Hello everyone, I'm new to the MikroTik world. I've always used Vyatta, and later VyOS, in fairly large server farms with high-end hardware (dual quad-core processors, 64GB RAM, etc.), and then EdgeRouters (which are Vyatta-based) in small businesses.
Considering that EdgeRouters are, I wouldn't say completely abandoned but close to it, receiving only bug-fix updates after years, I wanted to try something different for my home office like a MikroTik. Which one would you recommend? I don't have huge requirements in terms of ports (6 Gigabit Ethernet ports should be enough), but the hardware needs to be high-performing. It will obviously need to act as a router, but also as a firewall and a VPN terminator (at least 2 simultaneous connections, usually OpenVPN). Since it's a home network, the bottleneck will be the external fiber connection, which is capped at 1 Gbps at peak speed (meaning never, where I live). If I really wanted to upgrade to a faster fiber line in the future, it would be 2.5 Gbps.
Any suggestions? I was considering the CCR2004 series or the RB5009, but I'm not sure which one to choose. Keep in mind that I've never had any performance issues with the EdgeRouter ER-6P or EdgeRouter ER-X.
I note though, when using the actual OpenVPN client, I have never had a config built by the MikroTik not work (but then my configs are pretty "middle of the road" - cert based with multiple pushed routes.)
As indicated, for SOHO setup, RB5009 is something where it would be really hard to go wrong.
Personally I only use Wireguard at my home-RB5009. MUCH faster then OpenVPN.
For one setup (also using RB5009 as central hub) I have some IPSEC tunnels to Azure environment (because Azure doesn't use Wireguard natively as VPN ).
But when I have the liberty to choose, always Wireguard.
For home (or advanced home, homelab, soho) applications I'd choose the rb5009. There's very little reason not to: you only get a slightly increased throughput and a slightly nicer port configuration for quite a bit more money and the additional hassle of active cooling.
I didn't mean to suggest that OpenVPN doesn't work, just that not all features are available. As long as you stick to the ones that are, there's no problem. There are even some nice additional features not available in the official client/server.
First when i was building my soho setup i started small with random routers, eventually i decided i wanted to actually learn a thing or two and straight up went to rb5009Ug and a crs310.
As i wanted the "unified" experience of having the joy of controlling and learning about enterprise wifi setup and management i chose to go with cAP ax's 3 of them to be exact and one wAP ax.
Seeing how i needed PoE now, i just bought a rb5009Upr (its the same as rb5009Ug it just has PoE-out on all ports).
So basically my setup now is rb5009Upr -> 3x cAP ax -> crs310.
Personally wouldn't recommend a crs310 if you're gonna have the switch in the same room as you or if you sleep in that room where the gear is, since its got a very loud fan and the whole setup runs mildly hot to have all in a non-ventilated room.
For this setup, I’d go with the RB5009. It should comfortably handle 1 Gbps, firewalling, and a couple of VPN connections, while also leaving some room for a future 2.5 Gbps upgrade. The CCR2004 would probably be overkill for a typical SOHO network.
GPON SFPs are available, but getting them to work fully correctly is a bit of a journey. Tutorials are available, ISP cooperation, both when setting them up initially, and then in case of any malfunction, varies widely.
I'm of the (not necessarily correct) opinion that keeping the ISP equipment is the most satisfactory solution, unless you have some sort of problem with it. The usual reports put Fritzboxen as generally stable/workable.
Anyway, even if you decide to go with an SFP, that should mostly be treated as a separate project.
i personally wouldnt bother with gpon sfps, because they 1. Are hard and confusing to setup, 2. they run extremly hot, 3. they're expensive 4. most of the time isps dont support them.
currently i have two Fritzbox and they are working perfectly from years, never had an issue. so, i keep them and then i connect the miktotik to the Fritz, as wan
).