MikroTik Home Network Lab

A real-world home network built on a MikroTik hAP ax² (RouterOS 7), documenting dual-WAN load balancing, hardening, monitoring, and an in-depth investigation into VPN protocol blocking on a heavily filtered ISP.

This isn't a tutorial written top-down — it's a log of what was actually built, what broke, and what the router's own behavior revealed about the network it sits on. Real values (IPs, ports, credentials, keys) have been replaced with placeholders throughout; the RouterOS commands themselves are unedited.

Hardware / environment

• Router: MikroTik hAP ax² (ARM64, 1GB RAM, 128MB flash — no USB port)
• RouterOS: 7.23.x
• WAN 1: Fixed-line ISP, modem in DMZ mode, static LAN-side IP
• WAN 2: Mobile-carrier ISP via modem bridge, DHCP, no static IP
• LAN: One wired management port + one 2.4GHz WiFi 6 network

Topology

flowchart LR
    subgraph WAN
        ISP1[("ISP 1 — DMZ modem\nstatic IP")]
        ISP2[("ISP 2 — bridged modem\nDHCP, off-subnet gateway")]
    end
    subgraph Router["MikroTik hAP ax²"]
        E1[ether1]
        E2[ether2]
        E3[ether3 — mgmt]
        BR[bridge1]
    end
    subgraph LAN
        MGMT[Management PC]
        WIFI[WiFi clients]
    end

    ISP1 --- E1
    ISP2 --- E2
    E3 --- MGMT
    BR --- WIFI
    E1 --> Router
    E2 --> Router
    Router --> BR

Loading

Contents

Doc	What's in it
01 — Dual-WAN Load Balancing	ECMP setup, an off-subnet DHCP gateway that silently blackholed traffic, and a PCC race condition that dropped brand-new clients
02 — Security Hardening	Firewall from scratch, service lockdown, non-default management ports
03 — DNS Resilience & Ad-Blocking	Dual DNS (international + national fallback), ~8k-domain DNS-level ad block
04 — QoS	Stateless packet-mark priority queueing (and why it's stateless on purpose)
05 — Monitoring & Alerting	Live traffic graphs, WAN-down email alerts, a rolling security digest, graduated auto-blacklisting
06 — VPN Blocking Investigation	WireGuard, OpenVPN (TCP+UDP), and a from-scratch containerized Xray/Reality client — what got through and what didn't
07 — Automated Backups	Weekly config export, emailed off-box
08 — Guest Network & Honeypot	Per-client rate limiting, a ping-to-reset data quota built from Simple Queues, and turning a leaked guest password into a deliberate honeypot

Notable findings

• A "connected" DHCP-assigned gateway can be silently unreachable. RouterOS requires a gateway to resolve through a connected route before a static route depending on it is considered active — an off-subnet gateway (common on some mobile/LTE bridge setups) fails this silently. See doc 01.
• PCC (per-connection-classifier) mangle marking can race under connection bursts. A device joining WiFi and opening many connections at once could get connections stuck indefinitely — invisible in normal use, only surfacing under burst load. Switched to plain ECMP. See doc 01.
• WireGuard and OpenVPN (TCP and UDP) were both actively disrupted on this connection — not dropped outright, but allowed to start a handshake and then killed mid-negotiation, the signature of active DPI rather than a simple port/IP block. Plain TLS to the same host on the same path was unaffected. Full writeup in doc 06.
• A blacklist rule placed before the established/related check drops legitimate traffic, not just attackers. A major CDN's edge IP got auto-blacklisted by the scan-detector in doc 02, and because the FORWARD chain checked the blacklist before established connections, active sessions to that address were cut mid-stream — the fix was realizing the rule was redundant on that chain and removing it, not reordering it.

Disclaimer

This is a personal home lab writeup, not a hardened commercial deployment guide. Config snippets are illustrative — review anything before running it against your own equipment.