Both the GUI and their CLI are among the most unintuitive systems I've ever seen. I definitely spent more than one evening trying to configure my Mikrotik from scratch as a typical home router + switch + AP. I'm no networking guru, I only did some Cisco stuff a few years ago at uni, but I didn't understand 80 % of the terms used in their OS.

Agreed, MikroTik is extremely complex due to how feature-rich it is and because they run the same OS across all their devices, regardless of router/switch/AP/generation. Definitely not for the faint of heart that simply want to do some basic networking.

On the other hand, I'm not sure "unintuitive" is the correct word here. Having had the (dis)pleasure of setting up complex topologies on other manufactures like Cisco I found MikroTik to be considerably more intuitive (or perhaps "less unintuitive" would be more appropriate), possibly because Cisco has been built on for many decades and new features were constantly added on top of existing systems for compatibility purposes instead of redoing the CLI from scratch to make a more consistent user experience.

I've been using a MikroTik router at home for 6+ years; I would say that RouterOS is absolutely NOT "easy for a noob". It's on the prosumer side of things, but you need to be willing to sink your teeth into some fairly gritty network configuration workflows.

Anyone posting on HN will likely be able to figure out the basics, but it is definitely much less polished than other prosumer products such as Ubiquiti and the documentation can be a little rough around the edges.

Nope, it's really not for noobs. Basics things you can get via click on other SoHo routers like sane default firewall configuration, NAT loopback or simple VPN setup do not exist here. Setting up a Mikrotik is more akin to setting up a DSL connection on 1992 Linux - it's all "technically" available in the UI, but the UI is just a clickable version of all the CLI complexity and you need to know network terminology to get to capability of a default SoHo router configuration.

Having said that - if you know network setup very well, then Mikrotiks are very powerful and allow for network setups that are much more flexible than consumer equipment.

But once you know that you need a NAT loopback, you can quickly follow instructions on internet to create that rule.

Well, I've been fighting this for two years now and it still doesn't work, sooooo :)

(Also configuring IPv6 correctly is also a special hell that's far away from clicking "enable IPv6" on my previous ASUS)

Their firewall is iptables wrapped in a really nice GUI.

The criticism on their firewall might as well be a criticism on iptables (which IMO is completely valid, even after years I still have doubts about what a certain rules structure is going to do).

iptables itself is extremely unintuitive (although extremely powerful and flexible), but their GUI makes it more manageable.

I would suggest looking at their wiki and screenshots or youtube of their UI.

I've managed cisco amd juniper routers. And I can't make heads nor tails of it.

As soon as you wonder off the default track, you're expected to understand deep level networking terminology abstracted in a UI tailored for experts.

To setup port forwarding you have to understand how to configure the firewall, yes. This is both a drawback for simple use cases but a boon for more advanced ones. It cuts both ways. Personally I think it’s rather unfair to call the UI unintelligible. If you don't like it just ssh to it and configure it that way. Everything you can do is packaged up in a nice command structure.

Their firewall is essentially iptables. If you can work iptables, you can work the routeros firewall.

I've got a few Mikrotik devices (CRS328, CSS326). Maybe I just haven't gotten it, but I find their RouterOS WebUI extremely confusing. Like go into three separate top-level tabs to assign a VLAN to a port. The CLI is okay, once you get stuff working and just need to duplicate/modify lines.

Mikrotik's SwOS is alright and has most of the options you'd expect from a switch, but is missing the ability to have a human readable text config. I've got a Netgear switch as well, and I'd label its obtuseness on par with RouterOS. At the end of the day it seems every network vendor has their own bespoke proprietary UI that you have to suffer through.

In general I'm much more at home with Linux's iproute2/bridge-utils/nft. What I really want is some low power switches that can run OpenFlow or the like so I can centralize all the config back to my Linux router. On a home network, most devices shouldn't be talking directly among themselves anyway!

Another thing I really want is for network switches to have an RGB LED on each port that can indicate what VLAN it's configured for.

Yes, mikrotiks separate bridges, vlans, interfaces.

If you want to set ether 3, 4 and 5 to untagged vlan called "Alf" with ID 11, ether 6 to untablled vlan "Bob" (id 12), and ether 7 and 8 to a trunk of both Alf and Bob, you can do

1) Create a bridge for Alf, and a bridge for Bob

2) Assign IPs for them (assuming your mikrotik is the router), and maybe dhcp pools, server etc

3) add ether3, 4 and 5 as bridge ports for Alf, and ether6 for Bob

4) Create a vlan interface on ether7 for Alf with vlanid=11, add to bridge Alf

5) Create a vlan interface on ether8 for Alf with vlanid=11, add to bridge Alf

6) Create a vlan interface on ether7 for Bob with vlanid=21, add to bridge Bob

7) Create a vlan interface on ether8 for Bob with vlanid=21, add to bridge Bob

But the killer is there are two different recommended ways to do it depending on the hardware.

I haven't looked at my config in a while. It appears I've got a single bridge, and ports get added to it with their VLAN tags (for ingress, I believe) -

    /interface bridge port
    add bridge=_bridge interface=sfp-sfpplus1
    add bridge=_bridge frame-types=admit-only-untagged-and-priority-tagged ingress-filtering=yes interface=sfp2 pvid=10

But then I also have to define the VLAN ID for the bridge (for egress, I believe) -

    /interface bridge vlan
    add bridge=_bridge tagged=sfp-sfpplus1,_bridge, untagged=sfp2 vlan-ids=10

The device is a CRS328-4C-20S-4S+RM. It seems like I am using the other recommended way. Which would make sense because I'm not really using the "router" part of the software, but rather configuring the built in switch chip to do its thing.

Looking at the text config now it seems quite sensible, and isn't far from SwOS, Linux CLI, or switch chip datasheets. But I remember getting to that point in the WebUI being somewhat confusing, perhaps due to the alternative in-CPU way you described.

Whats the recommended way to config VLANs if mixing recent Mikrotik router with existing Unifi switches & AP's.

you just need to remember that in case you make bridges:

- you need to enable hardware offloading for it

- different models have different limits on number of hardware offloaded bridges

- if it's not hardware offloaded, you run all traffic through cpu and kill throughput

I tend to work with CCRs, so no hardware offloading - everything runs through the CPU (and normal throughput isn't an issue)

I find that Winbox is much more usable than the WebUI - it runs well under wine (and even on m1, you can run it under wine64 under rosetta).

worked for me. one suggestion though, get a serial cable, so in case you creative some too creative vlan config that will lock you out, you could fix it without having to reset entire box

Alternatively, make a backup before screwing with the VLAN. Then resetting the box is not as much of a set-back.

Also alternatively, turn on Safe Mode so if you lose access the router will revert to the configuration state when Safe Mode was turned on.

this is too. i guess ultimate solution is mix of backup and serial<>bt or serial<>wifi dongle. this is in case you gonna mess configuration frequently

Most of their devices come out of the box in a sensible configuration for a home router, and port forwarding/vlans are very straightforward to set up. If you're really worried, you can run the cloud-hosted router software in a VM to play around with it and find out if it will meet your needs.

It depends on your expectations of "easy".

When compared to consumer router devices, then no.

When compared to configuring enterprise networking kit using the CLI ... well ... perhaps. Mikrotik does have some short cuts / UI features. But if you want to do anything vaguely complex, you're going to need to put some serious time into getting your head around the way the system processes packets.

If getting to grips with how packets flow through different subsystems in your router doesn't really appeal (check out https://wiki.mikrotik.com/wiki/Manual:Packet_Flow) then there are better, simpler options which are still powerful.

Yeah, got hAP ac^2 and it's literally plug and play. Port forwarding etc. are all really easy.

yes. but more importantly, they are extremely popular - big ecosystem of freelancers.

you can go on fiverr and upwork and get someone to remotely configure/manage it for you.

Curious, would you trust someone to do that? For me when it comes to network, my paranoia level is sky high. I would definitely not allow some random person to configure my network...

It's no different than devops.

I'm not quite sure what you mean here. Everyone from banks to small shops use IT configuration services.

Most people will supply you a resume, contact details and sign a NDA. That's quite good enough.

As someone with moderate networking experience in a Cisco environment, and having set up Ubiquiti products and a pfsense router, MikroTik tops the cake for worst learning curve. I wasn't even trying to use it as a router, I just wanted a basic L2/L3 switch with some VLANs. It's set up now and I'm happy with it, but prepare for lots of trial, error, and head scratching.

it's basically a (somewhat) pretty gui around iptables and /etc/network/interfaces

everything more or less maps directly onto raw Linux functionality