TPTito Pinardo Gutiérrez
← Back to the rack
Español
1U · ROUTERRB5009 · RouterOS 7 · 3 segments In production

Slot 1 of 25 in the rack · In production

1U unit · Home network

The MikroTik router

Audited on 06-09-2026

A MikroTik RB5009 replaces the ISP router: the fibre box is left as a plain bridge. It splits the house into segments, decides what can talk to what, opens the VPN to get in from outside and only lets in from the internet what has somewhere to go.

Why
The ISP router can't split networks, show what comes in or run my own VPN. With the MikroTik every rule is mine and documented.
How it's set up
Fibre → ISP box in bridge mode → MikroTik with PPPoE. Three segments: servers, wired home and Wi-Fi with the TV. WireGuard on the router itself.
What it taught me
Every firewall rule has a failure behind it: a fake certificate across the whole house, locking myself out, and a Wi-Fi that wouldn't connect.
  • 3network segments, each with its own DHCP
  • 3 stagesbefore blocking whoever keeps trying SSH
  • 1 ruleof badly scoped NAT broke HTTPS across the house
  • 0own services left on the ISP box and the AP

Inside the router

Everything coming into or leaving home goes through here. Pick a flow to see which rule decides each step.

Flows Pick one and follow the packet.

Outside home MikroTik RB5009 · and what hangs off it RouterOS 7 WAN and inbound Segments (VLANs) What sits behind Protection and automation Internet Fibre (bridge) Cloudflare Phone outside PPPoE Inbound NAT Firewall WireGuard Servers Wired home Wi-Fi · TV DHCP Wi-Fi AP Traefik DNS Plex Block lists Hairpin NAT IP script Management
Hermesvisiting the unit

Click a part or pick a flow. If you came from a skill, the parts where I use it are already lit.

      Someone opens this site
      1. Internet — A visitor asks for the site from anywhere in the world.
      2. Cloudflare — It reaches Cloudflare first, which has it cached or asks home for it.
      3. Fibre box in bridge mode — The request comes in over the fibre. The ISP box is only a bridge.
      4. PPPoE connection — The MikroTik receives it on the PPPoE connection, with the home public IP.
      5. Port forwarding (NAT) — A NAT rule forwards it to Traefik. Only for traffic coming in on the WAN: a failure taught me that condition.
      6. Firewall — The firewall lets it through because it's a connection with a known destination.
      7. Server segment — It enters the server segment.
      8. Traefik — Traefik gets it and sends it to the site's container.
      I get in from outside with the VPN
      1. My phone, away from home — I'm away from home, on mobile data.
      2. Internet — The phone opens the WireGuard tunnel to the home public IP.
      3. Fibre box in bridge mode — It comes in over the fibre.
      4. PPPoE connection — The MikroTik receives the encrypted packet.
      5. WireGuard VPN — WireGuard checks the phone's key and opens the tunnel. If the key doesn't match, it doesn't even answer.
      6. Firewall — The firewall treats the VPN like the admin segment.
      7. Server segment — From there I reach the server as if I were home.
      8. Router management — And the router management, which accepts connections from nowhere else.
      A phone joins the Wi-Fi
      1. Wi-Fi access point — A phone connects to the home access point.
      2. Wi-Fi, TV and alarm segment — The AP puts it in the Wi-Fi segment, the most isolated one.
      3. DHCP per segment — The router's DHCP gives it an address in that segment and the home DNS.
      4. Home DNS — Its DNS queries go to the home DNS, which blocks ads and trackers.
      5. Firewall — The firewall lets it out to the internet.
      6. PPPoE connection — Out through the PPPoE connection with the public IP.
      7. Fibre box in bridge mode — And over the fibre.
      8. Internet — The phone browses without being able to see the servers.
      A Wi-Fi device tries to get in
      1. Wi-Fi, TV and alarm segment — The TV, on the Wi-Fi segment, asks for the Plex library.
      2. Firewall — The firewall has an explicit exception for that: go ahead.
      3. Plex — Plex serves the film.
      4. Wi-Fi, TV and alarm segment — Now a device on the same segment tries to reach something else on the server.
      5. Firewall — The firewall looks for an exception. There isn't one.
      6. Server segment — The traffic never reaches the server segment.
      7. Firewall — It's silently dropped, no reply.
      8. Wi-Fi, TV and alarm segment — The device only sees what it's been allowed to see.
      Someone tries passwords over SSH
      1. Internet — An internet bot tries to log in over SSH, again and again.
      2. PPPoE connection — It reaches the router.
      3. Firewall — First attempt: the firewall writes its address on the first list, for a minute.
      4. Staged lists — If it comes back within that minute, it moves to the second list.
      5. Firewall — The third attempt in a row…
      6. Staged lists — …puts it on the block list for a day.
      7. Firewall — From then on, everything it sends is dropped unseen. I reviewed the order of the stages in the audit: the first packet mustn't skip all three at once.
      The ISP changes the IP
      1. PPPoE connection — The PPPoE connection renegotiates and a new public IP arrives.
      2. Dynamic IP script — The router script spots it on the WAN list.
      3. Hairpin NAT — It updates the hairpin NAT rules that had the old IP written in.
      4. Port forwarding (NAT) — And the forwards point to the right address again.
      5. Cloudflare — Outside, the server's sync job updates Cloudflare so the domains still point home.

      1. Internet

        Anyone, from anywhere.

      2. Fibre box in bridge mode

        The ISP box only turns fibre into Ethernet. No Wi-Fi, no DHCP, no UPnP or WPS: no services of its own.

      3. Cloudflare

        In front of the public sites: hides my home IP and filters attacks before they arrive.

      4. My phone, away from home

        On mobile data with the VPN, I join the network as if I were home.

      5. PPPoE connection

        The router authenticates with the ISP and gets the public IP, which changes now and then.

        • MikroTik

      6. Port forwarding (NAT)

        Only what has somewhere to go is forwarded: the web goes to Traefik and little else. Every rule is scoped to traffic coming in on the WAN.

        • MikroTik

      7. Firewall

        Decides what can talk to what. Between segments the default is no: only the documented exceptions.

        • MikroTik
        • Linux / SSH hardening

      8. WireGuard VPN

        Lives on the router itself: I moved it out of a container so getting in to fix the server doesn't depend on the server.

        • WireGuard
        • MikroTik

      9. Server segment

        The server and my admin PC. They can start connections towards the rest; the rest can't start them towards here.

        • VLANs

      10. Wired segment

        Home devices on cable. They can't get into the server segment.

        • VLANs

      11. Wi-Fi, TV and alarm segment

        Phones, the TV and the alarm. The most isolated one: it sees neither servers nor wired, except DNS and Plex.

        • VLANs

      12. DHCP per segment

        Each segment gets addresses from its own range, and all of them point at the home DNS.

        • MikroTik

      13. Wi-Fi access point

        The old ISP router, repurposed: it only broadcasts Wi-Fi into its segment. No DHCP, UPnP or WPS.

        • VLANs

      14. Traefik

        The only door to the public sites. It has its own unit in the rack.

      15. Home DNS

        Resolves internal names and blocks ads. It's the exception every segment can reach.

        • Technitium DNS

      16. Plex

        The other exception: the TV, on Wi-Fi, can watch the library.

      17. Staged lists

        Whoever opens new connections again and again goes onto a first list, then a second, and finally the block list for a day. A single attempt punishes no one.

        • MikroTik
        • Linux / SSH hardening

      18. Hairpin NAT

        So that, from inside the house, the public IP leads to the internal service just like from outside.

        • MikroTik

      19. Dynamic IP script

        When the ISP changes the public IP, a router script updates only the rules that depend on it.

        • MikroTik

      20. Router management

        Administration is only accepted from the server segment and the VPN, with TLS 1.2 and strong SSH crypto.

        • MikroTik
        • Linux / SSH hardening

      What I use from my skill tree

      Pick a skill: the parts where I use it light up on the map and I tell you what for.

      MikroTik
      RouterOS 7: PPPoE, NAT, a firewall with staged lists, DHCP per segment, scripts reacting to IP changes and restricted management.
      VLANs
      Three segments with an explicit access matrix: servers, wired home and Wi-Fi with the TV, the most isolated.
      WireGuard
      The VPN to get in from outside, on the router itself, with access equal to the admin segment.
      Technitium DNS
      The home DNS is the exception every segment can reach; each segment's DHCP announces it.
      Linux / SSH hardening
      Staged brute-force blocking, management only from inside or the VPN, TLS 1.2, strong SSH crypto and spare services switched off.

      Incident log

      Real failures. Read the symptom, pick the cause you think it was and see how it was fixed.

      1. #1

        Fake certificates across the house

        June 2026 · NAT

        From home, sites like Spotify showed a «self-signed» certificate error and Firefox wouldn't even allow an exception. From outside they were fine.

        What do you think was going on?

        Show the fix
        Cause
        The rule forwarding 443 to Traefik didn't say «only traffic coming in on the WAN». It caught inside traffic too, Traefik answered with its internal certificate and HSTS sites don't forgive.
        Fix
        Add the WAN interface condition to the rule and flush open connections so they were rebuilt with the new rule.
        Lesson
        Every forwarding rule carries its inbound interface. A rule that's too broad works… until it breaks something far from where it lives.

      2. #2

        I locked myself out

        14-08-2026 · firewall

        Minutes after adding brute-force protection to the Minecraft server, I couldn't get in to play myself.

        What do you think was going on?

        Show the fix
        Cause
        The staged pattern that works for SSH doesn't suit a game: the client opens several new connections when it starts, so it went through the three stages in seconds and landed on the block list for a whole day.
        Fix
        Take my address off the list and drop the rule for that service. Staged protection stays where it makes sense: admin access.
        Lesson
        A security rule is tested with legitimate traffic, not just with the attack. What works for one protocol doesn't work for another.

      3. #3

        A laptop that wouldn't join the Wi-Fi

        30-09-2026 · Wi-Fi

        A new laptop couldn't join the home Wi-Fi, and the VPN failed from the home Wi-Fi itself. Every other device was fine.

        What do you think was going on?

        Show the fix
        Cause
        The access point was plugged into the server segment's port, with an address that wasn't its own. On top of that, the ISP box had its own Wi-Fi on, competing with the home one.
        Fix
        Re-cable the AP to its port, check in the router's VLAN table that it was in its segment, and turn off the spare Wi-Fi, DHCP, UPnP and WPS on the ISP box and the AP.
        Lesson
        Check live, not in the docs: the AP's real IP wasn't the planned one. And switch off everything a device doesn't need: UPnP opens ports without asking and WPS can be brute-forced.

      4. #4

        My sites don't load on Saturdays

        10-10-2026 · outside my network

        One Saturday afternoon my sites wouldn't load from outside home. With the VPN, they did. The server was answering perfectly.

        What do you think was going on?

        Show the fix
        Cause
        On match days Spanish ISPs block Cloudflare IPs to cut pirate streams. My sites share those IPs. It wasn't my fault.
        Fix
        Check the origin bypassing Cloudflare and look at a public service that tracks the blocks. I considered dropping Cloudflare during matches or running a proxy elsewhere; I decided to do nothing: the block lifts on its own.
        Lesson
        Before touching anything, separate «my system is failing» from «something between the visitor and me is failing». Checking the origin directly settles it in a minute.

      Told in full in an article:

      How it was built

      1. June 2026

        Out with the ISP router

        • MikroTik RB5009 as the router, with its own PPPoE; the ISP box in bridge mode.
        • WireGuard moved from a container to the router itself: the VPN no longer depends on the server.
        • First failure, first lesson: HTTPS NAT scoped to the WAN.

      2. August 2026

        Segments and access matrix

        • The initial six-VLAN plan simplified to the three segments that were really needed.
        • A matrix of what can start connections towards what, confirmed live against the router.
        • Explicit exceptions: DNS for everyone and Plex for the TV.

      3. September 2026

        Audit and hardening

        • Order of the blocking stages reviewed, TLS 1.2 for management and strong SSH crypto.
        • September RouterOS security advisory: update to the fixed release in the same branch.
        • AP and fibre box cleaned up: no spare Wi-Fi, DHCP, UPnP or WPS.

      4. 18-10-2026

        A DMZ for what faces the internet

        • The public door and the game server, the only things that take connections from the internet, move to their own segment.
        • From there they only reach DNS, monitoring and, for the door, the services it publishes. The home network, nothing.
        • Changed live, without an outage, and then put into code.

      Decisions (and why)

      • Where the VPN lives

        On the router, not the server

        If the VPN depends on the server, when the server fails I can't get in to fix it. On the router it's there as long as there's internet.

      • How many segments

        Three, not six

        The original plan had six VLANs. Each one is a matrix of rules to maintain; three cover what matters: servers apart, the house apart and wireless, the most isolated.

      • What's open to the internet

        Only what has somewhere to go, scoped to the WAN

        Every open port is surface. The web comes in through Traefik and Cloudflare; internal panels aren't published: you reach them through the VPN.

      • What takes connections from the internet

        On its own segment

        If someone got in through the public door or a game server, the next step would be moving around the network. Isolated in a DMZ, they only see what they need to work.

      What I learned

      • Network rules fail far from where they live: a NAT rule was breaking HTTPS in the browser.
      • Test security rules with legitimate traffic, not only with the attack.
      • Check the device's real state before trusting the documentation.

      What's next

      • Get VPN hairpin working from the home Wi-Fi, which still doesn't.
      • Move the router configuration into code and review it with diffs, like the rest of the infrastructure.

      Shall we talk?

      I can walk through any of these decisions in detail in an interview.

      Download CV Get in touch ← Back to the rack

      Rebuilt from my network documentation: no addresses, ports, keys or device names.