<story><title>Pulling MikroTik into the Limelight Demystifying and Jailbreaking RouterS</title><url>https://margin.re/2022/06/pulling-mikrotik-into-the-limelight/</url></story><parent_chain><item><author>sliken</author><text>Seems like MikroTik and Ubiquiti haven&amp;#x27;t been particularly good on documenting how their routers work, what each process does, and how to debug&amp;#x2F;verify what they are doing.  I&amp;#x27;ve been particularly worried about Ubiquiti, since they seem to be ignoring the MIPS based EdgeRouter line.  The various consumer NAS vendors have been a nightmare security wise, and it&amp;#x27;s far from clear that the prosumer routers from Ubiquiti and MikroTik are any better.&lt;p&gt;Should it really require reverse engineering to figure out how a Linux box passes packets?&lt;p&gt;I gave up on Ubiquiti and bought a tiny $120 router ($140 with a nice metal case) that&amp;#x27;s a NanoPi R6s.  Pretty impressive specifications.  8GB ram, 8 cores (4 fast Ax76 and 4 slow A55s) and no fans.  Has 2x2.5GBe and 1x1GBe for networking.  I&amp;#x27;ve installed a port of OpenWRT called FriendlyElec and Ubuntu 22.04.1 LTS.  I didn&amp;#x27;t bother cross compiling, it&amp;#x27;s plenty fast for native compiles.&lt;p&gt;I&amp;#x27;ve been impressed so far.  It compiles Rust about half as fast as my Quad core Xeon server from years ago, and is &lt;i&gt;SEVEN&lt;/i&gt; times faster than a RPi 4 8GB!  I have an Apple M1 mini around that manages the same compile in 13 minutes.  A nice bonus is neither network or storage is USB attached, unlike the RPi.&lt;p&gt;Burned it in overnight, running all 8 cores flat out, with no problems.  Haven&amp;#x27;t decided what to use, maybe shorewall or just raw nftables&amp;#x2F;iptables.&lt;p&gt;Similarly there&amp;#x27;s 4 and 6 port 2.5 Gbe boxes with various N5000 and N6000 celerons at around $200.  ServerTheHome has reviewed many of them, they seem to be evolving nicely, better cases, better heat sinks, better 2.5Gbe Intel chips, etc.  Run *WRT, pfsense, or whatever else floats your boat.  STH even demod running the firewall under proxmox on one of these cheap 4-6 port 2.5GBe widgets.  Would be nice to keep your complete config in git or the config management widget of your choice (often Puppet or Ansible).&lt;p&gt;Guess I&amp;#x27;m just getting less trusting in my old age.</text></item></parent_chain><comment><author>luma</author><text>You&amp;#x27;ve thrown out a lot of performance numbers here but most of us aren&amp;#x27;t compliling rust on our routers.  Have you stood up iperf to see how fast it routes?  The task is harder than you think if you want any features to go with that and there&amp;#x27;s a good reason most vendors (Mikrotik and Ubiquiti included) offload most of the task to silicon.</text></comment>
<story><title>Pulling MikroTik into the Limelight Demystifying and Jailbreaking RouterS</title><url>https://margin.re/2022/06/pulling-mikrotik-into-the-limelight/</url></story><parent_chain><item><author>sliken</author><text>Seems like MikroTik and Ubiquiti haven&amp;#x27;t been particularly good on documenting how their routers work, what each process does, and how to debug&amp;#x2F;verify what they are doing.  I&amp;#x27;ve been particularly worried about Ubiquiti, since they seem to be ignoring the MIPS based EdgeRouter line.  The various consumer NAS vendors have been a nightmare security wise, and it&amp;#x27;s far from clear that the prosumer routers from Ubiquiti and MikroTik are any better.&lt;p&gt;Should it really require reverse engineering to figure out how a Linux box passes packets?&lt;p&gt;I gave up on Ubiquiti and bought a tiny $120 router ($140 with a nice metal case) that&amp;#x27;s a NanoPi R6s.  Pretty impressive specifications.  8GB ram, 8 cores (4 fast Ax76 and 4 slow A55s) and no fans.  Has 2x2.5GBe and 1x1GBe for networking.  I&amp;#x27;ve installed a port of OpenWRT called FriendlyElec and Ubuntu 22.04.1 LTS.  I didn&amp;#x27;t bother cross compiling, it&amp;#x27;s plenty fast for native compiles.&lt;p&gt;I&amp;#x27;ve been impressed so far.  It compiles Rust about half as fast as my Quad core Xeon server from years ago, and is &lt;i&gt;SEVEN&lt;/i&gt; times faster than a RPi 4 8GB!  I have an Apple M1 mini around that manages the same compile in 13 minutes.  A nice bonus is neither network or storage is USB attached, unlike the RPi.&lt;p&gt;Burned it in overnight, running all 8 cores flat out, with no problems.  Haven&amp;#x27;t decided what to use, maybe shorewall or just raw nftables&amp;#x2F;iptables.&lt;p&gt;Similarly there&amp;#x27;s 4 and 6 port 2.5 Gbe boxes with various N5000 and N6000 celerons at around $200.  ServerTheHome has reviewed many of them, they seem to be evolving nicely, better cases, better heat sinks, better 2.5Gbe Intel chips, etc.  Run *WRT, pfsense, or whatever else floats your boat.  STH even demod running the firewall under proxmox on one of these cheap 4-6 port 2.5GBe widgets.  Would be nice to keep your complete config in git or the config management widget of your choice (often Puppet or Ansible).&lt;p&gt;Guess I&amp;#x27;m just getting less trusting in my old age.</text></item></parent_chain><comment><author>glogla</author><text>I think building it yourself works well for routers and NASes, but there&amp;#x27;s a gap for WiFi. Lot of the bells and whistles that make modern wifi perform well (beamforming, MIMO, ...) is locked behind proprietary software and your homemade access point will never work all that well.&lt;p&gt;Interestingly, this is also something MikroTik isn&amp;#x27;t very good at - their long-range wifi is nice, but their consumer wifi used to be stuck at 2x2 and basically worse than cheap Asus &amp;quot;wifi router&amp;quot; which is somewhat embarrassing.&lt;p&gt;For switches, if you want &lt;i&gt;fast&lt;/i&gt;, for small installation it is hard to beat the Mikrotik 4xSFP+ 10G switch for $150.</text></comment>