Excellent video, only one important thing you didn't mention; backup and restore of config. This is by far one of the most useful options mikrotik has. It makes it really easy to switch from a certain mikrotik router to another without having to reconfigure the new one from scratch. Saves a lot of time especially if you use bridges which eliminate having to redo your whole firewall setup when changing ports. It also is good practice to save a working config before doing anything new. If it fails and you have a mess (also very easy to get with mikrotik), just reset the router to factory, upload and activate the saved config and voila.

Thanks awesome

I definitely agree that a CCNA is a bit of a step of from the MTNCA, it is also in my opinion a harder certificate to achieve due to the high bar set by Cisco as well as not being able to go back on questions when taking the exam. And yeah, MikroTik expects you to already understand how TCP/IP works and how to perform basic subnetting. So not a 100% equivalent, but it is MikroTik's equivalent to an entry level networking certification.

You are mixing between networking and vendors, CISCO does not mean networking, it is only a vendor, you can master networking with Network+ then start with MTCNA or CISCO. There will be no differences at all.

@@johnlegend8421 while it may be true Cisco is just a vendor but they were if not still are the standard when it comes to networking because of how much in depth the curriculum is, the same may not be true for N+ as they skim over the basics of networking and aren't vendor specific meaning after all of the learning with N+ you still Will pickup Cisco or juniper to study.

There is no way a very basic course like mtcna would be compared to CCNA.I have heard this argument so many times and mostly from people that do not have the CCNA

@@johnlegend8421 look at how Cisco has structured their courses .You cover the theory first before you cover the application of the technology.

Wow thank you for the extremely nice comment! I really hope I can help more people with their own growth when it comes to MikroTik or networking in general and get them wanting to do more!

@@TheNetworkBerg Its true. I got better to what I do. That leads to getting better at everything. 🙏

I can't imagine the firewall rules have changed much since publishing this video, will need to give it a review :) I think the most important part about the rules is just to understand how they work. Especially how input, output and forward rules work. Fasttrack is also a very interesting topic. So might revisit this again for noobies or create a new video going over all the current MT configurations and features in version 7.15

It's a pleasure, thanks for leaving the nice comment :)!

Glad it helped

Thanks for watching!

Glad you liked it!

Yeah I know they are definitely working on it, I recall seeing it mentioned in either a newsletter or one of the new HAP reveals on their channel. So maybe it will come out soon for ROS as a whole. Thank you also for the nice comment, it is appreciated!

ROS v7 with wifi wave2 package already have WPA3 implemented and functional

I do not know what regulations Nigeria has regarding Wireless connectivity, I think the country selection just basically allows you to tweak the wireless to standards or regulations in your country. Setting it to the UK or any other country I do not think will pose any risk or issues unless there are some regulations where you may be connecting to spectrums that you aren't allowed to. I am an African too, living in South Africa that is where my accent is from using the "Afrikaans" language. I think many people think about Latvia when it comes to MikroTik. I really hope to see more MikroTiks being used globally because it is a really good piece of hardware and software for the price!

I'll definitely test it out and make a video on it sometime :D Thanks for the suggestion and appreciate the nice comment

Will definitely looking at creating a video aimed specifically at the CLI

Hi Ryan ports that aren't bridged will typically function as a single broadcast domain. Useful for connecting to upstream providers like ISPs that have a "dedicated" port each port will also be able to carry 4095 VLAN tags which get more useful in the ISP/Carrier space. And yes you do have the option to change things later on as the need arises.

Thank you ^^!

I honestly wish I could also get my hands on a hap ax2 or ax3 :D Feel free to comment on a video once you have them how the performance is! And thank you for the kind comment I really appreciate it.

@@TheNetworkBerg No problem, i have to see how long i have to wait, ax2 is available to order but i didn't see ax3. I will run a few test to see the performance and report back but i think it will work just fine, i never had problems with mikrotik.

@@kresimirpecar4925 they look BEAUTIFUL, I am very jealous :D!!!!

@@TheNetworkBerg I've been waiting for RB260GSP for over 10 months... And hAP ax2 is already sold out... Ax3 eta is unknown right now... AX2 is not yet available in south africa ?

@@kresimirpecar4925 AX2 is available, but not really. Since all big distributors have it sold out already and no time available for when new stock is available. So could be months :((((

Thank you for the nice comment, I truly appreciate it!

Sorry if you misunderstood or if I didn't make that part clear this is specifically if you run the default rules for incoming connections. Ie you have remote clients trying to initiate wireguard connectivity to you. Not the other way around. You can read more about it on the MikroTik Docs help.mikrotik.com/docs/display/ROS/WireGuard

Well, if you are on the "server" side of things, then yes, you need to allow that incoming connection on the mikrotik router. I just meant that as a client you do not have to. I personally use Wireguard for enabling IPv6 traffic (my ISP does not support IPv6 yet), and I never had to open anything, everything worked out of the box.

I wonder the same thing... Hope he answers. I will have my MikroTik soon, if I find out, I will reply again.

The WAN interface is supposed to be separate from the LAN, not bridged together. He set up a DHCP 'client' on the WAN interface to get an IP from his ISP, and set up a DHCP 'server' on the LAN interfaces (which are bridged to each other) to give out IP addresses to his LAN clients. Traffic from the WAN side must now flow through the router according to the firewall rules, to get to the LAN side.

Yes, you could run this as a transparent bridge and apply firewalling.

You could learn completely for free by downloading a CHR image and running that as a VM

Yes, you could run the x86 VM on Proxmox if you are interested in learning more about MikroTik and to play around with the OS, Networking, etc. You can download the ISO from here: mikrotik.com/download

@@TheNetworkBerg wow thank you ❤

If the interface is in a bridge, its considered a slave interface. You would need to remove eth1 from the ports (do not use "all" in ports)

You will use mangle rules to enforce packet markings to basically push traffic from a specific source out over a different gateway. The methods are still pretty similar between v6 and v7, biggest changes is how the routing tables are added. Will create an updated video sometime to demonstrate this process.

On the internet method shows by creating separate FIBs, You cannot mark a routing without it. but after I switch to newly created FIB routing table shows blank, So I'm bit confused whether this is like VRF a complete new routing instance? @@TheNetworkBerg

I don't see why not, pretty sure I have seen Atheros on MT as well.

I really couldn't say, you would have to ask the people who mounted them. Maybe free wifi for people who are parked there or someone who can't put cables in or over a road but they are using it as a wireless connection. I would probably just let your council / police department know about it since I don't think it is probably legal to mount wireless equipment to light poles.

@@TheNetworkBerg thank you very much for your reply. I thought it was kinda odd. You have a great day.

It's more about how much resources the devices has available for the session (connections) table, you could configure thousands of NAT rules, but it depends on if they are actually being used by the router. So if you want to port forward 70 ports to a host inside your network and you only use the NAT rule whenever needed it should be fine. But don't expect it being able to handle too many sessions where thousands of people connect at the same time for something like a web service.

@@TheNetworkBerg wow ok thx so much for coming back to me on this really Awesome what you doing on your channel. keep it going will make sure to shear your channel :)

Of course you can, you can sign up for something like DynDNS and use that to connect to with your router. Can then just setup a portforward rule on your WAN port and forward it internally so even if the IP changes everyone still knows what the FQDN is :)

@@TheNetworkBerg but i am connected in NAT.i have pay an aplication called "Port Forward" and he couldnt do me port forward.cos ISP have NAT.

Sorry to hear that Joe, any reason why you are done? There are definitely many alternatives depending on what you want to use the device for. Home use or business?

@@TheNetworkBerg My work gives out hAP2's when you hit your 90 days. It's kind of to get us to play with and get more comfortable with Mikrotiks, no one really does though. I have had mine for over a year now and it's mostly gathered dust. I have not deployed it here in my home network, as I spend 2 hours here, 4 hours there every few weeks trying to get it to work. Every time it ends with me not being able to even access it through Winbox. The past remedies of resetting the device are not working this time and doing the Netinstall has been futile. I have dumped hours upon hours into trying to get this thing to work. They really are awesome though, so much potential, just too complicated. I just got an OPNSense firewall spun up in a VM (in less than 2 hours) and this seems like the way to go.

@@TheNetworkBerg We do use them for some of our clients, but none of the engineers like to mess with them if they don't have to. Probably only 2 of the engineers set them up and deploy them.

@@TheNetworkBerg I have issues while trying to set it up. I have never been able to actually deploy it as I end up not being able to find it via Winbox, this is after some configuration via Winbox. I have gone through the process 7-8 times over the last year, I get frustrated with it and let it sit for a month or two then try again, same result. However, last week when I said I was officially done, apparently I bricked the device (not my words, but my coworkers as he is the most knowledgeable about Mikrotiks in our office). He gave me a new one, but I am not holding my breath that I am going to get a better outcome.

@@joeosint by losing access i imagine it is from configuring the firewall. mikrotik firewall is just GUI-fied iptables, which admittedly is very complicated. linux users already familiar with iptables will feel right at home though. for preventing losing access constantly, there is a safe mode toggle that snapshots your config when activated, and if winbox disconnects any changes in the config are rolled back to when safe mode was activated.

There is no benefit, it is just another private subnet that is available for personal use.

There isn't any benefit from using 172 instead of 192 other than preventing clients from 192 network accessing clients on 172 network and vice versa or/and just assigning 2 different networks or VLANs with unique rules. Scenario where you might need that, is if you have let's say smart TV and want to allow netflix and firmware updates on it, but prevent all access to and from internet to it or setup network for kids which deactivates internet access at certain time and/or days or restricts type of content your kids can access on the internet.

You don't have to use winbox, but it is a very useful tool for accessing a device on even its mac-address or to connect to a romon network. Personally I use the CLI a lot more than winbox, but that is more of a personal preference.

Fire away

@@TheNetworkBerg If for instance we block a porn site through mikrotik, but the wireless users on their mobile if they install any vpn app then they can open those pages.....so kids also might do that. Is there anyway in Mikrotik to drop all the packets that are out of my public ip... so believe if they connect to vpn then internet won't be available...

isn't

My favorite version of Windows, I still watch some videos from time to time where Bill Gates is dancing at the launch

Yikes indeed, great point! Luckily there are several other videos on the channel that focuses specifically on securing a MikroTik router which I can suggest watching this is just a pure intro😊

That's a shame you feel that way, what do you think would make the video less dull for you? You could also check out some other the other MT channels like TKSJA or The Network Trip and see if their style of video is more to your liking.

I never claimed it was open source, but I totally agree if you are looking for something that is open source then MikroTik is not it :)

Thanks for the suggestion, I think I just happened to forget to turn on capture cursor on OBS in this instance, although on the other side I have received complaints before that I am too busy with the cursor as well 😄