It's worth pointing out that the default configuration of almost every Mikrotik router these days comes with a firewall that blocks inbound access to all ports. Admins have to go out of their way to expose winbox to the internet (as many did - including myself - under the belief the protocol was somewhat secure running over TLS).
Unfortunately NIH syndrome runs at an all time high at Mikrotik. Even the RouterOS webserver and SMB implementations were custom written, and both were later found to contain remotely exploitable bugs. I'm sure there are other holes lurking in their implementations of ipsec, openvpn, etc, so I no longer open up anything and rely on port forwarding to more secure and battle-tested services like OpenSSH / Wireguard for remote management.
Mikrotik boxes are really quirky. They basically have user-facing bugs, symptoms of which can have no explanation except for them fronting some massive clusterfuck on the inside. They used to do bizarre things with timestamps of freshly copied files, when the modified time would oscillate around some convergence point. Some wierd directory names (like .popup ?) were reserved for no apparent reason and an attempt to create them failed with "file not found". That sort of thing. And we even didn't own any of their devices, we were just in a splatter zone from our clients constantly walking into Mikrotik issues. It was few years ago though, so perhaps things have improved since then.
>...so I no longer open up anything and rely on port forwarding to more secure and battle-tested services like OpenSSH / Wireguard for remote management.
Absolutely. I purchased an rb2011uiasrm when I got gig fiber at home. I enjoyed hardening the router and ran IPsec VPN for a bit but prefer using another box w/OpenVPN and HMAC auth. I just don't see no matter the promise of security a good reason for explicitly allowing remote access from internet to a core device, MikroTik or otherwise.
Can anyone suggest a wireless router that someone can buy today that either ships with or can be flashed with OSS firmware? I've been trying to shop around for one compatible with DD-WRT or OpenWRT and been rather disheartened so far; every promising model I've found either requires you to play roulette with the specific hardware version of the router that you receive (which is never advertised on product pages), or is out of stock entirely, or costs upwards of $250 (which is tough to sell to my friends, when their ISP charges $10/mo to rent a router with much less hassle).
Ubiquiti EdgeOS based edgerouters are what I prefer as a greybeard sysadmin type who has dealt with everything under the sun. It's VyOS (Vyatta) based, they are now complying with gpl afaik, and their hardware is really good for the price/performance ratio. The edgerouter-x or lite can be found for ~$99 and is a great piece of gear.
Another option would be your own hardware with pfsense (bsd) or ipfire(linux).
Even further would be your own hardware with linux and write your own nftables or bpf.
For something with hardware offload, get a Ubiquiti EdgeRouter. I run one at home, it's debian based, I have lots of tools I've written in Go compiled and running on it for various purposes and you can install debian packages for things you need.
The other option I've heard good things about are the PCEngines devices. They don't, as far as I'm aware, have hardware offload, so make sure their performance suits, but they use OSS U-Boot and you install the OS of your choice. It's one of the most open devices in a router form factor I've come across.
Depending on the number of ports you need, you could also use one of the Jetway devices. They make them with varying numbers of ports as SBCs in a case and you add RAM/M.2 SSD. I got a Celeron one with 2 ports and run it as a Suricata IPS. It performed just fine with my 100M pipe.
I know this doesn't help friends and non-technical folks, but I finally gave up and bought an APU[0], installed Debian, and configured dnsmasq+hostapd+iptables. With unattended updates, it was the most secure thing I could think of. Well, I suppose using openbsd would have been potentially more secure, but there were driver issues with the wireless card that I wanted.
The Netgear Nighthawk series is almost always available on Amazon and is generally well supported by dd-wrt.
Specifically, the best deals can be had on the oldest model, the R6700v3, from an Amazon warehouse deal for $70. This is what I use, and it works without issue with dd-wrt. You'll need to flash it 3 times.
The best device is probably the R7800 model. It uses a very fast, non-Broadcom (OpenWRT-supported), modern chip. The only way this matters in practice is if (1) you have a gigabit Internet connection and (2) if you need QoS turned on for scoring an A+ in "bufferbloat" on speedtest.net--i.e., you play games.
If you don't use QoS, you will be able to serve 1 gigabit with dd-wrt's "Shortcut Forwarding Engine," which is an accelerated "in-Linux-kernel IP packet forwarding engine." If you don't have a gigabit connection, the typical Linux routing stuff that dd-wrt uses is fine.
With regards to model roulette, you can always buy it off eBay for the specific model. These routers are so common I see listing for them in Craigslist in the Bay Area right now.
I would argue the two main reasons to do this are for improved security/stability and QoS. If you're not interested in these features, buy something that Wirecutter recommends in your price range. But compared to $70, I believe a truly decent router can be had for $50 (the Archer series others have mentioned) that is also truly ancient.
The Apple Airport devices run ARM NetBSD and you can SSH into them. The last generation ran NetBSD 7 and executed binaries from NetBSD userspace when compiled statically.
OpenWRT does not ship closed-source Broadcom drivers, so it tends to have worse support across the board. I don't think their OSS-related reasons for doing so are material to you.
I just last weekend retired a pair of Asus RT-AC66U routers/access points. They ran stable for years on Tomato (version tomato-RT-AC66U_AT-RT-AC6x-3.4-140-AIO-64K.trx) and I think all the hardware revisions work, but confirm that yourself.
I retired them mostly because the Ubiquiti management is much easier and that hardware also affordable (though the software is not open, so not a fit for your use case).
Consider TP-Link Archer C7, for instance. It is an older one, but has reasonably fast hardware, supports IEEE 802.11ac and is available on Amazon. New costs ~75 USD, a "certified refurbished" version costs ~50 USD.
There are many brands and models that are compatible with OpenWRT. I have good experience with tp-link wr1043nd, wdr3600 but they are a bit old by now. I just ordered ZyXEL NBG6617 to test out.
Until very recently I would just go to Microcenter and purchase a cheap refurbished small form factor PC plus two Intel NICs and run OpenBSD. For less than $200 you have a fully functional router albeit at a higher power cost than a true appliance.
If you really need a small / low power usage appliance then some Ubiquiti devices run OpenBSD as I mentioned in another reply below.
Anecdotally OpenBSD also supports wireguard if that's a concern.
So far, I've had very good luck with the ASUS AC1300 (asus_rt-ac58u) and OpenWRT. I still need to add to the openwrt wiki but it was pretty easy. (Luck == I've bought two so far, plan to buy more)
I have one of the Linksys WRT-AC series (WRT-1900ACS but they are all pretty similar I think) - they're very well supported by OpenWRT (stock firmware is a derivative of OpenWRT in fact at least on some of them). Hardware specs are good, including reasonably fast CPUs (good enough to saturate a VPN at 100Mbit at least which is the uplink I have here). The open source wireless chipset support is towards the better end too - not perfect but a lot better than some others.
If you're flashing your own images of OpenWRT, there are a few conveniences which are a bit more uncommon in the hardware which are useful if you ever need to debrick - eg easily openable case, UART header comes pre-installed (you don't need to solder your own), etc.
Interestingly enough, MikroTik routers are mostly well supported by OpenWrt it seems. At least that's what my search for something that is beefier than regular OTS Routers has yielded. Flashing OpenWrt is a little cumbersome though.
TP-Link, the former manufacturer of my choice, unfortunately has become a version roulette it seems.
If power consumption does not bother you, maybe banana pi? Or something atom based?
I just pay the $10/month. The complete lack of hassle makes it worth it to me. Of all the things in the world I want to do, futzing with some OSS firmware is pretty close to the bottom of the list.
What’s your reason for suggesting friends buy a modem/router beyond the cost?
My MikroTik started going nuts late last week; it managed to upload ~90Gb worth of data in 3 days (downloads weren't nearly as bad). Considering I only have a 300Gb cap, that hurt. I subsequently re-flashed it, and secured it properly this time, which solved the issue.
Using the hardware reset button doesn't fix things, so heads up for others in that situation. Use MikroTik's NetInstall to re-install RouterOS instead.
Curious is this the VPNFilter malware or some new router virus?
Lately I’ve been having IP & Internet issues like....
- match suddenly banned me as a subscriber to okcupid and match. They won’t tell me why either & ive been a subscriber on/off for years. Never or ever would I do anything inappropriate though my match.com account I feel was hacked. Yet they don’t want to listen :-(
- my 6 month old roku device suddenly would no longer find my router.
- yesterday just bought a new Roku & was unable to activate it after many attempts.
Anyone else having weird Internet/IP device issues too?
Clearly it's possible that an attacker could come in from the back door (desktop, XSS etc), I could lock down the BGP more, and tighen up Mgmt beyond it's current fairly wide subnets (a /16 owned by work and my wired range), but it becomes a hassle, which leads to more disabling of the "action=drop" while debugging. My backup script emails me when the configuration changes
To check if your proxy is enabled (probably shouldn't be)
> After enabling the Mikrotik RouterOS HTTP proxy, the attacker uses a trick in the configuration by redirecting all the HTTP proxy requests to a local HTTP 403 error page, and in this error page a link for web mining code from coinhive.com is inserted. By doing this, the attacker hopes to perform web mining for all the proxy traffic on the users’ devices
> What is disappointing for the attacker though, the mining code does not work in this way, because all the external web resources, including those from coinhive.com necessary for web mining, are blocked by the proxy ACLs set by attackers themselves.
Smart enough to breach Mikrotik routers. Dumb enough to fuck up linking in coinhive JS. That screams "script kiddie buying delivery method on an open market".
Why would anyone want to use that? My theory is that it has something to do with how in many cases the MT sshd has to be told to figure out the terminal:
...and this information is really hard to find. If the terminal settings aren't right and you can't fix them, ssh is unusable and you're stuck with either winbox or webfig. Fortunately, if the ssh session is wrapped in a mosh session then mosh will handle MT's terminal settings.
Afaik winbox is the only way to reconfigure the device in case of serious IP misconfiguration, or if layer 3 networking does not work for some reason (I just had to debug a switching loop...), as winbox can connect by MAC, rather than IP.
That stinks. I tried to help the community by providing a warning and I get downvoted. What is the motivation to help? From now on I will not issue any warnings.
[+] [-] r1ch|7 years ago|reply
Unfortunately NIH syndrome runs at an all time high at Mikrotik. Even the RouterOS webserver and SMB implementations were custom written, and both were later found to contain remotely exploitable bugs. I'm sure there are other holes lurking in their implementations of ipsec, openvpn, etc, so I no longer open up anything and rely on port forwarding to more secure and battle-tested services like OpenSSH / Wireguard for remote management.
[+] [-] eps|7 years ago|reply
Mikrotik boxes are really quirky. They basically have user-facing bugs, symptoms of which can have no explanation except for them fronting some massive clusterfuck on the inside. They used to do bizarre things with timestamps of freshly copied files, when the modified time would oscillate around some convergence point. Some wierd directory names (like .popup ?) were reserved for no apparent reason and an attempt to create them failed with "file not found". That sort of thing. And we even didn't own any of their devices, we were just in a splatter zone from our clients constantly walking into Mikrotik issues. It was few years ago though, so perhaps things have improved since then.
[+] [-] philamonster|7 years ago|reply
Absolutely. I purchased an rb2011uiasrm when I got gig fiber at home. I enjoyed hardening the router and ran IPsec VPN for a bit but prefer using another box w/OpenVPN and HMAC auth. I just don't see no matter the promise of security a good reason for explicitly allowing remote access from internet to a core device, MikroTik or otherwise.
[+] [-] kibwen|7 years ago|reply
[+] [-] arminiusreturns|7 years ago|reply
Another option would be your own hardware with pfsense (bsd) or ipfire(linux).
Even further would be your own hardware with linux and write your own nftables or bpf.
[+] [-] alias_neo|7 years ago|reply
The other option I've heard good things about are the PCEngines devices. They don't, as far as I'm aware, have hardware offload, so make sure their performance suits, but they use OSS U-Boot and you install the OS of your choice. It's one of the most open devices in a router form factor I've come across.
Depending on the number of ports you need, you could also use one of the Jetway devices. They make them with varying numbers of ports as SBCs in a case and you add RAM/M.2 SSD. I got a Celeron one with 2 ports and run it as a Suricata IPS. It performed just fine with my 100M pipe.
[+] [-] yjftsjthsd-h|7 years ago|reply
[0] https://pcengines.ch/apu2.htm
[+] [-] doctorpangloss|7 years ago|reply
Specifically, the best deals can be had on the oldest model, the R6700v3, from an Amazon warehouse deal for $70. This is what I use, and it works without issue with dd-wrt. You'll need to flash it 3 times.
The best device is probably the R7800 model. It uses a very fast, non-Broadcom (OpenWRT-supported), modern chip. The only way this matters in practice is if (1) you have a gigabit Internet connection and (2) if you need QoS turned on for scoring an A+ in "bufferbloat" on speedtest.net--i.e., you play games.
If you don't use QoS, you will be able to serve 1 gigabit with dd-wrt's "Shortcut Forwarding Engine," which is an accelerated "in-Linux-kernel IP packet forwarding engine." If you don't have a gigabit connection, the typical Linux routing stuff that dd-wrt uses is fine.
With regards to model roulette, you can always buy it off eBay for the specific model. These routers are so common I see listing for them in Craigslist in the Bay Area right now.
I would argue the two main reasons to do this are for improved security/stability and QoS. If you're not interested in these features, buy something that Wirecutter recommends in your price range. But compared to $70, I believe a truly decent router can be had for $50 (the Archer series others have mentioned) that is also truly ancient.
The Apple Airport devices run ARM NetBSD and you can SSH into them. The last generation ran NetBSD 7 and executed binaries from NetBSD userspace when compiled statically.
OpenWRT does not ship closed-source Broadcom drivers, so it tends to have worse support across the board. I don't think their OSS-related reasons for doing so are material to you.
[+] [-] sokoloff|7 years ago|reply
I retired them mostly because the Ubiquiti management is much easier and that hardware also affordable (though the software is not open, so not a fit for your use case).
[+] [-] ajayh|7 years ago|reply
x86, can run OpenWRT.
[+] [-] pbasista|7 years ago|reply
Take a look e.g. at OpenWrt's list of devices "Ideal for OpenWrt": https://openwrt.org/toh/views/toh_available_864
Consider TP-Link Archer C7, for instance. It is an older one, but has reasonably fast hardware, supports IEEE 802.11ac and is available on Amazon. New costs ~75 USD, a "certified refurbished" version costs ~50 USD.
[+] [-] tga|7 years ago|reply
[0] https://www.aliexpress.com/item/Wifi-Router-NEXX-WT3020H-300...
[1] https://wiki.openwrt.org/toh/nexx/wt3020
[+] [-] pingec|7 years ago|reply
There are many brands and models that are compatible with OpenWRT. I have good experience with tp-link wr1043nd, wdr3600 but they are a bit old by now. I just ordered ZyXEL NBG6617 to test out.
[+] [-] technofiend|7 years ago|reply
If you really need a small / low power usage appliance then some Ubiquiti devices run OpenBSD as I mentioned in another reply below.
Anecdotally OpenBSD also supports wireguard if that's a concern.
https://www.openbsd.org/octeon.html
https://marc.info/?l=openbsd-ports&m=152712417729497&w=2
[+] [-] isatty2|7 years ago|reply
Otherwise, get an edgerouter.
[+] [-] linuxlizard|7 years ago|reply
[+] [-] rando444|7 years ago|reply
(2) If you get the wrong router, just return it and get another.
(3) Buy a router at a brick and mortar store so you know what you're getting.
[+] [-] tomatocracy|7 years ago|reply
If you're flashing your own images of OpenWRT, there are a few conveniences which are a bit more uncommon in the hardware which are useful if you ever need to debrick - eg easily openable case, UART header comes pre-installed (you don't need to solder your own), etc.
[+] [-] bipson|7 years ago|reply
TP-Link, the former manufacturer of my choice, unfortunately has become a version roulette it seems.
If power consumption does not bother you, maybe banana pi? Or something atom based?
[+] [-] erikdared|7 years ago|reply
[+] [-] Ahl4Gom6|7 years ago|reply
[+] [-] tempuser24|7 years ago|reply
I would assume that they are easy to flash and high compatible.
[+] [-] jsjohnst|7 years ago|reply
[+] [-] pjmlp|7 years ago|reply
If I am not mistaken FRITZ!OS is a Linux distribution.
[+] [-] letmeaskaq7532|7 years ago|reply
[+] [-] CallMeZach|7 years ago|reply
[+] [-] paulcole|7 years ago|reply
What’s your reason for suggesting friends buy a modem/router beyond the cost?
[+] [-] hrudham|7 years ago|reply
Using the hardware reset button doesn't fix things, so heads up for others in that situation. Use MikroTik's NetInstall to re-install RouterOS instead.
[+] [-] paul7986|7 years ago|reply
Lately I’ve been having IP & Internet issues like....
- match suddenly banned me as a subscriber to okcupid and match. They won’t tell me why either & ive been a subscriber on/off for years. Never or ever would I do anything inappropriate though my match.com account I feel was hacked. Yet they don’t want to listen :-(
- my 6 month old roku device suddenly would no longer find my router.
- yesterday just bought a new Roku & was unable to activate it after many attempts.
Anyone else having weird Internet/IP device issues too?
[+] [-] baybal2|7 years ago|reply
Mikrotik is Latvian, not Lithuanian.
[+] [-] isostatic|7 years ago|reply
To check if your proxy is enabled (probably shouldn't be)
[+] [-] 24gttghh|7 years ago|reply
[+] [-] lucb1e|7 years ago|reply
[+] [-] dboreham|7 years ago|reply
[+] [-] TeMPOraL|7 years ago|reply
> What is disappointing for the attacker though, the mining code does not work in this way, because all the external web resources, including those from coinhive.com necessary for web mining, are blocked by the proxy ACLs set by attackers themselves.
Smart enough to breach Mikrotik routers. Dumb enough to fuck up linking in coinhive JS. That screams "script kiddie buying delivery method on an open market".
Also, how is coinhive still a thing?
[+] [-] ballenf|7 years ago|reply
It's too bad coinhive is so easy to abuse. I'd much rather live in a world where websites are financed with my electric bill rather than my data.
[+] [-] dboreham|7 years ago|reply
https://blog.mikrotik.com/security/winbox-vulnerability.html
(referenced here : https://forum.mikrotik.com/viewtopic.php?f=21&t=137284&start...)
[+] [-] justinclift|7 years ago|reply
That strongly suggests password harvesting. Those ports/protocols often (not always) are used for unencrypted user/pass combinations. :(
[+] [-] jessaustin|7 years ago|reply
[+] [-] 4ad|7 years ago|reply
[+] [-] orf|7 years ago|reply
[+] [-] JohnnyWesh|7 years ago|reply
[+] [-] teilo|7 years ago|reply
[+] [-] unknown|7 years ago|reply
[deleted]
[+] [-] a012|7 years ago|reply
[+] [-] ccnafr|7 years ago|reply
[+] [-] burkesquires|7 years ago|reply
[+] [-] JohnnyWesh|7 years ago|reply
[+] [-] burkesquires|7 years ago|reply
[+] [-] isostatic|7 years ago|reply