[Please read carefully. I don’t have enough hardware to really test bandwidth, so at some point I stopped investigating. I am very satisfied with Mikrotik hardware].
Dear all,
First I would like to thank Mikrotik and the community for these nice products.
I purchased a couple of Mikrotik products for my home lab (I am not a professional) :
1 x CCR2004-1G-12S+2XS
1 x CRS326-24G-2S
1 x CRS305-1G-4S+IN
Here are my questions :
How can I disconnect from webfig?
Is Mikrotik bootloader secure and signed?
Are Mikrotik packages signed when downloading and upgrading?
Is Mikrotik software open-source and reviewed by the community (Github like)?
bootloader no idea, what that is, I get stuff straight from their website, so assuming its Latvian super protected.
packages signed… no ideas I get stuff straight from their website I certainly dont have to sign anything to get them.
Open source, no friggen way. RouterOS is proprietary, only Normis and Putin have that access.
If such a fraidy cat, suggest you go pfsense
Okay being a tad sarcastic, but only because I have zero interest in answering that type of question AFTER a purchase.
If this had been, I am thinking to get MT but would like some information first, that would have deserved a straight answer.
Also how do you know they are excellent products if not used yet??
I prefer tators anyway.
Disconnect from WebFig: there’s an icon (kind of a blue left arrow on brownish background) in the upper right corner of page which causes you to log out.
Is bootloader secure and signed: Bootloader is included in side RouterOS install images. If one deems ROS install package to be safe, then one doesn’t have to care about security of bootloader.
Are mikrotik packages signed: I can only guess. File format (.npk) is more or less proprietary. When ROS reads them, they do perform some checking (if package is corrupt, installation mostly fails with appropriate error message). How easy is it to construct a custom package which includes malware? That’s everybody’s guess. Only support@mikrotik.com could answer this question with confidence.
Is mikrotik software opensource: No, ROS is closed source.
@anav: I answered the questions despite having gut feeling that the post is a smartly disguised troll.
Thank you for your answers.
All I read is guess, if you don’t know I will contact support and ask.
Don’t tell Putin has access to a Latvian router, Latvia is part of the EU. This is one reason because I am supporting Mikotik : this is a European company and I don’t want to invest into foreing products (I am French and France is part of the EU). Same Country.
I am also witching from OPNsense to Mikrotik because of hardware acceleration and I need to go 10gb and I don’t want to use a computer as router.
From my point of view, ROS is based on Linux as most routers, switches and firewalls are (except Cisco which has its own OS).
My home lab has several VLANs and I am wondering how to filter inter VLAN traffic on 10Gb lines, these are my needs.
I will get back to you when I reach this point.
Good to know, here is one excellent reference for setting up vlans on Router OS.
Although for 10G networks and switches there is another way to configure vlans.
How did you perform this “test” ? What is the traffic-pattern ? (1 client/IP or some traffic generator sourcing from 100’s of different source IP’s ?, packet sizes etc)
So by 500Mb/s you mean “500 megabits per second” right ? ( which is indeed not much for a box like CCR2004)
During NAT, can you provide info on the CPU-utilisation ?
Network pattern :
RouterOS 7.x latest, with eth1 network admin
spf+ 1 : WAN connected to 2.5 Gb ethernet connector of fiber line (speed is 2.5Gb)
spf+ 2 : bridge 10.90.21.254 with one port providing DHCP 10.90.21.x (tested with 1Gb and 5Gb same results).
Fiber box providing DNS
NAT[/list]
Gb = Gigabit
I can browse the Internet connecting to spf+ 2.
I did not perform a precise iperf3 test, only a speedtest.
Speed with NAT is around 500Gb/s.
Direct connection to fiber box gives maximum speed.
NAT is done from the CPU, all packet must be modified and recalculated.
Both CRS can do at max near 600Mbit/s of NAT traffic, because mainly are Switches, not Routers.
Instead the CCR can achieve a NAT speed of near 4,5Gbit/s
If you need 10Gbit/s NAT speed, you must buy at least one CCR1036.
I don’ t see any solution to reach 10Mbit/s routing as per spec.
For sure, I am quite surprised by the lack of hardware offloading of firewall rules and switching.
The router has spf+ interfaces, there must be something that I don’t understand.
Solved, I feel ashamed : the router speed is limited by my ISP. I am supposed to have 5G/s now and 10G/s later and I only have 600Mb/s. Sorry for the confusion.
