Hacker News Reader

Comment by gene91 | Hacker News Reader

That sound like a terrible workplace.

For your own home, if not Ubiquiti, what do you use nowadays?

I've been considering MikroTik recently (specifically the RB5009 series). Main downside I've read about so far is that the UI/UX is a bit rough.

I don't get all the Mikrotik UI hate. It's not winning any beauty contests, but it's straightforward and it works well.

I've been using their devices for years, and I haven't had any problems setting them up.

There are some really terrible UI choices in SwOS, like not labeling rows of checkboxes so users need to hover over each one with their mouse to see a tooltip.

Send them a bug report, they'll likely fix it. I'm not joking, they're not using Webfig often, so sometimes they can overlook these kinds of minor issues.

I have a mikrotik https://mikrotik.com/product/hap_ac3 that I bought as a sort of test and it's been working fine for my needs. the webUI isn't the best, but wiki docs were pretty straightforward and I've been decently happy.

You think the UI is rough, try the cli.

There's a learning curve indeed, but it's also essentially just a thin wrapper around nftables (read iptables) so you learn about Linux networking by using them

I've been using unix and linux since the 90's and linux full-time on every system of mine, and Tik's still seemed entirely counterintuitive to me. I'd rather just deal with iptables and linux directly without the wonky cli.

I actually found the Mikrotik CLI easy to learn because it and the GUI are basically 1:1.

For example:

/ip/firewall/filter add

is in the UI under the sidebar IP -> Firewall, then the Filter tab, then click add. The parameters are named the same in both too.

I prefer the cli for Mikrotik, but that's true for most firewall, routers, etc.

YMMV.

Anyone using Mikrotik these days? Been Mikro-curious for awhile and always see them thrown around as a Unifi alternative. Yet to hear of any firsthand implementations though.

[0] https://mikrotik.com/

As a network engineer, I've considered them for my house, the price is right, but:

1) Their main push seems to use a thick client for admin which is a big no to me, otherwise the web ui in theory looks ok-ish. 2) Looking at their cli guide, it was cryptic as hell to me, and I deal with everything from cisco, arista, aruba, juniper, fortinet, pan, whatever from a cli or gui.

This was mostly confirmed a few weeks back, another old network engineer friend of mine hit me up asking if I've ever dealt with Mikrotik, and said no, but I knew where he was going. He'd screwed with it for a day or so supposedly just trying to make some L3 vlans, and finally a day or so later told me he'd made it work, but has never dealt with anything so terrible to configure from either gui or cli after having tried both, and he's another 20yr+ network engineer like me I trust not to be stupid.

That was all I needed to hear for future consideration.

Mikrotik has had WinBox for as long as they've been around and there's a lot of inertia around using it, but WebFig and the CLI are the only things I use (though I do have The Dude running through Crossover because it's useful).

Where you run into problems with 'tik gear is the differences that L3HW acceleration introduced into the mix. They didn't do what every other switch vendor does and limit features to what the switch chip supports and hide everything that the CPU can't handle away, so you have multiple ways of approaching most issues which threw me for a look as somebody who had been running JunOS gear in his lab for a while.

Once you get a feel for it then it's pretty straightforward to work with everything, though somebody used to an older generation of NOS like classic IOS (and associated clones) would have an easier time than me.

For reference, here's the config for my CRS317 acting as my "core" switch: https://gist.github.com/snuxoll/d63a155aa2155f53736a99d1cb27...

For sure, VLAN config is one of the most extremely "How and why did anyone end up designing it this way?" thought-inducing areas of Mikrotik config.

But I will say that the boxes of theirs that I bought about ten years ago are still going strong, never had a device fail on me, still receiving OS updates, still able to export and re-import my config to any of a wide variety of newer devices when the time comes.

Clearly they're not the right choice for everybody, but there are certainly up sides, if you're willing to grapple with the config.

Their "thick client" (aka Winbox) is effectively replicated in the web UI at this point.

Yeah, the CLI is a bit weird, but it's built on the same API calls that the web UI makes. So they're oddly consistent.

What does “L3 VLAN” even mean?

I have half a dozen Mikrotik hAP AC and wAP AC devices with Openwrt used in various places for work and for home.

Rock-solid hardware and muuuch better UX that RouterOS.

Don't remember when I setup those, but probably well before Covid. Really fire-and-forget devices.

Not the person you replied to, but I like Aruba Instant On.

https://www.arubainstanton.com/

Hmm, that looks like it must be centrally managed from the internet? Not saying it's not an appropriate replacement for Ubiquiti, but that seems like an opportunity for the same issues to show up… something that isn't remotely managed might be better instead.

I think the "InstantOn" functionality requires internet for setting up, but it seems like there is a way to manage it locally without the use of the "InstantOn" functionality:

https://www.arubainstanton.com/techdocs/en/content/get-start...

Some more discussion here from years ago:

https://community.arubainstanton.com/communities/community-h...

Although, I imagine this type of stuff may not be made to work well without internet.

Thanks! So it sounds like it may work, but it's very unclear it'll keep working. (Also I happened to be more personally interested in the APs rather than switches, and it's unclear if that also has a local management mode.)

I notice that the linked docs article doesn't get listed if you go up the breadcrumb and try to go back down…

Looks good but lacks layer 3 and fiber aggregation switches which we use in our SMB.

Not sure if they sell it outside of EU, but Keenetic is absolutely awesome. Been using their routers for a while, have a wifi mesh configured in my home built on their devices.

https://keenetic.com/en

Tplink for aps and mini PCs for routers

TP links are cheap and well made for its price, if you don't care that the CCP has a backdoor to every device

> the CCP has a backdoor to every device

This is huge! Please link me to the evidence to back this up.

China deploys plausibly deniable backdoors into internationally shipped network devices. Bugs that are remotely exploitable if you know they exist, but not obvious enough that they provide justification for the devices to be banned from import. These consumer devices are not exploited for intelligence gathering, but rather deployed as proxies that fall into one of two common buckets: acting as SOCKS proxies to relay attacks, and allowing a remote operator to scan for nearby wireless networks and bridge into them.

The NDAA blacklist was a happy compromise by the US government of banning the most egregious vendors that might find their way into sensitive facilities (Huawei, Hikvision, etc) while letting consumer focused brands that do the same (TPLink, Jetstream, Wavlink, etc) slip by so it didn't appear at face value to be a blockade of all Chinese made networking gear.

Taiwan on the other hand is less concerned about how China perceives their relations and bans all these vendors. They also ban Zoom.

First, [citation needed] w.r.r tplink and other consumer grade routers 'getting off easy'

Second, you seem knowledgeable about concerns w.r.t some supply chain attacks, at least from foreign actors, so do you have an alternative suggestion that isn't impacted by such concerns?

Ubiquiti is a non starter imo given their recent posture

It'd be easier to just Google it.

Grievances start with "made in China" and end with firmware hacks from May of this year.

https://blog.checkpoint.com/security/check-point-research-re...

"We are unsure how the attackers managed to infect the router devices with their malicious implant. It is likely that they gained access to these devices by either scanning them for known vulnerabilities or targeting devices that used default or weak and easily guessable passwords for authentication"

This implies the opposite of "the CCP has a backdoor to every device". Vulnerable devices from all manufacturers get exploited like this all the time.

I use TP link access points with my own cloud controller (running in docker container on my LAN) and a separate wired router. I don’t think there’s any concern with access points “phoning home” in this configuration.

I've had pretty bad luck with TPLink APs temporarily dropping connections and being just generally unstable. Even when you can put OpenWRT on them the hardware is just kinda buggy.

I think OP means the Omada EAP's, which are dedicated access points and not the routers. I have 2 EAP225's that have been better than the Ubiquiti it replaced.

Ruckus 730/750/850 with unleashed firmware

Draytek routers are not perfect, the UI lacks polish, but I have never had one fail on me yet. Solid kit (even though you do need to keep up with the firmware updates to keep them secure)

Aruba. Some jank in the software, but the gear has been rock solid

The Instant-On gear is physically almost identical to the professional line, but with heavy software limitations.

Best built hardware I've used, and I'd still be using their PoE at home if they didn't patch out SSH/REST access a few years ago.

Reply on news.ycombinator.com