مركز المحتوى
أدلة، WinBox، LTE واستراتيجيات البرامج الثابتة.
A flat network where IP cameras share a broadcast domain with office PCs is a liability: one compromised camera can reach file shares, and multicast noise drags everyone down. Here is how to split cameras, office and management into VLANs on MikroTik, with a default-deny inter-VLAN firewall that only lets the NVR reach the cameras.
An unmanaged switch is genuinely fine on small flat jobs and a liability on anything that needs VLANs, PoE control, loop protection, IGMP snooping or remote diagnosis. Here is the honest line between the two, the MikroTik options, and why the cheap switch becomes a blind spot you cannot fix from your desk.
A factory-default RouterOS box on a public IP is found and probed within minutes. Here are ten concrete steps to take before it goes live: change the winbox port, lock down /ip service, replace the admin user, fence off neighbor discovery and the MAC-server, set an input firewall, and back up — without locking yourself out.
Designing LTE failover on RouterOS that actually works: route distance, check-gateway, netwatch scripts, recursive routing for reliable detection, automatic failback with hysteresis, and the metered-data discipline that keeps an LTE link from becoming a billing surprise.
A laptop sitting two rooms away still clings to the first AP it joined at -80 dBm while a near AP idles. Here is what 802.11r, 802.11k and 802.11v actually do, why the client (not the AP) chooses to roam, and how to nudge it with access-list and signal-range on RouterOS.
A single duplicate patch cable or a daisy-chained unmanaged switch can flood a CCTV LAN until every camera drops. Here is how the loop forms, why broadcast traffic amplifies it, and how STP/RSTP plus MikroTik bridge loop-protect stop it.
Per-port PoE class is the easy number; the switch's total budget and voltage drop over 90 metres of Cat5e are where installs actually fail. Here is how to size so every IR illuminator can kick in at dusk without browning out the rack.
Industrial RF is hostile: metal racking, concrete, machinery, and electrical noise wreck assumptions that hold in an office. Each band trades range against capacity and cleanliness — 2.4 GHz reaches but is crowded and narrow, 5 GHz has room but shorter reach and DFS surprises, 6 GHz adds clean spectrum where you have it. The gotcha: wide 80 MHz channels often underperform 20/40 MHz in a noisy plant.
A flat /24 with 150 cameras and the office on the same broadcast domain is a fire waiting to start. Here is how to layer access/aggregation/core, segment with VLANs, and do the oversubscription math so the NVR never starves.
Camera datasheets quote a tidy bitrate; real installations don't behave that tidily. Here is how bitrate actually scales with resolution, frame rate, codec and scene motion, and how to sum N cameras into an uplink you won't regret.
On most LTE and mobile operators your router never gets a real public IP — it sits behind carrier-grade NAT, so port-forwarding and DDNS simply cannot work. Here is how to confirm CGNAT and the one pattern that fixes it: an outbound WireGuard tunnel to a VPS.
Over a flaky LTE link the VPN protocol you pick decides whether the tunnel survives the connection dropping and the IP changing. A field-tested comparison of overhead, MTU pain, NAT traversal, CPU cost and reconnection behavior.
Wireless can carry camera video reliably — but only when the RF reality cooperates. Line-of-sight and a clear Fresnel zone are non-negotiable, throughput falls with distance and noise, and PtMP needs TDMA to survive hidden nodes. Size for aggregate camera bitrate plus headroom, and remember that the link that worked in March may die when the leaves come out.
Forwarding RTSP, HTTP and ONVIF ports to an IP camera puts it in front of automated internet scanners within minutes. Here is why "it is just one camera" is still a foothold into the whole LAN, and how to do remote access correctly.
One tunnel to one NVR is easy. A hundred and fifty sites is an architecture problem: a VPS hub, a clean IP plan, every spoke dialing out so CGNAT never matters, and the discipline to keep 150 peer configs from becoming a swamp.
تعمق في ضوابط الأمان ومعايير التشفير وإجراءات الامتثال التي تجعل mikroHUB جاهزًا للنشر المؤسسي في بيئات خاضعة للتنظيم.
جولة تقنية في تنسيق vault v2 لدينا مع إصدارات المفاتيح وتوقيعات webhook عبر HMAC وتدوير المفاتيح دون توقف لتشفير بيانات اعتماد RouterOS.
ماذا يعني NIS2 لفرق إدارة بنية MikroTik، وكيف يعمل الإبلاغ عن الحوادث، وماذا يوفّر mikroHUB جاهزًا.
مقارنة تفصيلية لكل ميزة على حدة بين mikroHUB وMikroTik's The Dude - تغطي الهندسة المعمارية ودعم LTE والأمان والأتمتة والتكلفة الإجمالية للملكية.
تسلسل عملي للاختبار والتشغيل المرحلي ونوافذ الطرح والنسخ الاحتياطية وقرارات التراجع عند ترقية أساطيل MikroTik.
مقارنة حقيقية بين WinBox القديمة والحديثة التي تغطي دعم النظام الأساسي وأمن البروتوكول وتوافق RouterOS والتوصيات العملية.
قوة الإشارة ليست كافية. تعرف على كيفية قراءة مقاييس الجودة LTE باستخدام الحدود الحقيقية وأوامر RouterOS وتقنيات قفل النطاق والمنطق المنهجي لاستكشاف الأخطاء وإصلاحها.
سياسة ملموسة لتعيين قنوات إصدار MikroTik لبيئات الإنتاج والحافة والمختبر وما قبل النشر - مع أوامر حقيقية ونصائح تشغيلية تم الحصول عليها بشق الأنفس.
يكون المخزون أكثر فائدة عندما تحتوي كل مجموعة أجهزة على بنية ورمز المنتج وسياق البرامج الثابتة وروابط التنزيل في مكان واحد.
كيفية التخلص من منافذ الإدارة الواردة، وتأمين الوصول إلى الخدمة، وتدوير بيانات الاعتماد، وإنشاء دفاعات جدار الحماية ذات الطبقات لنظام RouterOS على نطاق واسع.
The NVR is at a site on CGNAT and you need to see the cameras from your laptop. WireGuard on RouterOS does it cleanly — but only if you understand that allowed-address is two things at once and that the return route is the part everyone forgets.
When you run more than a handful of MikroTik APs across several buildings, configuring each one by hand stops scaling. CAPsMAN gives you one controller, one config, and provisioning rules that auto-set up new APs as they appear. The catch is datapath forwarding — get local vs manager forwarding wrong and you bottleneck a whole site.
A remote firmware upgrade across a real fleet is not one button. You juggle two separate things RouterOS calls firmware, choose and freeze an update channel, roll out in waves, and keep a way back when a device strands itself on the far end of a tunnel.
What to actually alert on across dozens of remote MikroTik sites, how to set thresholds that survive flaky LTE, how to tier escalation, and how to reach the on-call person without training everyone to ignore the alarms.
An honest look at what The Dude still does brilliantly, where a single-host design hurts you across many remote sites, and what modern cloud monitoring buys you — along with the tradeoffs you actually pay.
Three features that contain the blast radius when someone plugs the wrong thing into the wrong port: storm-control caps broadcast floods, bridge horizon isolates client ports, and MAC learning limits stop rogue devices. Concrete RouterOS bridge config and the horizon gotcha.
How to build a single-line, idempotent .rsc template you can paste into any RouterOS terminal, parameterize per site, and re-run safely — so a fleet rollout stops being a hundred individual jobs.
A binary /system backup and an /export .rsc are not two ways to do the same thing — they fail and shine in opposite situations. One is a fast same-box snapshot with secrets baked in; the other is a portable, diff-able, partially-restorable text file. Keep both, and know exactly what each one silently leaves out.
When a RouterBOARD forgets its password, dies mid-upgrade, or sits in a boot loop, Netinstall is the tool that reliably brings it back. The catches are physical and network-level: a direct Layer-2 link, etherboot mode, no competing DHCP, the right architecture package, and a Windows firewall that loves to eat the BOOTP handshake.
1G SFP versus 10G SFP+, multimode versus single-mode, when DAC beats fiber for a rack hop, vendor coding tolerance on MikroTik, reading optical power with DDM, and the BiDi wavelength mismatch that silently kills a link.
Most MikroTik firewalls fall apart because the rules are in the wrong order, not because a rule is missing. Here is a field-tested base: how first-match ordering works, why raw runs before connection tracking, the established/related/invalid/new logic, separating input from forward, the fasttrack tradeoff, and how not to lock yourself out.
On a MikroTik with a switch chip, the bridge should forward at line rate in silicon. The day it silently falls back to software, your CPU pins at 100% and throughput collapses — here is exactly what kills offload and how to confirm it.
A practitioner's honest accounting of the v6-to-v7 jump: new kernel, built-in WireGuard, a rebuilt routing engine, ROSE storage and containers — and the migration surprises that bite when you upgrade a live edge router.
Video traffic suffers from jitter and loss long before it runs out of bandwidth. Marking with DSCP, queuing with simple queues or a queue tree, and taming bufferbloat at the one congestion point you actually control.
The modern bridge VLAN filtering model replaces the tangle of multiple bridges and VLAN interfaces most installers still copy from old forum posts. Here is how tagged/untagged ports, PVID and the bridge VLAN table actually fit together — plus the one mistake that silently breaks your management access.