The Setup, For Context
If you've been following the homelab posts, you already know the chain: MikroTik hits the internet first, does the firewall and NAT work, then hands things off to Traefik, which routes to the right Docker container. It's been solid. But recently I went digging into what router I actually own, and it turned into a small identity crisis.
Wait, Which hEX Do I Even Have
I bought my MikroTik hEX about two years ago for around 3,000 pesos, and I was fairly sure I'd gotten the newer "refresh" model. Turns out I didn't. What I have is the classic RB750Gr3: dual core, 880MHz, 256MB RAM. The refresh model (E50UG) runs a newer ARM SoC with double the RAM at 512MB, and MikroTik claims 100 to 134 percent better performance depending on configuration. Both were sold at the same price point, which stings a little in hindsight.
Here's the part that actually matters for how I use it, though. The refresh model has a wider internal backplane, which means LAN to LAN traffic can stay on the switch chip entirely and only WAN facing traffic has to touch the CPU. On my current classic hEX, I don't have that separation, so under heavier NAT or firewall rule load, LAN throughput and WAN throughput are competing for the same CPU cycles. For a home network pushing a handful of self hosted services, it hasn't been a dealbreaker, but it explains some of the sluggishness I've noticed when several services are getting hit at once.
Option 1: A MikroTik With a Built In WiFi Module
Right now my WiFi isn't handled by the MikroTik at all. I've got a TP-Link access point plus an extender to stretch coverage across the house. It works, mostly, except for one real problem: when I'm connected to the extended WiFi, I can't reach Immich. Immich runs on a different machine than my Traefik proxy, and something about how the extender bridges traffic breaks that path. Normally I'd fix this the way I fixed hairpin NAT before, with a DNS override, but the TP-Link extender in extended mode won't let me set its own DNS server. So there's no workaround here, just a hard limitation of the hardware. I either avoid the extended network for that service or replace the setup entirely.
A MikroTik unit with an integrated WiFi module would let me collapse the WiFi and firewall into one device, one routing table, one source of truth for how traffic moves. Since the MikroTik itself would be handling DNS at that point, the whole class of problem goes away, no extender in the path to fight with. The catch is price. These units cost noticeably more than a plain wired hEX, and I'd be paying for a feature (long range WiFi coverage) that a dedicated access point usually handles better anyway.
Option 2: Just Lean Into Gigabit
This one's a bit less exciting on paper than I initially thought, mostly because I learned partway through weighing this out that my current hEX already comes with 5x Gigabit Ethernet ports out of the box. So it was never really about acquiring gigabit ports, it's about whether I can actually use them at full capacity. And the honest answer is that inside my LAN, gigabit is genuinely useful (large file transfers, Immich syncing photos, backups between machines), but on the WAN side, my PLDT plan tops out at 500mbps, so a chunk of that bandwidth headroom is only ever going to matter locally. Not a wasted upgrade path, just one where the benefit is narrower than it first sounds. If I do go this route, it'd really be about the refresh model's better internal switching, not "getting" gigabit I already technically have.
Option 3: Mini PC Plus OPNsense
This is the option I keep coming back to, mostly because I want to learn it more than because I strictly need it. The idea is to retire the MikroTik as the edge firewall and replace it with a small dedicated PC running OPNsense.
Honestly, I don't have any hands on experience with OPNsense yet, so this is more curiosity than plan. I know it handles NAT and firewalling conceptually the same way MikroTik does, but I'd be relearning the whole interface from scratch, figuring out port forwards, firewall rules, and probably some hairpin NAT style issue all over again, just under a different name. I'm also not sure whether Traefik could reasonably live on the same box as OPNsense, or if it's better kept on its own machine like it is now. All of that is stuff I'd only really understand once I actually install it and start clicking around.
Where I'm Landing, For Now
Nothing here is urgent, though the Immich over extended WiFi issue is more real than I initially gave it credit for since there's genuinely no fix without changing hardware. Between the three options, the OPNsense mini PC route is the one I actually want to try, mostly for the learning curve, though a WiFi capable MikroTik would solve the Immich problem more directly. Worst case, I keep the MikroTik as a backup firewall and treat the whole thing as a weekend project rather than a network migration.