Not only routing filters, but also frequently when adding new bgp peers the prefixes are received, visible in the routing table (/ip route print...) but traffic does not follow the routing table.

Disable the peer, re-enable the peer, and then all of a sudden traffic is routing correctly.

BGP, is FULL of bugs. I'm scared to have my core and peering routers on mikrotik, and will be looking at replacing them.

That would be a completely different bug, and I cannot confirm it. What I observe is only that the prefixes do not appear in the table. When they do, they always work (for me).
It also would not be a BGP bug.

Maybe it is a fasttrack or route cache bug. That could be. I don't use those features.

That would be a completely different bug, and I cannot confirm it.
Maybe it is a fasttrack or route cache bug. That could be. I don't use those features.

+1, cannot confirm. Haven't had any phonecalls about reachability problems.

We don't have fasttrack, but we do have routecache.

Maybe it is a fasttrack or route cache bug. That could be. I don't use those features.

Neither is used.

Will check again when it happens in the future. Perhaps I am mistaken about the routing table, and it's more a matter of the prefixes are received, but not populated in the routing table. Will check when this happens again and confirm.

Confirmed now - the routes ARE in the routing table correctly, yet, a traceroute follows the wrong path...

Border 02 router, which peers with the ASN via public peering: So, we have received the route through our peering arrangements, we have 4 paths available. Yet, we only advertise 1 path to our Border 1 router (we should advertise at least 2 paths, as the preferences & communities are different)...

On Border 01, which peers directly with Border 02 (iBGP), and has a transit link (full table): The ACTIVE route, is supposedly going via Border 02. A traceroute however:
Traffic is not being send Border 01, Border 02, Peering. It is instead going Border 01, TRANSIT. Which is NOT what the routing table on Border 01 indicates.

Refresh/Resend the peering sessions, and the problem resolves itself after the BGP tables are loaded a second time. Happens with IPv4 as well as IPv6 traffic.

EDIT: From the ROUTER ITSELF (i.e. Border 01 router) the traceroute is correct (i.e. Border 01 -> Border 02 -> Peering). From devices BEHIND Border 01, the traceroute is incorrect (Border 01 -> Transit).

Route Cache is disabled, and RP Filter = no (on both routers)

I also personally do not understand some (for me) non-logical things like power options in CCR models. Why some CCRs can be powered by 230V/PoE combination, some by 2x230V and current flagship CCR1036 has only one 230V plug? Power input redundancy is not important for their flagship device?
Other similar things are from my point of view non-consistent model lines. I can imagine for example more devices derived from hEX with new powerful CPU and with 5, 8, maybe 10 and 16 ports in same case like RB2011 uses and so on. Similar situation is IMHO with SPF,SFP+ and ethernet ports combinations in various devices.
Personally it seems to me that they write various features and number of ports to small sheets of paper, throwing them all from top floor staircase and then designing models depending on features from sheets which managed to fall to ground floor.
Also it is now necessary to maintain firmware for lot of different CPU architectures, which also brings lot of possibilities for various kinds of errors in hardware and software.

Antoher thing is the holy grail RouterOS v7. The fact, that they are not able to give us clear statement about RouterOS v7 is also not much credible. Lot of people (including me - I wait for newer USB dongles support) is impatiently waiting for new features. Now I have to decide - should I wait for RouterOS v7 which would allow me to finish current project with Mikrotiks only or should I look for another solution? Currently I am evaluating other solutions just because I am not able to build any plan on uncertain situation with Mikrotiks.

Agreed on v7. Whomever is slowing down the roll out of v7 to focus on crap for v6 needs to take a walk.

- Routing filters often need to be disabled/re-enabled to make them work.

Can we have more details sent to support?
Do you modify routing filters frequently?

Wow.. How do Mikrotik support NOT know about this issue:

- Every ISP I talk to that uses Mikrotik for BGP complains about this issue.
- There are numerous threads on these forums about this issue.
- See Ticket#2013050266000072

What do I know about the problem:
- It seems to happen no matter how simple/complex the configuration is.
- It does not seem to be related to how often the filters are changed. (I have had it happen on new routers only advertising 2 prefixes and receiving 1)
- I have noticed it happens more often when a set of filters is pasted in via the CLI.
- I have mainly noticed it on egress filters, this may just be due to the fact that I modify these more often.

Just an interesting side note, I do BGP on MIkroTik every day and I can't say I've run into this very often, but I do a soft-refresh in and out every time I change the filter because MikroTik isn't the only one who has this issue. I've been burned by similar behavior on Cisco 6500, 7600, ASR and Nexus 7K when modifying ACLs/Route Maps for BGP peerings which is why I got into the habit years ago of soft refresh in/out every time I change the BGP filters.

Having said that, It should be able to handle a change without causing a bug.

We use BGP Route Filters for sending prefixes to specific communities (blackhole etc..) and never run into any issue yet.

That being said, we need better multi core support for PPP interfaces, queues, firewall filters, NAT.

Maybe the path Mikrotik should follow now is making FPGA based Hardware for NAT, Queuing and Firewall Filters.

Time to play in the big league

Maybe the path Mikrotik should follow now is making FPGA based Hardware for NAT, Queuing and Firewall Filters.

In my opinion, MikroTik shines in making routers based on very inexpensive "general" communications processors
running the generic Linux OS (which has lots of networking capabilities not found in other OSes but is not dedicated
to routing).

This resuls in very feature-rich but still inexpensive routers that can be used in (relatively) small networks.
When you require top performance that demands dedicated hardware support, there are other manufacturers
that offer this, and have offered it for much longer. Expect to pay a lot more, as a lot more development resources
go into that kind of solution.

Maybe the path Mikrotik should follow now is making FPGA based Hardware for NAT, Queuing and Firewall Filters.

In my opinion, MikroTik shines in making routers based on very inexpensive "general" communications processors
running the generic Linux OS (which has lots of networking capabilities not found in other OSes but is not dedicated
to routing).

This resuls in very feature-rich but still inexpensive routers that can be used in (relatively) small networks.
When you require top performance that demands dedicated hardware support, there are other manufacturers
that offer this, and have offered it for much longer. Expect to pay a lot more, as a lot more development resources
go into that kind of solution.

I agree with you. They should focus on bug fix and feature release in software.

Just an interesting side note, I do BGP on MIkroTik every day and I can't say I've run into this very often, but I do a soft-refresh in and out every time I change the filter because MikroTik isn't the only one who has this issue. I've been burned by similar behavior on Cisco 6500, 7600, ASR and Nexus 7K when modifying ACLs/Route Maps for BGP peerings which is why I got into the habit years ago of soft refresh in/out every time I change the BGP filters.

Having said that, It should be able to handle a change without causing a bug.

Interesting you say that, I've always thought that it was just a regular formality to do a soft-refresh after any BGP config change.

Just an interesting side note, I do BGP on MIkroTik every day and I can't say I've run into this very often, but I do a soft-refresh in and out every time I change the filter because MikroTik isn't the only one who has this issue. I've been burned by similar behavior on Cisco 6500, 7600, ASR and Nexus 7K when modifying ACLs/Route Maps for BGP peerings which is why I got into the habit years ago of soft refresh in/out every time I change the BGP filters.

Having said that, It should be able to handle a change without causing a bug.

Interesting you say that, I've always thought that it was just a regular formality to do a soft-refresh after any BGP config change.

If you do a lot of BGP in Cisco, you'll come across issues with filtering prefixes more often than you would think which is why a soft refresh has become a default practice for many network engineers.

Here is a recent example of a bgp filtering bug in Cisco, but there are plenty across all the platforms and versions of IOS they have developed throughout the years. All network vendors have bugs and issues - MikroTik doesn't have the market cornered on that.

https://quickview.cloudapps.cisco.com/q ... CSCts39535

While relevant, lets not get distracted too much from the larger theme with this routing filter issue

While relevant, lets not get distracted too much from the larger theme with this routing filter issue

I agree.
The route filter issue (inserted/moved filters are not always applied correctly) isn't fixed by refreshing, so it is not relevant to mention that.
The only way to fix the filters is to disable/enable them while they are at their final position and content.

While relevant, lets not get distracted too much from the larger theme with this routing filter issue

I agree.
The route filter issue...

I think Alex Hart meant we shouldn't get distracted from the larger theme: this thread is originally a discussion about whether we think RouterOS is moving forward fast enough, or if it might be left behind as competitors innovate quicker.

So far, it sounds like the jury is still out: lots of people who believe in and support MikroTik, and want them to succeed. But also quite a few people who have been caught out by "sharp edges" in some of the implementation details.

I have to say, I'm very pleased to look through the changelog for 6.38 release candidates and seeing some of the BGP issues starting to get sorted (e.g. the 0:0 community problem).

whether we think RouterOS is moving forward fast enough, or if it might be left behind as competitors innovate quicker.

So far, it sounds like the jury is still out: lots of people who believe in and support MikroTik, and want them to succeed. But also quite a few people who have been caught out by "sharp edges" in some of the implementation details.

To me, MikroTik RouterOS still has a lot more features than the OS of other routers in the same price category, and I think it is most
important that the existing features operate bug-free and that technologies like IPv6 are more completely supported.

There will always be people shouting booohooo MikroTik does not support X so I am going away to competitor Y!! Goodbye!
I think it is not reasonable to expect any manufacturer to support features that a competitor has and do it within the timeframe those
people usually want it (a week or so). Also I think a router should be a router and not some server platform and/or smart webfilter.

hi,

i would like to add:

-no more than ONE connection from the same IP with L2TP/IPSec
-IKEV2 (its mention here that its in the new RC. That would be awesome)

EDIT: looks like 6.38rc24 is my new RouterOS 7. Just found this: http://forum.mikrotik.com/viewtopic.php ... 00#p566439. If this will come both problems are solved

I also have the bug where I have to disable/enable or move rules to make them work, or reboot the router.

I was all 'tik all the time for years. TONs of devices deployed. Not any more.

I feel like I've had to regress a bit as I'm building APU/PFSense boxes for some clients that don't want edgerouters, and I'm using edgerouters and usg

I do have some CCR and despite some of these issues, I can work around them and it's great for out small wISP. I also have a significant beta environment for ubnt's new gear and software and it's encroaching on the 'tiks strengths rapidly.

as far as tik at home, no way. I've abandon that long ago as I don't feel like 'tik is user friendly for the home, and the big gaps in features completely removes it as an option. I hate to say a netgear nighthawk is better....but it is.

I think Alex Hart meant we shouldn't get distracted from the larger theme: this thread is originally a discussion about whether we think RouterOS is moving forward fast enough, or if it might be left behind as competitors innovate quicker.

Who do you see as competitors to MikroTik that are are currently beating them in innovation at the same price point?

The obvious one.

Who do you see as competitors to MikroTik that are are currently beating them in innovation at the same price point?

Right now, I don't. I thought that I'd been clear in all my posts in this thread. I see that there are bugs, but I've had bugs on every platform I've ever used - just as you've said has been your experience with Cisco.

However, I've also said that I see a lot of strong competition: many WISPs I know have been deploying their "backbone" links on Ubiquiti (either moving from MikroTik or starting with Ubiquiti from day one). And I see the EdgeRouter platform as creeping in to the "high performance, low capital cost" router market that MikroTik has long held. Competition is healthy, and my worry had been that RouterOS v7 can't come soon enough. However, with some of the fixes we're starting to see in the 6.38 rc changelogs, many of the operational concerns of the routing platform of RouterOS are going to be addressed.

I have even been asked to replace brand new Mikrotik wireless AC units with >3 year old 2.4Ghz UBNT wireless hardware because they like the way it performs better. (Capsman is only ok. Getting kicked off your AP to join another AP is archaic if your not used to it. It feels like a step backwards. Yall should really fix that. Don't say UBNT owns that because many multi radio systems are on the shelf now and you still can tell the capsman deployment from the rest because it sucks more)

This is the first year I have literally started having to look around. This is also the first year I chose to deploy alternative gear in order to ease a deployment and avoid performance issues with wireless.

10 years ago your gear was in black metal cases and it worked non-stop rock solid under most conditions. We used to brag about that.

Now its thin plastic and highly branded and some of it is worse than COTS equipment I can buy at my local store.

I already miss the old Mikrotik. (Prime example 493ah in metal case) I have for years. Now rather than being my first choice your one of a number of considerations and your features are behind and lacking when compared to COTS equipment.

Even Google is looking good for wireless right now. Mikrotik not so much. Yall have that hit & miss capsman thing and your wireless AC is only ok. (Only ok?)

Don't see many RMAs? Its because its not worth the few bucks I spent initially (even after 10+ failures) its especially not worth it for what I charge to install this gear.

You have gotten "cheap" too. Not cost effective cheap, but rather your hardware is cheap feeling, cheap looking & underperforming in many aspects. Wrong direction guys! Your current partnerships are making you look & feel like your competition.

Please fix yourself Mikrotik. Your starting to look and feel like TPLINK. Thats an insult because TPLink is plastic junk that doesn't work that well. Its hard to keep using Mikrotik when even my Mikrotik customers are noticing these issues ongoing.

Guys. I was telling those things years ago. And I still think the same like you, but remember that ebit to capital ratio is what an owner wants to be maximised every year. Making metal boxes thinner, replacing them by plastic and utilising all in one socs with ridiculous flash, removing wide range voltage regulators and other things are helping to meet such goals. Moving towards BFU market by dammed quickset and sell products on the same shelf like asuses, tendas and totolinks is helping it too. I believe that mikrotik makes much more money on 941 for 20 bucks than on all ccrs together during a year. We all can be pissed off, but the money matters. Mikrotik reached some reputation and is getting well known so they are trying to monetize it. You have to admit that isp business is not growing so fast comparing to BFU market. So that's it. And doesn't matter if you are going to buy few nanostations instead of sxt. Who cares? Home users are buying much more... You do not believe mikrotik anymore? Who cares? There is a heap of money that they are going to sell their reputation for. Their business. Their decision. Their future. Not ours.

Guys. I was telling those things years ago. And I still think the same like you, but remember that ebit to capital ratio is what an owner wants to be maximised every year. Making metal boxes thinner, replacing them by plastic and utilising all in one socs with ridiculous flash, removing wide range voltage regulators and other things are helping to meet such goals. Moving towards BFU market by dammed quickset and sell products on the same shelf like asuses, tendas and totolinks is helping it too. I believe that mikrotik makes much more money on 941 for 20 bucks than on all ccrs together during a year. We all can be pissed off, but the money matters. Mikrotik reached some reputation and is getting well known so they are trying to monetize it. You have to admit that isp business is not growing so fast comparing to BFU market. So that's it. And doesn't matter if you are going to buy few nanostations instead of sxt. Who cares? Home users are buying much more... You do not believe mikrotik anymore? Who cares? There is a heap of money that they are going to sell their reputation for. Their business. Their decision. Their future. Not ours.

From a financial perspective, they are probably one of the hottest tech companies in the Baltic with over 121% growth up to 2014 and another 30% growth in 2015.

http://www.inc.com/profile/mikrotikls-sia

The obvious one.

in the RF space, I'm assuming you mean Ubiquity, and while true in the North American and European markets, we see heavy MikroTik RF deployments in developing countries in Africa and South America. So there has to some regional adjustment when identifying competition because price is king in some markets whereas features and performance are key in others. Not everyone has the same use case either - WISP is only one use case for RF gear and not everyone needs GPS synch and more advanced RF features.

in the routing market, there really isn't any competition- the EdgeRouter shows promise but has years to go in features and stability.

in the switching market, they have a very strong proposition on features/performance for a 1U switch now that loop prevention protocols are coming out.

in the switching market, they have a very strong proposition on features/performance for a 1U switch now that loop prevention protocols are coming out.

I'm looking forward to an announcement of 10GE switches by MikroTik. The CCR1072 was a strong hint that this could happen.

Of course, the user interface in RouterOS for configuring the switch is a bit too much like "bare metal setup of the merchant silicon" for most people... but we're using them just fine.

I have even been asked to replace brand new Mikrotik wireless AC units with >3 year old 2.4Ghz UBNT wireless hardware because they like the way it performs better. (Capsman is only ok. Getting kicked off your AP to join another AP is archaic if your not used to it. It feels like a step backwards. Yall should really fix that. Don't say UBNT owns that because many multi radio systems are on the shelf now and you still can tell the capsman deployment from the rest because it sucks more)

This is the first year I have literally started having to look around. This is also the first year I chose to deploy alternative gear in order to ease a deployment and avoid performance issues with wireless.

10 years ago your gear was in black metal cases and it worked non-stop rock solid under most conditions. We used to brag about that.

Now its thin plastic and highly branded and some of it is worse than COTS equipment I can buy at my local store.

I already miss the old Mikrotik. (Prime example 493ah in metal case) I have for years. Now rather than being my first choice your one of a number of considerations and your features are behind and lacking when compared to COTS equipment.

Even Google is looking good for wireless right now. Mikrotik not so much. Yall have that hit & miss capsman thing and your wireless AC is only ok. (Only ok?)

Don't see many RMAs? Its because its not worth the few bucks I spent initially (even after 10+ failures) its especially not worth it for what I charge to install this gear.

You have gotten "cheap" too. Not cost effective cheap, but rather your hardware is cheap feeling, cheap looking & underperforming in many aspects. Wrong direction guys! Your current partnerships are making you look & feel like your competition.

Please fix yourself Mikrotik. Your starting to look and feel like TPLINK. Thats an insult because TPLink is plastic junk that doesn't work that well. Its hard to keep using Mikrotik when even my Mikrotik customers are noticing these issues ongoing.

Though I rarely play on the enterprise wireless side, "broadband" wireless is my bread and butter. Over the years I've played with everything from Canopy to Aviat and back. Mikrotik to me was always a routing solution. Here recently I've noticed a lot of problems leading to frequent router replacements at sites. After the finial run of RB493's died The decision was made to migrate to the RB2011. Currently, most of the AP's are UBNT rockets. Usual problem is static discharges killing ports on the RB2011. Occasionally lightning takes out a router (unfortunately Ubiquiti is not great on providing grounding solutions for AP solutions. Average 2011 lasts about year and is retired when all of the ports are dead. 493's lasted 3+ years.

At one of my sites has a lot of stray RF from a piss-poor low power FM station install. Keeps knocking the Interface links down to 10M connections on the RB2011. As an experiment I recently purchased a few RB450G routers w/metal enclosures. Been trying to duplicate the problem with my service monitor by feeding RF right into the thing…can't. Same setup near my hAP AC lite (which is used for my home routing) and it starts freaking out. I'd definitely agree with your assessment of the legacy RouterBoard products being higher quality devices.

On a secondary note, I've never thought capsman would be great for an enterprise setup however, I think it could be a real tool for a PMP sectorized setup by offering a single control point.


Sent from my iPhone using Tapatalk

At one of my sites has a lot of stray RF from a piss-poor low power FM station install.

I agree that this sometimes can be a problem, but I am not sure it can be blamed on MikroTik.
We use MikroTik routers in broadcast towers (kilowatts of transmit power) and in amateur radio repeaters
(e.g. in the close field of a 80W transmitter on 29 MHz) and indeed it causes ethernet problems in the latter
case but we fix those with ferrite clamps on the network cables.
(the gray plastic thingies with black ferrite cores inside that you sometimes find packed with equipment and
that most people discard because they don't know what they are for and don't bother to read manuals)

In cases like this you may often find that replacing some equipment with another type also appears to
cure it, but that does not really mean the other equipment is that much better designed. Similar for your
static discharge problem: you should just install your equipment correctly to solve this (earthing and
equipotential bonding) rather than rely on the ability of the equipment to absorb it.

On a secondary note, I've never thought capsman would be great for an enterprise setup however, I think it could be a real tool for a PMP sectorized setup by offering a single control point.

Completely agree, including NV2 support for capsman. But MT pretty much already said no, not going to happen. Same with Virtual APs and NV2 (has been asked for, over, and over, and over, with VERY valid reasons).

Sometimes, I really just get the feeling that MT does not, or does not WANT to understand the WISP arena. Especially not when it comes to innovation and doing new things / doing things differently.

At one of my sites has a lot of stray RF from a piss-poor low power FM station install.

I agree that this sometimes can be a problem, but I am not sure it can be blamed on MikroTik.
We use MikroTik routers in broadcast towers (kilowatts of transmit power) and in amateur radio repeaters
(e.g. in the close field of a 80W transmitter on 29 MHz) and indeed it causes ethernet problems in the latter
case but we fix those with ferrite clamps on the network cables.
(the gray plastic thingies with black ferrite cores inside that you sometimes find packed with equipment and
that most people discard because they don't know what they are for and don't bother to read manuals)

In cases like this you may often find that replacing some equipment with another type also appears to
cure it, but that does not really mean the other equipment is that much better designed. Similar for your
static discharge problem: you should just install your equipment correctly to solve this (earthing and
equipotential bonding) rather than rely on the ability of the equipment to absorb it.

We actually tried it as well as using different stp cat5e runs (the corrugated stuff cambium likes to recommend hasn't helped much either). It also doesn't help this on top of a 40 year old 5 story building. Site grounding is next to non-existent. However, it hasn't caused any of the licensed links to go down so we can't really complain of much.

I agree that the static discharge issue is a grounding issue. Unfortunately, it's West Texas and it's just part of it when working with sites that pre-date R56 and no one wants to put forth the money to ground everything.

One site is a 30 year old broadcast tower (44 kW) so enhanced grounding is the best that can be done without completely overhauling the site. We do run surge suppressor son the cat5e with station grounding but seems like Ubiquiti forgot about providing grounding options for their rocket series radios as the ports on the RB2011 still die. Actually we didn't have a problem with that site until we put AP's on it. We removed that stations STL a few years ago when the FCC wanted everyone to recoordinate and migrated to Barix over a licensed 3.65 link. Actually did it with all of that broadcast company's STL's. Issues always seem to be with the APs.


Sent from my iPhone using Tapatalk

Ubiquiti wireless outperforms Mikrotik wireless. It wasn't always the case, and there was a time that mikrotik's nv2 was better than airmax. Those times are passed. I've thoroughly tested both AC implementations and Ubiquiti's comes out as much better, with more stable latencies and stable links, and simply faster.


Mikrotik is a router platform as far as I'm concerned. Even at sites where I start with a routerboard w/ wifi, I end up turning it off and deploying Unifi APs.

I have some CCR's that are pretty great. There are flaws, but not show-stoppers.

As a warning to mikrotik though, ubiquiti's router hardware is encroaching VERY quickly. There was a time when Mikrotik was hands-down the best value in an MPLS, OSPF router, but now it's got competition.

just revisiting this. wondering where mikrotik is at on the 'next gen' v7. edgeos is very very quickly encroaching on the wisp routing market. Mikrotik had a very strong place in even cambium and ubiquiti networks but I'm seeing pretty rapid switchover these days. Many wisps are flocking to edgerouters. Mikrotik, what's the deal? Where's your fight?

I guess they don't care much.

It seems they are focusing more on SOHO by adding features like TR-069, or crippling features like multiple partitions by using 16MB flash chips, instead of finally releasing v7 and fixing all those problems that can't be solved on v6.

it is time they should bring in V7. High time.

i agree mikrotik is on the decline. Wheres the RB3011 with mini PCIe or wifi?
Lots bugs or limitations here and there. Its good to focus on the SOHO and home market but dont leave your existing customers in the dust. In the past the majority of mikrotik customers knew that there was no substitute for what mikrotik offers. In the home and SOHO market, things change quite a lot, now it seems attractive as more and more features that used to be enterprise only or only what you could do with openwrt or by installing your own linux server are getting implemented on home routers. However mikrotik is actually ill equipped to enter the home and SOHO market.

Just a few features i've been barking on about that mikrotik has been lacking
- DNScrypt (really needed everywhere actually)
- LACP on the switch chip.
- host based rules rather than IP based (so using domains, hosts, etc rather than having to use IPs in rule configurations and even general configurations). Home and SOHO actually prefer to use names, hosts and domains, not numbers or hex.
- software based additions that allow for some dynamics such as changing the routes that DNS requests use for example or allowing use of multiple WANs for DNS requests (or even multiple DNS server instances like with DHCP server to allow a per network configuration on a single device).
- ability to install some software (asus, openwrt, netgear are all capable of this). Netgear recently made it possible to install plex media server on their routers. On asus its possible to install the software you want by going in through ssh. This is the one advantage that ubiquiti routers have over mikrotik and a QoS algorithm too.

Very simple example, lets say i wanted to use pool.ntp.org as my NTP server to my mikrotik router, if i enter it in it gets converted into an IP or in some cases not allowed to be stored as a domain. On consumer routers you could enter a domain in your configuration (except for DNS ofcourse) and it will still accept it, the only difference is that once the domain expires in cache it is checked again.

So i think that mikrotik is taking the wrong path, or that they're taking a path and doing it wrong, missing out the essentials of it. Sure in the past consumer routers tend to be hopeless in stability, reliability and bugginess but now they're catching up on quality and features.

Very simple example, lets say i wanted to use pool.ntp.org as my NTP server to my mikrotik router, if i enter it in it gets converted into an IP or in some cases not allowed to be stored as a domain. On consumer routers you could enter a domain in your configuration (except for DNS ofcourse) and it will still accept it, the only difference is that once the domain expires in cache it is checked again.

The below works fine for me:

server-dns-names (Comma separated domain name list default: ) To set NTP server using its domain name. Domain name will be resolved each time NTP request is sent. Router has to have /ip dns configured.

I think he just wanted to sum up some annoyances, was thinking about an example, then wrote about the pool.ntp.org
but forgot that in this particular case the problem does not exist becuase DNS names can be used there and are resolved
at usage time. There are some other places where that is true, e.g. for the destination of an L2TP tunnel.
But in many other places only fixed addresses can be used, and sometimes it is annoying.

It would be convenient when one could have some "hosts and networks table" where symbolic names can be assigned
to addresses and they can be used anywhere in the config. Not via DNS, because some of those configs simply are not
dynamic and cannot be made dynamic, but just for convenience when configuring.
There is the "address list" feature that can be used in the firewall, and I do use it for this purpose, but it is not
applicable everywhere. I can understand why that is: it is used as a lookup table for firewall matching only.
So it would be nice to have a feature that is more like a "/etc/hosts file" and the entries can be used everywhere, not
only in the firewall. It should also be possible to have subnets in there (not unlike /etc/networks but not as limited as that).
So a symbol can be set e.g. LANSUBNET = 192.168.88.0/24 and that can be used everywhere where you need that, e.g.
in the DHCP server, a possible IPSEC rule, maybe in the firewall, etc.

there is another thread of this in general which did actually get mikrotik's response.

I would like to add for both threads that there seem to be many elitist/enterprise admins who dont know heads or tails about routers. Routers arent just pure routers theres a lot around them. For example you will find some enterprise network admins who would scold you if you had a torrent client feature on your router but truthfully, there are many features on routers that arent related to routing, for example you have the critical bit of DNS and NTP servers on routerOS and even GPS, which in a datacenter may all not be used in enterprise. Secondly mikrotik has an array of features such as scripting, API and so on, allowing for remote admin of the routerboard and for performing some complicated tasks, im sure enterprise users make use of this, even romon and dude as well, all features that have nothing to do with routing but are necessary to fit the role that users need from a router. Sure mikrotik has FTP, SFTP, SSH, TFTP and even winbox file transfers, none of which relate to routing but you can use them to update the router, put the needed files (like for use with hotspot for example) and so on. Even i make use of the tftp server on mikrotik.

So while the enterprise community may sound rigid, its very likely because they dont consider that a router has all these things to fit the requirements needed other than just doing routing. TFTP is particularly useful especially when the device thats handling DHCP for the main network is also doing it, as it makes it easy when booting via tftp using the main network such as to get internet access for updates on the target machine. Routers are computers too, so we shouldnt clamp down on mikrotik not to expand their features to things like cups and xsane for instance and in the future we may get more and more routing related stuff too so being too rigid on features just means that mikrotik could lack the necessary features in the future. Even cisco has an array of management features too on their routers.

Different features appeal to different customers, so if mikrotik could make them all without bugs that would still not make everyone happy as the elitist would come out and say that mikrotik should be a router only disregarding the fact that there are many non router related features that are already on mikrotik helping them do their job and making things easier.

When what you really want is a Linux box, you are not at the correct place at MikroTik.
MikroTik have decided that Linux is used internally but externally they have their friendly interface which limits what you can do.
They keep some control over "security" (and probably also supportability) by not allowing access to the underlying Linux system, e.g. via a shell or by allowing installation of external software.
When you don't like that, go shopping somewhere where that is possible. I use bare Linux myself in some cases as well, but I like the MikroTik routers for many purposes.
Also, please don't think that what YOU consider important or essential, is valued by others as well. So for a company with many customers. telling them that "this feature is a must have for everything" is not going to automatically get it to the top of the list.

When what you really want is a Linux box, you are not at the correct place at MikroTik.
MikroTik have decided that Linux is used internally but externally they have their friendly interface which limits what you can do.
They keep some control over "security" (and probably also supportability) by not allowing access to the underlying Linux system, e.g. via a shell or by allowing installation of external software.
When you don't like that, go shopping somewhere where that is possible. I use bare Linux myself in some cases as well, but I like the MikroTik routers for many purposes.
Also, please don't think that what YOU consider important or essential, is valued by others as well. So for a company with many customers. telling them that "this feature is a must have for everything" is not going to automatically get it to the top of the list.

i know, but when i say important i mean you wouldnt be able to function without it. You dont need DNS for routing to work but you cant live without it either.

i know, but when i say important i mean you wouldnt be able to function without it. You dont need DNS for routing to work but you cant live without it either.

But my network functions well with the DNS provided by MikroTik and without the DNScrypt that you consider essential.
So apparently you have a different idea about "essential" than others.

i know, but when i say important i mean you wouldnt be able to function without it. You dont need DNS for routing to work but you cant live without it either.

You can't live without it on your network, but you certainly can live without it on your router. And this is an important distinction, meaning that the needed network service can be provided by a third party, with better performances than using your router. Having everything crammed in one device is a compromise which we choose, usually from a cost perspective.
E.g. in my network I have a Linux machine running a full fledged DNS, while the router only forwards requests and acts as a minimal backup for the internal network.

i know, but when i say important i mean you wouldnt be able to function without it. You dont need DNS for routing to work but you cant live without it either.

You can't live without it on your network, but you certainly can live without it on your router. And this is an important distinction, meaning that the needed network service can be provided by a third party, with better performances than using your router. Having everything crammed in one device is a compromise which we choose, usually from a cost perspective.
E.g. in my network I have a Linux machine running a full fledged DNS, while the router only forwards requests and acts as a minimal backup for the internal network.

i doubt consumers would have that option to run mikrotik alongside a PC running linux.

i doubt consumers would have that option to run mikrotik alongside a PC running linux.

That's true, but on the other hand, I doubt consumers need all those full services. They actually need minimal but sufficient service support for regular tasks. Advanced services are out of the "consumer" scope.

Let's take again DNS as an example: IMHO a consumer device does not support/need zones and zone transfers, dnscrypt and other advanced features. It is the ISPs responsibility to provide an DNS service for their customers so that their consumer devices should work fully and transparent, while keeping end user costs down. On the other end of the spectrum, if a user really needs those features, he transcends the consumer condition and he could also run a full size Linux server to fulfill his needs of additional advanced services (and this could be, in our example, as low as a puny $15 NanoPi running bind).

Of course, having a complete support in the router would be nice, but is not not mandatory

DNS is nice example where it's not that clear.

Imagine a simple home user who just needs to escape censorship that ISP is forced to do by some "enlightened" government (it looks like it's going to be increasingly popular need in the future). Fiddling with DNS is very popular method how to censor stuff, it's cheap and relatively effective against regular users. DNSCrypt can help with overcoming that. But keeping extra machine as DNS server is overkill and configuring it separately on each device connected to network is not practical either (too much work, or not even possible with many devices). How much happy would this user be, if router could handle it...

Or a small office that needs to connect to main office and needs to access internal servers. There's a local domain in use and they have to use its DNS servers to resolve internal hostnames. But that's just tiny fraction of their connectivity needs, so they don't want to fully depend on remote main office. A per-domain forwarding is the perfect answer, it would allow them to use main office's resolvers only for ourcompany.lan hostnames and they would be happy. But they have the same problem as home user had. Should they build a Linux server? For a tiny office that so far lived happily with one hAP lite and two notebooks? Again, the router is the right place for it.

There are also other things as well.
If you look at whats in the consumer market, you'll find many gaming routers that have various features too, some related to routing directly (like QoS profiles for example). Having a site that can provide profiles for use with mikrotik can be very helpful too. I've seen various mikrotik tutorials for various things but not something easy to implement. Using hq codel algorithm for QoS could help simplify setting up an effective QoS for the user even if it is more CPU intensive.
Consumers have various categories.

You have the basic home user, who has no clue about networking. Just uses what the ISP provides or buys a cheap consumer router.

You have the more advanced home user who has some clue about networking and more advanced needs, like vlans which many consumer routers dont provide for LAN and even non routing related features like DNS and other things. These guys will use mikrotik but not if mikrotik doesnt have the basic features that even basic consumer routers include that arent related to routing.

Lastly you have the power user who goes for the highest end hardware and features, currently they wont consider mikrotik (they consider netduma though) due to the features and UI. Mikrotik has performance hardware but not the features and UI that attracts these and these guys will usually pay more. Theres really no reason why you cant buy a RB9xx with mini PCIe and make a monster of a wifi AP for bragging rights but no one in this class knows about being able to have more radios for less than the price of those triband consumer routers. Mikrotik really could do well here if it would combine the various versatile features their different routerboards give and for much less. You can find routers with decent hardware, mini PCIe and all the bells and whistles of a regular PC (like the intel atom based ones for example) and do it for much less than those kickstarter routers are charging but features also need to be added too.

Then you also have to consider trends. DNScrypt is getting popular due increase in internet filters and ISP spying for monetary purposes. Many VPN providers dont support mikrotik for non PPTP connections (its a big deal because consumers will want the latest, that means UDP openVPN compared to businesses that prefer to use L2TP/IPSEC). However even i cant make heads or tails of configuring other VPN types on mikrotik other than pptp. More and more consumer routers are including features that are developed by others, like netgear having hardware encoding and plex media server for use with a usb drive or even NAS. Perhaps mikrotik could allow other companies to develop software for use with mikrotik routerOS but only runs with lower priority than mikrotik's own packages. This way mikrotik could focus on making a good product and all the other not so important features can be made by others and downloaded when needed. Perhaps permission sets could be used like with recent android OSes where the required access is shown and the user can select which parts can be accessed by each individual software. Soon in many markets, features like DNScrypt could be the deciding factor into choosing a router with more internet being filtered and more unfair ISP spying and selling of information.

I can't say that we're exactly on the same wave here, but don't understand it in a wrong way.

More features, definitely yes. The more, the better. Even such ones that will make some "hardcore enterprisers" weep. Just kidding, nothing against them, all "crazy" stuff can be completely optional. But for me, I'd still like MikroTik to stick with those more network-related features. Things like media server are over the top for me.

On the other hand, if MikroTik decided to expand, multiply number of developers and let some work on these things, then why not. Create different optional packages, or even create new special RouterOS branch, or whole new different OS, ... But that's a little too far from current state of things.

Similar with different or "better" UI. I for one I'm very satisfied with current UI and options it offers. I like the "total control" approach (well, within the limits set by MikroTik), but still with friendly interface (by my standards). I understand that many users could be pleased if there was something easier, filled with "one-click wonders". But I just can't imagine, how these two approaches could go together. One example of simpler interface is existing QuickSet. It's probably far from what you meant, but I think it can be taken as first step. And you can already see that it's one or the other, you can't just fiddle with any advanced stuff you want and expect QuickSet to be able to deal with it. So expanding in this direction would probably also require some independent OS branch.

i like the current UI too using winbox, but if mikrotik ever decided to sell to the high end consumers, they'd need a look that appeals. You dont need one click wonders, just pretty looking visual elements and presets that can be applied. Mikrotik themselves dont need to make the presets but it should be made easy for people to find and use them. What i mean is just downloading and applying scripts online for configuration, this is for ISPs that use more things, like google fiber for example or even QoS configs that could be applied as well. There isnt an easy to find online repository so if the wiki had links to professional sits with such scripts that could make things easier.

The enterprise tend to forget that they do use quite a lot of non router related features such as management, API and scripting. Consumers and small businesses however cant set aside a seperate machine and many businesses fall into the trap of using those horrible vpn routers like the cisco rv for example. That platform is severely underpowered, buggy and lacking vpn features that consumer routers come with now for many models.

Mikrotik routers are very capable but it requires an expert to make full use of it. If mikrotik home users had a security preset that could be applied, not just for their WAN interface but even LAN too to defend against attacks like droidsheep or session hijacking or even the pineapple hak for example, so far consumer routers still cant defend against this decades old attack. I've seen old cisco tutorials that actually uses mikrotik as some sort of database device to compliment their own managed switches for layer 2 security.

I doubt a home user would even get a Mikrotik set up

I'm also curios (and somewhat worried) where Mikrotik is going nowadays.

• Trying to compete in the "TR-069 segment" is pointless. Big ISPs only make deals with cheap OEM's like Huawei/Compal/Technicolor where they can control everything.
• Ubiquti is very strong in "Prosumer" WiFi & WISP solutions.
• Many willing-paying customers chooses a typical "Gamer-router" (e.g Netgear Nighthawk, D-Link Ultra) because the looks promises speed. The software sucks but they never worry about it.
• Many SOHO-users don't care about software features - it' should just be plug and play and provide Internet.
• Mikrotik isn't that great on switching to be honest. VLAN is quite odd (in perspective to Cisco) and to many industry-standard features is missing (port security, 802.1x, etc.)
• If I need a low-cost very-high-performance IPv4/IPv6 router/firewall in a datacenter, I choose a Linux/BSD box with BIRD or VyOS and some 10G interfaces.

Mikrotik has excellent features (a part for some oddly missing) and great CLI. Mikrotik is unique to offer enterprise features to small fanless DC-fed equipment. For many small-ISP/WISP the alternatives is Cisco/Juniper/xxxxx with hefty licensing fees and expensive mandatory support-contracts.

Mikrotik should focus on

• Maintaining their enterprise-features.
• Sensible models for small-ISP/WISP with features as redundant AC or DC and mixture of SFP/Copper combinations (CCR, RB1100, hEX)
• Beef up on security out of the box, because the rumour isn't that nice today. Make SSH-tunnel mandatory for Winbox/DUDE (I don't use them personally)

SSH-tunnel by itself doesn't bring much. What you need is a separate network for management with proper authentication of the admin.
There would be an opportunity to offer this through IPcloud (some VPN with 2-factor authentication) but apparently it is not considered to do this.
(for now it is only used as a DynDNS service and for backup storage)

It will at least give some additional protection for the winbox-protocol (that some does over the Internet) that has been exploited several times.

It will at least give some additional protection for the winbox-protocol (that some does over the Internet) that has been exploited several times.

But it introduces vulnerability of the SSH-protocol into the mix. So is that good?