So, would that be the purpose of having a Vlan 99? To set more restrictive rules to access the Mikrotik device itself?

I think yes, because access to the network devices and their configuration should definitely be limited to the administrator.

The purpose of dividing a network into VLANs is, among other things, to control the access rights of certain devices and their users via the firewall.
This also includes access to the network devices themselves, which should be set as restrictively as possible.

Regarding your question how to implement QoS on your router, there are several MuM presentations available, e.g. https://mum.mikrotik.com/presentations/IT14/giordano.pdf If you have customers paying for and relying on you as an ISP, you may think about how to acquire redundancy for internet access. ...

Yes, chip-shortage makes it a little bit difficult right now.
The successor RB5009 is available here
https://www.eurodk.de/de/products/mt-rb ... 009ug-s-in

There, the RB4011 is available as of 4.1.22.

Of course, I was referring to the 'Control Bridge' feature I mentioned before, which is completely irrelevant here.

Yes, anav, you are right. I like this feature somehow, but it is only feasible between switches anyway.

@spynapples, for TO's scenario, would you recommend using the MTK 'Controller Bridge and Port Extender' feature?

https://help.mikrotik.com/docs/display/ ... t+Extender

This would make it possible to manage everything only on the router.

Because he is looking for a switch: If there are some extra centimeters left he could use the CRS112, there is also a POE version available: https://mikrotik.com/product/crs112_8p_4s_in If you need higher throughput, but without POE version as of yet: https://mikrotik.com/product/css610_8g_2s_in Ano...

Hello @sirbryan, it would be very courteous if you could share your experiences with your two new devices (CCR2004 and RB5009) here in the forum.
I could imagine that their comparison to your other devices would be very interesting for many readers.

Another downside to the CSS610 is that it won't be available again until March 2022. Supply chains are really a problem. https://www.eurodk.de/de/products/crs/cloud-smart-switch-610-8g-2s-in However, the outdoor version is available, as of today. https://www.eurodk.de/de/products/crs/cloud-smart-swi...

Very nice what features one gets to discover here in the forum. Many thanks for that.

Unfortunately, often only because they do not work.

Yes, I have to keep existing tunnels for legacy reasons. If speed is an issue and I would be free to choose, some other VPN types already exist in ROS.

Not really, I'm glad that ROS supports OpenVPN, because this way the VPN endpoint is where my firewall is.

However, to get more features for the same price would always be nice, but it works for me as it is without any problems.
And improvement will come, not so bad.

No, OpenVPN works okay for me. Using TCP gives some speed penalty, not so important for my use case. Missing support for route pushing can be easily bypassed in the user policies. OpenVPN server will be improved with RouterOS V7.1, which is, however, not ready yet. Wireguard support is added there, ...

Isn't your scenario what is explained in this document (shared by @anav):

https://mum.mikrotik.com/presentations/US12/steve.pdf

After ROSv7.1 gets stabilized, you might want to keep using yor CRS328 as router with its L3 HW offloading vastly improving routing speed in certain conditions. @mkx, thanks for the tip, L3 HW Offloading looks very promising. However 1. it looks like some tinkering because of the numerous constrain...

I am faced with the same decision. For me (maybe for you too) the CCR2004-16G-2S+ would fit better as the network still uses Cat6A. But until the severe problems with the CCR2004-1G-12S+2XS are solved, I won't buy the CCR2004-16G-2S+ with the same CPU. Especially since it only runs with a special RO...

I have implemented exactly your idea with my Mikrotik router, which sits behind an AVM Fritzbox as a pure DSL modem and controls several other AVM Fritzboxes used as WLAN access points, WLAN repeaters, subswitches and DECT telephone system in different VLANs. I followed this approach: "Mikrotik...

As you may have seen in

viewtopic.php?f=3&t=164578

there is no solution for this problem since more than a year.

The only workaround seems to be a scheduled reboots.

Probably in a moment someone will recommend you not to write novellas, but to paste your config here.

This is also a very important question for me. I am faced with the question of whether to purchase a CCR2004-16G-2S+. However, looking at the thread about the problems with the CCR2004-1G-12S+2XS, there's no way I'm going to do that. The reboot problem has not been causally fixed after over a year n...