Wireless Advice - Mikrotik

[delid4ve]

Following deployment of a mikrotik RB1100AHx2 in my office and being very impressed, I'm now looking to replace my home system due to a dying Asus N66u.

At present i have

Wired Clients --> Netgear Prosafe Switch (House is full Cat 6 to this) --> (LAN) Asus N66u (Serving Wireless) (WAN) --> Port 1 QNAP NAS Port 2 (VPN Client) --> Virgin Hub (With Guest Wifi - no access to LAN) --> WAN
Port 3/4 Of the QNAP serve another netgear POE switch for an isolated CCTV network.

Yes Yes, i'm operating a double NAT. This was done due to the fact that my QNAP can handle 100Mbps @ 20% CPU over OVPN whereas the ASUS topped out at 40Mbps @100% CPU. This was the only way to set this up with my current equipment but it works well.

I'm currently looking at replacing with full mikrotik.
I have a few questions though.
Looking at the wireless side of things CAPSMAN seems the way to go should i need multiple access points. Can this run on an OS level 5 unit such as the RB3011?
I want to keep cost as low as possible without degrading performance but an RB1100ahx4 seems overkill.
How seamless will the transfer between access points be?
ill be operating around 20/25 wired clients and another 10 wireless.

So i'm currently looking at the following:
1 x RB3011/1100 (£107 each /£169 each)
2 x HAP AC access points (1 downstairs, 1 upstairs) (Not HAP AC2's as these still seem to have issues) (£71 each)
1 x external access point later for outdoor if signal not strong enough.

Upgrading ill be able to:
Remove double NAT (Virgin HUB in modem only / Mikrotik can have multiple networks and serve wireless guest AP)
Remove Prosafe switch as enough ports on Mikrotik router

Any suggestions or advice welcome. Thanks.

 

[umarmung]

I would not recommend Mikrotik for wireless, except for point-to-point where they provide great value and are known for it in the WISP industry. They make incredible routers, less so WiFi (average performance, poor latency, poor legacy rate stability). About the only strong aspect of Mikrotik WiFi is a low noise floor, which won't really help you much in multiple small spaces of a typical house. They are also extremely configurable devices in general.

Ideal setup: RB1100AHX4 + 2x Ubiquiti UAP-AC-Lite or take a chance on the pre-release nanoHD. If you want complete overkill go for the Qualcomm-based UAP-AC-HD, if you have 3x3+ clients that can take advantage of it

Budget setup: hAP ac2/RB750Gr3 + 2x Ubiquiti UAP-AC-Lite. You can disable the wireless on the hAP ac2, resulting in wired router better than the hEX with a similar power draw, while remaining an optional additional AP or for use as a wireless bridge. The hAP ac2 WiFi issues have been fixed as of the latest release of RouterOS (6.42.3).

Both setups will scale to Gigabit Internet connections with NAT, even bidirectionally, though only the RB1100 is wirespeed. I am not a fan of the RB3011, since it has had multiple issues in the past and is an awkward middle ground in terms of price performance.

You may still need QNAP or something else for OpenVPN because Mikrotik OpenVPN support is poor - they do not even support OpenVPN over UDP.

In short, stick to Ubiquiti Unifi products for WiFi internal, external and even their point-to-point is excellent. They have better performance, superb low latency, very adaptable controllers, and high visibility into the managed network, making quick changes like bandwidth management trivial. They also support Fast Roaming and Zero-Handoff/SCA. You cannot go wrong, unless you have some very specific needs that are highly atypical for a consumer, e.g. strict 802.11r/k/v support. In which case, budget enterprise APs from Ruckus, Cisco, Aruba may be an alternative.

The only downside of Unifi management vs CAPsMAN is that the Unifi controller has to be run on a separate machine (Windows, Linux or Mac) or a Cloud Key. If you choose Zero-Handoff setup (not necessary in a home) rather than Fast Roaming or neither, the controller also has to be running all the time instead of whenever you want to make a configuration change.

If you insist on going with CAPsMAN, then CAP devices can be L4 and CAPsMANv2 can run on any RouterOS 6.22rc7 or later device, such as the Internet gateway router. Be aware that not only are Mikrotik products far harder to configure than Ubiquiti, but you also have to manually "force" roaming with ACLs and careful RSSI tuning with (or without) CAPsMAN, i.e. no zero-handoff nor fast roaming.

 

[delid4ve]

Thanks for the reply and detailed help.

Yes i was looking at the HEX just after i posted as i thought i was probably going overkill for home.
Ill take your advice though and get the ac2 as i can get a decent price due to the bad reviews everywhere.
Not used Ubiquiti before but just done a bit of reading up, not worried about statistics etc and see i can setup from ios app. I may add the controller later to my QNAP if needed.
I'm thinking that ill get 1x UAP-AC-LR instead of the lite, 3x3 and better range, see what my coverage is like instead of buying 2x straight off.

 

[sfx2000]

So i'm currently looking at the following:
1 x RB3011/1100 (£107 each /£169 each)
2 x HAP AC access points (1 downstairs, 1 upstairs) (Not HAP AC2's as these still seem to have issues) (£71 each)
1 x external access point later for outdoor if signal not strong enough.

Upgrading ill be able to:
Remove double NAT (Virgin HUB in modem only / Mikrotik can have multiple networks and serve wireless guest AP)
Remove Prosafe switch as enough ports on Mikrotik router

Any suggestions or advice welcome. Thanks.

Looks like a solid plan to me...

 

[delid4ve]

I would not recommend Mikrotik for wireless, except for point-to-point where they provide great value and are known for it in the WISP industry. They make incredible routers, less so WiFi (average performance, poor latency, poor legacy rate stability). About the only strong aspect of Mikrotik WiFi is a low noise floor, which won't really help you much in multiple small spaces of a typical house. They are also extremely configurable devices in general.

Ideal setup: RB1100AHX4 + 2x Ubiquiti UAP-AC-Lite or take a chance on the pre-release nanoHD. If you want complete overkill go for the Qualcomm-based UAP-AC-HD, if you have 3x3+ clients that can take advantage of it

Budget setup: hAP ac2/RB750Gr3 + 2x Ubiquiti UAP-AC-Lite. You can disable the wireless on the hAP ac2, resulting in wired router better than the hEX with a similar power draw, while remaining an optional additional AP or for use as a wireless bridge. The hAP ac2 WiFi issues have been fixed as of the latest release of RouterOS (6.42.3).

Both setups will scale to Gigabit Internet connections with NAT, even bidirectionally, though only the RB1100 is wirespeed. I am not a fan of the RB3011, since it has had multiple issues in the past and is an awkward middle ground in terms of price performance.

You may still need QNAP or something else for OpenVPN because Mikrotik OpenVPN support is poor - they do not even support OpenVPN over UDP.

In short, stick to Ubiquiti Unifi products for WiFi internal, external and even their point-to-point is excellent. They have better performance, superb low latency, very adaptable controllers, and high visibility into the managed network, making quick changes like bandwidth management trivial. They also support Fast Roaming and Zero-Handoff/SCA. You cannot go wrong, unless you have some very specific needs that are highly atypical for a consumer, e.g. strict 802.11r/k/v support. In which case, budget enterprise APs from Ruckus, Cisco, Aruba may be an alternative.

The only downside of Unifi management vs CAPsMAN is that the Unifi controller has to be run on a separate machine (Windows, Linux or Mac) or a Cloud Key. If you choose Zero-Handoff setup (not necessary in a home) rather than Fast Roaming or neither, the controller also has to be running all the time instead of whenever you want to make a configuration change.

If you insist on going with CAPsMAN, then CAP devices can be L4 and CAPsMANv2 can run on any RouterOS 6.22rc7 or later device, such as the Internet gateway router. Be aware that not only are Mikrotik products far harder to configure than Ubiquiti, but you also have to manually "force" roaming with ACLs and careful RSSI tuning with (or without) CAPsMAN, i.e. no zero-handoff nor fast roaming.

Thanks for all your help and advice. I went with the HAP AC2 and 1x UAP-AC-LR.
I can report:
Wifi coverage is excellent (about 20m through multiple brick walls at AC speed) and i havn't even got round to mounting on a wall yet, just sitting on a shelf flat so no need for 2x Ubiquiti's (i have disabled wifi on the HAP AC2)
No need for Ubiquiti controller as just set it up via the ios app.
VPN routing is by far easier now and more stable, by being able to add multiple address's/routes/firewall rules that i couldn't on my existing asus.
L2TP/IPSEC VPN's to multiple sites are working flawlessly even with dyndns scripted IPs
And the biggest bonus point is... It cost me less than a consumer grade router
Well chuffed