Hacker News Reader

Comment by sandGorgon | Hacker News Reader

Same as this , except with one change. For the router, use the (cheaper and more powerful) Mikrotik Routerboards. We don't use a Poe switch - we just use cheap Poe adapters and connect directly to the routerboard.

For those who have never touched a Ubiquiti, configuring it could be a little iffy . I normally advise setting up DHCP 43 advertisement on the router before trying to setup the access points.

But seriously, this stuff scales.

View on HN

Haven't the Mikrotiks had lots of serious vulnerabilities recently?

Those that weren't updated for a year.

There was a 0-day winbox bug this year that was being actively exploited in the wild. They definitely have their share of security issues, and more are likely to come since they write their own versions of httpd, sshd, smbd, etc instead of using well tested open source versions.

As long as you aren't exposing the device itself to the internet, you should be safe from most exploits if your LAN is semi-trusted.

I'm currently using Mikrotik happily for AP and router needs, but considering switching to a Ubnt setup for ease of management that does not depend on Windows/Wine and without having to write my own configuration management tooling. As central management is somewhat lacking.

What are your considerations for not choosing Ubnt for routing?

I'm not the OP but I moved from UBNT to Mikrotik for two reasons:

- When it comes to SFP, UBNT's wired gear is unreliable. See https://community.ubnt.com/t5/EdgeRouter/EdgeRouter-X-SFP-le... for an example.

- My only experience with UBNT's support was exceptionally poor. When I ran into the above issue, I was using a third party SFP module and support stonewalled me, saying I had to buy one of their modules. They wouldn't loan me one or guarantee a refund if the module didn't resolve the issue. Unsurprisingly, buying their module didn't help at all (though they finally let me RMA the equipment).

Mikrotik's gear has been solid for me. Zero problems whatsoever.

the mikrotik cli is wonderful. you can script it all out. the UI is a little complicated, but oh well.

quick question - why do you need windows/wine for mikrotik ? we use the cli commands through the web console.

in fact we dont have windows in the office. granted you may be doing something more advanced than us, but curious to know.

I mostly manage my device setups with CLI/webfig. Sometimes winbox in wine as it is a little more reliable in mac-telnet then 'non-official' clients. But I long for some centralised configuration management. Even on small networks. Its just nice to come back to a complete overview instead of spread out configuration and out-of-date documentation for stuff you did months back for a friend or family. I don't know if Ubnt will fill this need, but what I've been hearing about it should.

I'm not GP, but what drove me towards MT and away from Ubnt was Ubiquiti's history of violating the GPL [1].

[1] https://news.ycombinator.com/item?id=9331512

Is the Mikrotik any better in this regard? Has anyone taken them up on the offer of a GPL source code CD?

It seems they comply https://github.com/robimarko/routeros-GPL

Windows? The MT RouterOS web interface works very well in both Chromium and Firefox on Linux for me.

The web interface works fine for me on macOs, as well as the CLI. But it's far from centralised configuration management. Sometimes you want to tinker, but sometimes you just want to deploy something (at friends/family) that works and when you return to it in a few months, to continue where you left off without going through every device's configuration or the documentation that is obvious not there as those side projects often don't allow you to 'allocate' time for that.

which router is iffy for you, Edge or Unifi? The Auto VPN tunnel being right in all my other network and wireless settings is nice. its fairly obvious from my posts im awarding a lot of value to consolidated management.

If you buy the APs individually, they come with power injectors, if you buy a 5 pack, they dont and its easier to home run back to a single switch. Less things to get unplugged.

Mikrotik routers were just hacked pretty badly. I'm not so sure they are competent enough with the security of their routers now, even if their routers are otherwise good value.

The CVE-2018-14847 was responsibly disclosed and patched. However, the problem happened with routers that did not get updated. This is no different than any other unpatched software.

https://blog.mikrotik.com/security/winbox-vulnerability.html

Reply on news.ycombinator.com