hAP ac²

The hAP ac² (part number RBD52G-5HacD2HnD-TC) sits in countless meter cupboards: five gigabit ports, two radios, a price nothing could touch. As a home router on an ordinary line, or as an access point behind a bigger router, it still does the job. There are two things you should know about this model before you start, and either one costs you an evening if you find out afterwards.

This model's data has been checked against real hardware.

The ports

Five ethernet ports, ether1 to ether5, all 1 Gbit. ether1 is the WAN port by default. No SFP, nothing faster than a gigabit, and no PoE-out: the PoE-out per port field does not appear for this model. An access point on ether5 needs its own power supply or an injector.

The switch chip VLAN trap

The switch chip in this model (IPQ-4018, from the Atheros8327/QCA8337 family) keeps its VLAN table in a menu of its own: /interface ethernet switch. The configurator writes VLANs the v7 way, with bridge VLAN filtering. That works, but it takes the traffic off the switch chip: the CPU starts forwarding the VLAN packets and hardware offload is gone. A box that switched at wire speed suddenly does a great deal less.

The configurator says so itself as soon as you enable VLANs on this model. For full throughput on this chip the switch-chip configuration is the right route, and the tool does not write that one: you do it by hand in the switch menu. If you mainly want VLANs for a guest SSID and some IoT, the loss is not a practical problem.

See VLANs for what the tool does write, and Bridge and ports for the bridge around it.

Wi-Fi, and which package

Two radios: wlan1 on 2.4 GHz and wlan2 on 5 GHz. For this model the configurator writes the wireless package, so /interface wireless with a security profile, exactly as you know it from RouterOS v6.

This is one of the models that can run two Wi-Fi packages on v7: the familiar wireless, or wifi-qcom-ac with the new /interface wifi structure. They do not coexist. If wifi-qcom-ac is on the device after an upgrade, your Wi-Fi networks are gone while bridges, DHCP and leases are all still there, which makes it look as though the radios died. It is the most reported surprise on this model. The background, and the way back, are in From v6 to v7.

What that means for central management: /caps-man controls access points running the wireless package. If the access point runs wifi-qcom-ac, it belongs to /interface wifi capsman and has to be set up again. Do not mix the two within one site. See CAPsMAN.

What it is good at, and where it runs out

A 32-bit ARM processor with 128 MB of memory. That memory is this model's real limit. It is enough for a router with a firewall, DHCP, a DNS cache and Wi-Fi, but not for all of it at once: a long firewall list, many simultaneous connections, a large DNS cache and logging to disk all add up. Keep the configuration on this device simple, and switch off sections you do not use in advanced mode.

The CPU is the second limit. With FastTrack on, ordinary traffic goes around it and the box keeps up with a gigabit line. Switch QoS on with a queue tree and FastTrack goes off, so it shapes in software; the configurator estimates 200 to 300 Mbit/s there and suggests fair share per host with CAKE or fq_codel on this model instead, because that is one queue with no mangle rules. See Bandwidth (QoS). A WireGuard tunnel is encrypted entirely in software here and stays well below your line rate.

The RouterOS licence level is 4, which among other things decides how many tunnels you may run at once.

Which roles fit

• Home router: the role this device was sold for, and still the best fit.
• Access point or CAP: the obvious second career once a newer router takes over.
• Wi-Fi repeater: possible, at up to half the throughput.
• Office router with VLANs: workable, but read the switch chip section above first.
• Harden only (baseline): useful for an ac² that has run for years and that you do not want to rebuild, only close up.

The quickest route to a working script

1. Choose One device, search for ac2 and pick Home router, or Access point if a router is already in place.
2. Fill in your internet connection, or for an access point only the management address.
3. Fill in SSID, passphrase and country, plus an administrator password.
4. Check which Wi-Fi package is installed with /system package print before you paste.
5. Reset, paste the script over a cable and log back in. See Using the script.

The full route for a home router is in Example: replacing the ISP router.

What trips people up

• Wi-Fi gone after an upgrade. Nearly always the wrong package. Check /system package print; install wireless and import again, or deliberately choose wifi-qcom-ac and set the Wi-Fi up from scratch.
• Slow VLANs. Not a fault, but the offload falling away. See above.
• Memory gone. Check what is free with /system resource print before you switch on another section.
• Pasting the script over Wi-Fi. The radios are reconfigured during the import; use a cable.