The hEX (part number RB750Gr3) is MikroTik's small wired router: five gigabit ports in a plastic case, no Wi-Fi. It fits when the Wi-Fi comes from somewhere else, ceiling access points for instance, or when you need a router that only routes: a second location, a VPN endpoint, a test bench, a cabinet where no antenna belongs.
If you want an SFP port or PoE-out as well, look at the hEX S: same size, more connections. If you need Wi-Fi in the same box, an hAP model suits you better.
The ports
Five ethernet ports, ether1 to ether5, all 1 Gbit. ether1 is the WAN port by default; the other four go into the bridge and form your LAN. That is all of it: no SFP, nothing faster than a gigabit, and no PoE-out, so the PoE-out per port field does not appear for this model.
Four LAN ports sounds thin, but for a router it is usually enough: one goes to the switch, one to an access point, and you still have two left. If you need more sockets, put a switch behind it and use a port as a trunk. See Bridge and ports for which ports join the bridge, and VLANs for separating networks over those same cables.
Two internet connections work fine on this model: take ether1 and ether2 as WAN and leave the rest as LAN. How failover and distribution behave is in Multiple WAN connections.
No Wi-Fi
There are no radios. The Wi-Fi step in the wizard therefore does not appear, and the roles that need a radio (access point, CAP, repeater, wireless CPE) are not offered. That is a choice rather than a shortcoming: a router in the meter cupboard is rarely in the right place for Wi-Fi anyway.
To add Wi-Fi, put a separate access point behind the hEX. The practical way to get that right in one go is a site with several devices: the hEX as router, one or more access points behind it, sharing VLANs and SSIDs, with one script per device. See Several devices, and CAPsMAN if you want to manage those access points centrally. The hEX can be that controller: pick the Router + CAPsMAN role, or add the CAPsMAN controller block to an ordinary router role.
What it is good at, and where it runs out
For an ordinary household or a small office on a gigabit line, this router does exactly what it should: NAT, firewall, DHCP, DNS cache, IPv6, a handful of port forwards. As long as the firewall uses FastTrack, most traffic goes around the processor and you never notice the CPU.
The ceiling appears the moment traffic does have to pass through the CPU. That happens in three cases: with a queue tree for QoS (FastTrack goes off, and the configurator warns that this costs throughput on small routers such as the hEX), with VPN tunnels, which are encrypted in software here, and with an internet connection faster than a gigabit, which these ports could not carry in the first place.
We do not quote throughput figures. They depend on your rules, your connections and your packet sizes, and a number from a datasheet says little about your network. Measure it on your own device. Our catalogue also lists only the ports and the default configuration for this model, and we would rather leave out what we cannot confirm.
Which roles fit
- Home router: internet, one network, firewall, IPv6, without a Wi-Fi step.
- Office router with VLANs: five ports are enough for a WAN, some desks and a trunk to a switch.
- VPN gateway: a common role for this model, as a WireGuard endpoint at a second location for example. See WireGuard and Site to site tunnels.
- Router + CAPsMAN: the hEX routes and manages the Wi-Fi of separate access points.
- Harden only (baseline): for a hEX that already runs and that you only want to close up.
The Access point, CAP, Wi-Fi repeater, Wireless CPE and LTE / 5G router roles do not appear: no radio, no modem.
The quickest route to a working script
- Choose One device, search for
hEXand make sure you pick the RB750Gr3 and not the hEX S. - Pick Home router for one network, or Office router with VLANs if guests and desks should be separated.
- Fill in your internet connection: DHCP or PPPoE, optionally through a provider preset.
- Set an administrator password, reset the device and paste the script. See Using the script.
For an office with VLANs the whole route is written out in Example: office with VLANs.
What trips people up
- Picking the wrong hEX. The hEX S has an SFP port and PoE-out on
ether5; the RB750Gr3 has neither. Choose the wrong one and your script configures a port that is not there. - Expecting Wi-Fi. There is no radio in this device. Plan the access point in from the start instead of improvising it later.
- QoS on a fast line. A queue tree switches FastTrack off and hands the work to the CPU. On a router this size, fair share per host with CAKE or fq_codel is almost always the better choice. See Bandwidth (QoS).
- An old ISP router that keeps routing. Put it in bridge, or you sit behind two layers of NAT and port forwarding will not work.