The hAP (product code RB951Ui-2nD) is the plainest router-with-Wi-Fi in our list: five ethernet ports, one radio, PoE-out on the last port. It suits a small flat, a holiday home, or any spot where the cabling matters most and the Wi-Fi comes along for the ride.
Watch the port speed. In our catalogue the five ports on this model are 100 Mbit, not gigabit. If your line is 200 Mbit or faster you will not get it through this device, no matter how the script is written. Look at the hEX instead, or at a newer hAP if you want Wi-Fi in the same box.
The ports
Five ports, ether1 through ether5, all five at 100 Mbit. ether1 is the default WAN port as the catalogue records it; the other four go into the bridge and become your LAN. There is no SFP cage and no faster port.
ether5 has PoE-out. Because the catalogue knows that port as a powering port, the PoE-out per port field appears in the Bridge and ports section, with the settings auto-on, forced-on and off. That is how you power a separate access point or a camera over the same cable. What you need to know about voltage, cable length and the difference between passive PoE and 802.3af is in PoE-out.
Which ports join the bridge is set in Bridge and ports. Two internet connections work fine here: take ether1 and ether2 as WAN. See Multiple WAN connections.
The Wi-Fi
There is one radio, wlan1, on 2.4 GHz. No 5 GHz. That is the limit of this device as an access point straight away: 2.4 GHz is crowded, the channels overlap and the speed is low. For a few phones, a printer and some IoT gear it is enough; for video calls or streaming from the sofa it usually is not.
The catalogue puts this model on the old Wi-Fi package, wireless. You will notice that. The configurator writes lines under /interface wireless instead of /interface wifi, and the fields that belong only to the new package do not appear: no 802.11r fast roaming, no adjustable management frame protection, no band steering. In a repeater setup, station-bridge also only works when the other end is a MikroTik running the same package. See Wi-Fi settings and RouterOS packages.
With only one radio, the repeater role rebroadcasts through a virtual AP on that same radio. The configurator ticks that box for you; untick it and the repeater broadcasts nothing.
A small board, and little memory
The catalogue records 64 MB of memory for this model. The configurator therefore adds a note when it generates: RouterOS v7 runs on it, but there is not much room. So keep the configuration small, leave sections you do not use switched off, install no packages you do not need, and check what is left with /system resource print after pasting. If it fills up, RouterOS v6 is often calmer on a board like this.
The architecture is MIPSBE. Our catalogue does not record the licence level or the switch chip for this model, so this page does not state them. Look them up at MikroTik if you need them.
VLANs cost throughput here
This model is listed with hw_vlan: switch-menu. Its switch chip keeps the VLAN table under /interface ethernet switch, not in the bridge. Switch VLANs on in the configurator and the script uses bridge VLAN filtering. That works, but hardware offload goes off with it: VLAN traffic is then forwarded by the CPU instead of the switch chip. The configurator says so when it generates. On a 100 Mbit router that is usually still workable, but know that you are giving something up. See VLANs.
Which roles fit
- Home router: one network, internet, firewall, IPv6, Wi-Fi on 2.4 GHz.
- Access point or CAP: the hAP behind another router, everything bridged. As a CAP it gets its SSIDs from a CAPsMAN controller.
- Office router with VLANs: possible with five ports, but read the switch-chip paragraph above first.
- Wi-Fi repeater and Wireless CPE: both available, both on 2.4 GHz.
- Harden only (baseline): for a hAP that already runs and that you only want to lock down.
Only LTE / 5G router is greyed out, with the message that there is no LTE modem. Switch and Core router are still offered, because the configurator blocks them nowhere, but they are not meant for this device.
The quickest route to a working configuration
- Pick One device and search for
RB951Ui, so you do not land on the hAP ac lite or the hAP mini by accident. - Pick Home router.
- Fill in your internet connection: DHCP or PPPoE, optionally through a provider preset.
- At the Wi-Fi step, set your country and one SSID with WPA2 or WPA3.
- Set an admin password, reset the device and paste the script. See Using the script.
If the hAP sits behind an existing router as an access point, take the Access point role and give it a static management address so you can find it again.
What trips people up
- Expecting more than 100 Mbit. The speed test stalls around 90 Mbit, and that is not a setting you forgot; the ports are what they are.
- Looking for 5 GHz. That radio is not in there. Anyone who wants 5 GHz needs a different model.
- Switching too much on. With 64 MB of memory every extra section costs something. Containers, a hotspot and heavy firewall sets do not belong here.
- QoS with a queue tree. That turns FastTrack off and moves the work to the CPU. Fair sharing per host with CAKE or fq_codel is the better choice here. See Bandwidth (QoS).
- Losing the management address. If in doubt, switch on an offbridge port, which keeps one port outside the bridge with an address of its own. See Locked out.