what I want it to.

Probably is handy for some basic configurations though.

Re: Mikrotik router as OpenVPN Client

#38

Post by proctor »

machbio wrote: post #9
pingec wrote: post #2

Quite handy. If anyone has OpenWrt hardware like me, OpenVpn clients and servers work good enough and the setup is well documented: https://wiki.openwrt.org/doc/howto/vpn.openvpn

For a beginner - I would suggest DD-wrt as its more beginner friendly as compared to Open-Wrt; OPENVPN documentation is pretty good - https://www.dd-wrt.com/wiki/index.php/OpenVPN As for Router support - the best one would be the Archer C7 from TPLink ( http://www.dd-wrt.com/wiki/index.php/Supported_Devices#TP-Li... )

I help maintain a page[0] that keeps a list of the best performing routers that support OpenWRT and DD-WRT. It allows to sort by Value, Performance or Price.

[0] http://rooftopbazaar.com/routerfirmware/

Re: Mikrotik router as OpenVPN Client

#39

Post by jlgaddis »

I'm a network engineer for an ISP (5 years now; ~8 years in the same role at a .edu before this) and I am very much in the Cisco/Juniper camp.

When I started at the ISP, I had never even heard of Mikrotik. Having been using high-end Cisco/Juniper gear for years, I was quite skeptical that those cheap little Mikrotiks were worth a damn.

I've actually been quite surprised. While all of my "critical" infrastructure runs on Cisco, I've got several Mikrotik routers running in production, almost exclusively as access concentrators (for PPPoE sessions). I really use very little of their features, but they handle PPPoE and OSPF just fine.

We also have an MSP side, which is mostly our ISP customers whom we also handle managing their local networks for. Our guys have deployed a handful of Mikrotiks at the edge of these customer networks as well but, again, this is just basic office router functionality (DHCP, NAT, firewalling, etc.).

For the price point, they're actually pretty decent devices. I don't own any myself (excluding a couple in my "networking test lab" here at home, but those belong to $work) and wouldn't personally use one. This is mostly on principle -- I disagree with their beliefs when it comes to the GPL and compliance.

Also, I wouldn't recommend using them for anything you deem "critical" or even "really important". Just read through the Changelogs for their firmware releases -- some of the bugs/fixes do not instill confidence in their software engineering.

FWIW, my router at home (on a fiber connection) is (was?) designed and sold as a RouterOS device [0], although I removed the Mikrotik CF card and replaced it with another one that I installed an OpenBSD image onto [1]. It's mounted read-only (except when I want to modify things, of course) to preserve the lifetime but lately, I've been considering installing an SSD into it. It's actually a pretty powerful (albeit low-end) PC disguised as a router. It can easily provided all the basic network services one might need at home (DHCP, DNS, NAT, firewalling, TFTP, etc.). It wasn't cheap, though -- $600, IIRC, but it's a few years old now. I wrote a bit more about it [2] a few months ago.

[0]: http://www.balticnetworks.com/docs/routermaxx%206%20port.pdf (PDF)

[1]: http://www.nmedia.net/flashrd/

[2]: https://news.ycombinator.com/item?id=10796573

Re: Mikrotik router as OpenVPN Client

#40

Post by NetStrikeForce »

girzel wrote: post #6

I bought a Mikrotik a month or two ago, expressly so I could install OpenWRT on it, and use it to get around the Chinese firewall with Shadowsocks. The OpenWRT install never worked, so now I just have a (pretty nice) router, doing what routers are supposed to do. It's long since that OpenVPN didn't work in China, but this should provide a good learning experience, and who knows, maybe it will lead me to something tha…

Apparently SoftEther works really well for that and the developers have a free VPN service called vpngate. Worth a try? :-)
Post reply on HN