MikroTik Competitive Review

Every small ISP knows the MikroTik playbook. A RouterBOARD or a CCR at the edge, PPPoE or IPoE bolted together from a DHCP server, a stack of simple queues, a FreeRADIUS box you maintain yourself, and — once you cross a few thousand subscribers — a second CCR. Then a third. It works. It's cheap. It's good enough.

"Good enough" has a price, and you already pay it:

• You scale by buying more boxes, not more capacity. A single MikroTik box saturates one CPU core on PPPoE/IPoE encapsulation and software queues somewhere in the 4,000–10,000 subscriber range. Past that, the field guidance is blunt: stand up another NAS. Real-world designs for larger operators reach for sixteen CCR-class boxes — each one an island, with its own state, its own failure domain, and no shared view.
• You are the systems integrator. RouterOS ships primitives — a DHCP server, a queue engine, a RADIUS client, Option 82 relay. The subscriber-management brain lives outside the box, in FreeRADIUS, Splynx, User-Manager, or accel-ppp. You wire them together, and you keep them wired.
• A restart is an outage. When the box reloads, the sessions go with it.
• The subscriber is a config line, not a session. RouterOS has no dynamic subscriber model; each service is hand-provisioned. It behaves like a very capable router. It does not behave like a BNG.

None of this is a knock on MikroTik's engineering — it is the honest consequence of a single-box, merged-plane router being asked to do a carrier's job. The question this review answers is simple: what if you didn't have to compromise?

The dividing line is architecture. A router forwards packets and runs its brain on the same CPU. A telco-grade BNG splits the two — a fast data plane that only forwards, and a separate control plane that does the thinking. That one decision is the difference between "add another box" and "add another node," between "restart drops everyone" and "restart drops no one." The Quantum IPoE BNG is built on the telco side of that line. MikroTik, by design, is not.

What "Telco-Grade" Actually Means

BlueDot's Quantum IPoE BNG is not a router with subscriber features added. It is a disaggregated BNG — the same architectural pattern the Juniper MX and Cisco ASR carry into the largest networks on earth — packaged to run on a commodity Dell R360-class server you can buy today.

The data plane is real forwarding silicon-speed software. Subscriber traffic runs through VPP on DPDK in userspace, driving Intel E810 NICs at line rate. Once a subscriber is online, every one of their packets is looked up, anti-spoof-checked, policed, and forwarded without the control plane ever touching it. This is what lets a single node carry on the order of 100,000 concurrent subscribers — an order of magnitude beyond a MikroTik box's ceiling, on one server.

The control plane is a separate brain. A controller holds the intelligence — the subscriber lifecycle state machine, an embedded DHCP server, the AAA client, accounting, and a durable session store — and talks to the data plane over gRPC. Because that link is gRPC, the controller can even run on a different machine from the forwarding node. In steady state the controller sees none of a connected subscriber's traffic; only two tiny packet classes are ever "punted" up — a new subscriber's DHCP, and an inbound RADIUS policy change.

Growth is horizontal — and shared. One controller can drive multiple data-plane nodes under one configuration. You add capacity by adding a node, not by cloning a whole independent router and hand-syncing its state. This is the difference between a fleet and a pile.

That is what "telco-grade" means here: separation of forwarding and intelligence, line-rate hardware-driven data path, and horizontal scale under a single control plane. It is an architecture, not a marketing adjective — and it is the one thing a single-box router cannot retrofit.

Head to Head

Every Quantum claim below is drawn from the published Quantum IPoE BNG and QuantumTouch Theory-of-Operations. Every MikroTik claim was validated against current RouterOS 7 documentation — we deliberately do not fight on any point RouterOS has already closed.

Four of these deserve more than a table cell.

Scale that grows sideways, not by forklift. MikroTik's own community reaches for sixteen CCR-class boxes to serve a large FTTH base, each a separate island of state. Quantum's data plane is built to carry ~100k subscribers on one node, and to add the next 100k by attaching another node to the same controller and the same operator view. You stop buying routers and start adding capacity.

Restarts and upgrades stop being outages. Because the controller and data plane are separate processes, Quantum treats session state as durable — written on every change, with live timers rebuilt from stored deadlines. A controller restart re-attaches to a data plane that never stopped forwarding. And a package upgrade preserves every live session — you patch the box without knocking your paying subscribers offline. On a single-box router, that is simply not possible.

Policy that follows the live subscriber. On RouterOS, RADIUS CoA cannot change a subscriber's address, pool, or routes mid-session — those need a disconnect and reconnect. Quantum re-rates a connected subscriber in place, today: edit a plan and the controller walks the session table and updates every affected subscriber's data-plane limiter — no re-DHCP, no interruption. Upsells, throttles, and plan changes happen without the customer noticing a blip.

Operations that come in the box. This is where "good enough" hurts most quietly. With MikroTik you assemble your NOC from parts. Quantum ships QuantumTouch, a single-pane operator plane: a guided setup wizard, live dashboards on a five-second heartbeat, per-subscriber green/yellow/red analytics, a unified audit timeline merged from four sources and shipped off-box to your SIEM (syslog/TLS, HTTP, or S3, at-least-once), configuration snapshots with content-hashing, structured diff and signed export, ~65 Prometheus series for your existing Grafana, and real security posture — reveal-once API keys with roles, MFA, SAML/LDAP, managed TLS with ACME, and signed security webhooks. That is a telco NOC's toolkit, standard, not a weekend of glue code.

Honest About the Alpha — On Purpose

A marketing sheet that hides the caveats is one you can't trust with your subscribers. So here is exactly where this Community-Edition Alpha stops short today — the same list our own Theory-of-Operations publishes:

• IPv4 only, this release. IPv6 — dual-stack, DHCPv6, prefix delegation — is on the roadmap, not in this build. If you need IPv6 in production today, note that current RouterOS already does it — that is a real, honest consideration, and we will not pretend otherwise. Quantum's IPv6 is coming; it is not here yet.
• Authentication is local in this build. The production RADIUS client — live sockets, dual-server failover, the CoA listener, RADIUS accounting on the wire — is the defined next addition. Today the box runs a local AAA provider and can operate standalone with no RADIUS server at all. That is not a weakness for a small operator — it is the free-tier on-ramp: stand up a working BNG with zero external dependencies, and federate into RADIUS when the client lands.
• Single-node operator plane, ~100k per node this release. One QuantumTouch process runs one box; the data-plane node targets ~100k subscribers now, with a path to 400k–500k per node later. Horizontal data-plane growth under one controller is in the architecture today.
• Policing, not shaping. Rate control is RFC 2698 two-rate/three-colour policing — the same model, done richer, with per-colour accounting a queue-based box doesn't give you.

Notice what this list is: a set of seams between a focused Alpha and the full product, each with a defined path forward — not architectural dead-ends. The hard part, the part you cannot bolt on later, is already done and running: the separated data and control planes, the line-rate forwarding, the durable sessions, the live re-rate, and the operator plane. We built the telco-grade foundation first and are honest about the trim still going on. MikroTik built a superb router and asks you to pretend it's a BNG.

The Bottom Line

For a decade, the small ISP's only realistic BNG was a router doing its best impression of one — and "good enough" was the ceiling. The Quantum IPoE BNG moves that ceiling to the floor:

• Start free, standalone, today — no RADIUS, no external stack, on commodity hardware.
• Run a real BNG, not a router pretending — dynamic sessions, per-packet anti-spoofing, live re-rate, durable state.
• Grow sideways — add nodes under one controller instead of buying and babysitting another island.
• Operate like a carrier — one pane, real audit, SIEM shipping, snapshots, RBAC — in the box, not in your spare time.

The compromise was never your fault; it was the only option. It isn't anymore.

Try the Community Edition. Stand it up on a spare R360-class server, point an edge router at it, and watch 100,000-subscriber architecture carry your first hundred. When you're ready, the production RADIUS client, IPv6, and multi-node scale are the roadmap — on the same telco-grade foundation you started on.

Quantum capabilities in this review are sourced from the BlueDot Quantum IPoE BNG and QuantumTouch Theory-of-Operations (Community Edition, Alpha, July 2026). MikroTik statements reflect current RouterOS 7 documentation and public community deployment experience, validated for this review; we intentionally omit any claim RouterOS has already addressed. "Telco-grade" refers to architecture — separation of control and data planes, line-rate forwarding, and horizontal scale — not to a certification. © 2026 BlueDot Insight LLC. BlueDot Proprietary.