If you're leaning towards Unifi, I'd say look more closely at the limitations. There are some basic scripting that I can do in RouterOS with Mikrotik that's just impossible with Unifi, and that turned me off from Unifi even though they have a super sleek interface. I do have an Ubiquiti 5ghz Nano thing that's powerful enough for long range wifi when I'm at the local park for a morning walk.
As an example for what I mean, let's say I have an IoT device that I cannot allow to use my external IP address, and it must always go through a VPN. But VPN's sometimes go stale and you need to reconnect to get it going again. So a script is in place that checks for newly connected but previously assigned DHCP leases, matching them against the IP Route configured for it, which then matches with the VPN autoconfigured from a pool, and it will disable and renable the VPN connection. And it'll do this every time DHCP expires and is reassigned, essentially keeping the VPN alive. There's another script that monitors VPN's when they go down and reconnects to another one from a pool. The IP route in place prevents internet access through the default main route when the VPN is disconnected or reconnecting.
This sort of stuff is just about impossible with Unifi, if you need scripting.
The other is QoS. Instead of VLAN's, I have subnets configured for different classes of devices. Mobiles/Tablets, Laptops/Desktops, IoT, Printers, Shares. Mobiles/Tablets get the highest priority regardless of the kind of traffic they want, then regular port 80 like traffic from all the other devices and at the lowest priority is everything else. Along with QoS is multiwan, I have multiple LTE failovers whenever the main connection goes down (usually during a power outtage).
One last thing I think is essential is dns destination nat. That's forcing any dns request made by a device on the network to go through my own dns server, which is pihole. Two of them, actually.
My wifi strategy is a single SSID for anything and everything, and have RouterOS determine what can be done based on the subnet assigned through static ip leases. I'm sure by now the wifi password has been spoofed, but the network I have planned accounts for that and limits anything that isn't explicitly defined to a guest network where the most realistic damage they can do is print until the ink runs out. It's not flawless and I know I have a lot to learn about network security. But it works well.
I can't even pretend to say that I know much about RouterOS, but anything I wanted to do was possible in some form, with scripting. And it was a surprise that this could not be done with something as elitist as Unifi. So I'd say look at the limitations and what you deem absolutely essential for your network.
You have explicit control on what devices can access what parts of the internal network and/or outside internet. With firewall rules, you can essentially block off all outside requests to your internal network outright. Here's what I have configured:
View attachment 106153
I have a very rudimentary knowledge about these firewall rules, but I can try and explain. If other members see that my explanation is wrong, please correct me. I would love to learn.
The fourth rule prevents any client that's not from any interface that's been classified as LAN, from accessing the router. As you can see, there's been 285k packets that's been dropped, that's basically people (I'm double nat'ed) and/or my ISP trying to access/snoop my router.
The fifth rule specifies that IoT/Cameras can only access the devices that interact with them. They can't access printers, shares or anything else.
The sixth rule limits what the Guest Network can access. It can't access anything that hasn't been allowed.
The ninth rule blocks fresh connections from outside clients from directly accessing clients in my internal network. No packets here means they have been blocked by the previous rules (these rules are in hierarchical order) or that I configured this rule wrong.
The last two rules allow the two pihole devices to have priority access to the internet without having to go through the firewall, this speeds up dns requests.
