Ramblings of an aging IT geek
← Ramblings of an aging IT geek
networking

a year on mikrotik after a decade on pfsense

A year after swapping a pfSense box for a MikroTik router, an honest account of what got better, what got worse, and what I miss.

Network cables in a patch panel

A year ago I retired a perfectly good pfSense box for a MikroTik. Not because pfSense was failing, but because I wanted hardware offload at 10G without a power bill that read like a small datacentre. Twelve months in, here's the honest reckoning.

What got better is mostly performance per watt. The MikroTik routes line rate while sipping power, and RouterOS has genuinely useful tools buried in it once you find them. The Winbox interface is dense but quick, and being able to script the whole config in one text file that I keep in git is something I didn't know I'd value until I had it. Rebuilding the router from scratch is now a paste job.

What got worse is the learning curve, which is a cliff. RouterOS does not hold your hand, the firewall defaults are permissive in ways that will bite you, and the terminology is its own little dialect. I locked myself out twice in the first month. pfSense, for all its quirks, has sane defaults and a UI that explains itself.

What I miss is the pfSense package ecosystem and the community write-ups for every conceivable scenario. MikroTik answers exist, but they're scattered across forum posts from 2017 that may or may not still apply.

Would I switch back? No. But I'd only recommend MikroTik to someone who genuinely enjoys reading manuals. If you want a firewall that mostly configures itself, stay on pfSense and don't let anyone tell you you're wrong.