مرکز محتوا
راهنماها، WinBox، LTE و استراتژی فریمور.
A flat network where IP cameras share a broadcast domain with office PCs is a liability: one compromised camera can reach file shares, and multicast noise drags everyone down. Here is how to split cameras, office and management into VLANs on MikroTik, with a default-deny inter-VLAN firewall that only lets the NVR reach the cameras.
An unmanaged switch is genuinely fine on small flat jobs and a liability on anything that needs VLANs, PoE control, loop protection, IGMP snooping or remote diagnosis. Here is the honest line between the two, the MikroTik options, and why the cheap switch becomes a blind spot you cannot fix from your desk.
A factory-default RouterOS box on a public IP is found and probed within minutes. Here are ten concrete steps to take before it goes live: change the winbox port, lock down /ip service, replace the admin user, fence off neighbor discovery and the MAC-server, set an input firewall, and back up — without locking yourself out.
Designing LTE failover on RouterOS that actually works: route distance, check-gateway, netwatch scripts, recursive routing for reliable detection, automatic failback with hysteresis, and the metered-data discipline that keeps an LTE link from becoming a billing surprise.
A laptop sitting two rooms away still clings to the first AP it joined at -80 dBm while a near AP idles. Here is what 802.11r, 802.11k and 802.11v actually do, why the client (not the AP) chooses to roam, and how to nudge it with access-list and signal-range on RouterOS.
A single duplicate patch cable or a daisy-chained unmanaged switch can flood a CCTV LAN until every camera drops. Here is how the loop forms, why broadcast traffic amplifies it, and how STP/RSTP plus MikroTik bridge loop-protect stop it.
Per-port PoE class is the easy number; the switch's total budget and voltage drop over 90 metres of Cat5e are where installs actually fail. Here is how to size so every IR illuminator can kick in at dusk without browning out the rack.
Industrial RF is hostile: metal racking, concrete, machinery, and electrical noise wreck assumptions that hold in an office. Each band trades range against capacity and cleanliness — 2.4 GHz reaches but is crowded and narrow, 5 GHz has room but shorter reach and DFS surprises, 6 GHz adds clean spectrum where you have it. The gotcha: wide 80 MHz channels often underperform 20/40 MHz in a noisy plant.
A flat /24 with 150 cameras and the office on the same broadcast domain is a fire waiting to start. Here is how to layer access/aggregation/core, segment with VLANs, and do the oversubscription math so the NVR never starves.
Camera datasheets quote a tidy bitrate; real installations don't behave that tidily. Here is how bitrate actually scales with resolution, frame rate, codec and scene motion, and how to sum N cameras into an uplink you won't regret.
On most LTE and mobile operators your router never gets a real public IP — it sits behind carrier-grade NAT, so port-forwarding and DDNS simply cannot work. Here is how to confirm CGNAT and the one pattern that fixes it: an outbound WireGuard tunnel to a VPS.
Over a flaky LTE link the VPN protocol you pick decides whether the tunnel survives the connection dropping and the IP changing. A field-tested comparison of overhead, MTU pain, NAT traversal, CPU cost and reconnection behavior.
Wireless can carry camera video reliably — but only when the RF reality cooperates. Line-of-sight and a clear Fresnel zone are non-negotiable, throughput falls with distance and noise, and PtMP needs TDMA to survive hidden nodes. Size for aggregate camera bitrate plus headroom, and remember that the link that worked in March may die when the leaves come out.
Forwarding RTSP, HTTP and ONVIF ports to an IP camera puts it in front of automated internet scanners within minutes. Here is why "it is just one camera" is still a foothold into the whole LAN, and how to do remote access correctly.
One tunnel to one NVR is easy. A hundred and fifty sites is an architecture problem: a VPS hub, a clean IP plan, every spoke dialing out so CGNAT never matters, and the discipline to keep 150 peer configs from becoming a swamp.
بررسی عمیق کنترلهای امنیتی، استانداردهای رمزنگاری و اقدامات انطباق که mikroHUB را برای استقرار سازمانی در محیطهای مقرراتی آماده میکند.
راهنمای فنی قالب vault v2 ما با نسخهبندی کلید، امضاهای webhook مبتنی بر HMAC و چرخش کلید بدون توقف برای رمزنگاری اعتبارنامه RouterOS.
NIS2 برای تیمهایی که زیرساخت MikroTik را مدیریت میکنند چه معنا دارد، گزارشدهی حادثه چگونه کار میکند، و mikroHUB از ابتدا چه چیزی فراهم میکند.
مقایسه دقیق ویژگی به ویژگی mikroHUB و MikroTik's The Dude - شامل معماری، پشتیبانی LTE، امنیت، اتوماسیون و هزینه کل مالکیت.
دنباله ای عملی برای آزمایش، مرحله بندی، پنجره های عرضه، پشتیبان گیری، و تصمیمات برگشتی هنگام ارتقاء ناوگان MikroTik.
مقایسه واقعی سازههای قدیمی و مدرن WinBox که پشتیبانی از پلتفرم، امنیت پروتکل، سازگاری RouterOS و توصیههای عملی را پوشش میدهد.
قدرت سیگنال کافی نیست. با نحوه خواندن معیارهای کیفیت LTE با آستانه های واقعی، دستورات RouterOS، تکنیک های قفل باند و منطق عیب یابی سیستماتیک آشنا شوید.
یک خط مشی مشخص برای نگاشت کانال های انتشار MikroTik به محیط های تولید، لبه، آزمایشگاه و محیط های پیش از انتشار - با دستورات واقعی و توصیه های عملیاتی که به سختی به دست آمده اند.
موجودی زمانی مفیدتر است که هر خانواده دستگاه دارای معماری، کد محصول، زمینه سیستم عامل و لینک های دانلود در یک مکان باشد.
نحوه حذف پورتهای مدیریت ورودی، قفل کردن دسترسی به سرویس، چرخش اعتبارنامهها و ساخت دیواره آتش لایهای برای RouterOS در مقیاس.
The NVR is at a site on CGNAT and you need to see the cameras from your laptop. WireGuard on RouterOS does it cleanly — but only if you understand that allowed-address is two things at once and that the return route is the part everyone forgets.
When you run more than a handful of MikroTik APs across several buildings, configuring each one by hand stops scaling. CAPsMAN gives you one controller, one config, and provisioning rules that auto-set up new APs as they appear. The catch is datapath forwarding — get local vs manager forwarding wrong and you bottleneck a whole site.
A remote firmware upgrade across a real fleet is not one button. You juggle two separate things RouterOS calls firmware, choose and freeze an update channel, roll out in waves, and keep a way back when a device strands itself on the far end of a tunnel.
What to actually alert on across dozens of remote MikroTik sites, how to set thresholds that survive flaky LTE, how to tier escalation, and how to reach the on-call person without training everyone to ignore the alarms.
An honest look at what The Dude still does brilliantly, where a single-host design hurts you across many remote sites, and what modern cloud monitoring buys you — along with the tradeoffs you actually pay.
Three features that contain the blast radius when someone plugs the wrong thing into the wrong port: storm-control caps broadcast floods, bridge horizon isolates client ports, and MAC learning limits stop rogue devices. Concrete RouterOS bridge config and the horizon gotcha.
How to build a single-line, idempotent .rsc template you can paste into any RouterOS terminal, parameterize per site, and re-run safely — so a fleet rollout stops being a hundred individual jobs.
A binary /system backup and an /export .rsc are not two ways to do the same thing — they fail and shine in opposite situations. One is a fast same-box snapshot with secrets baked in; the other is a portable, diff-able, partially-restorable text file. Keep both, and know exactly what each one silently leaves out.
When a RouterBOARD forgets its password, dies mid-upgrade, or sits in a boot loop, Netinstall is the tool that reliably brings it back. The catches are physical and network-level: a direct Layer-2 link, etherboot mode, no competing DHCP, the right architecture package, and a Windows firewall that loves to eat the BOOTP handshake.
1G SFP versus 10G SFP+, multimode versus single-mode, when DAC beats fiber for a rack hop, vendor coding tolerance on MikroTik, reading optical power with DDM, and the BiDi wavelength mismatch that silently kills a link.
Most MikroTik firewalls fall apart because the rules are in the wrong order, not because a rule is missing. Here is a field-tested base: how first-match ordering works, why raw runs before connection tracking, the established/related/invalid/new logic, separating input from forward, the fasttrack tradeoff, and how not to lock yourself out.
On a MikroTik with a switch chip, the bridge should forward at line rate in silicon. The day it silently falls back to software, your CPU pins at 100% and throughput collapses — here is exactly what kills offload and how to confirm it.
A practitioner's honest accounting of the v6-to-v7 jump: new kernel, built-in WireGuard, a rebuilt routing engine, ROSE storage and containers — and the migration surprises that bite when you upgrade a live edge router.
Video traffic suffers from jitter and loss long before it runs out of bandwidth. Marking with DSCP, queuing with simple queues or a queue tree, and taming bufferbloat at the one congestion point you actually control.
The modern bridge VLAN filtering model replaces the tangle of multiple bridges and VLAN interfaces most installers still copy from old forum posts. Here is how tagged/untagged ports, PVID and the bridge VLAN table actually fit together — plus the one mistake that silently breaks your management access.