hEX lite (RB750r3)

The hEX lite (product code RB750r3) is the smallest wired router in the catalogue: five ethernet ports in a plastic case, no Wi-Fi, no SFP. It fits where the Wi-Fi comes from somewhere else and the router only has to route: a second site, a cabinet, a classroom, a small business on a hundred megabit line.

Note the difference with the ordinary hEX. That one has five gigabit ports, this one has five 100 Mbit ports. It is the only difference you feel, and it is a big one.

The ports

Five ethernet ports, ether1 to ether5, all 100 Mbit. ether1 is the default WAN port; the other four go into the bridge and form your LAN. No SFP, no PoE-in, no PoE-out, so the PoE-out per port field does not appear for this model, and you power it with the adapter.

Those 100 Mbit are this device's ceiling. If your line is faster, this router is the bottleneck no matter how good the rest is. That is not a setting: there is no gigabit in the port. See also Checks about speed. If you want gigabit in the same format, the hEX is the successor and the hEX S the one with an SFP port added.

Four LAN ports is usually enough for a router: one to the switch, one to an access point, two left over. If you need to plug in more, put a switch behind it and use one port as a trunk. Which ports end up in the bridge is covered in Bridge and ports, and separating networks over those same cables in VLANs.

Two internet connections are possible: take ether1 and ether2 as WAN and leave the rest as LAN. See Several uplinks: failover and load balancing. Keep in mind that two hundred megabit lines still share one processor.

No Wi-Fi

There are no radios in it. The Wi-Fi step in the wizard therefore does not appear, and the roles that need a radio (access point, CAP, Wi-Fi repeater, wireless CPE) are not offered. If you want Wi-Fi, put a separate access point behind the hEX lite.

The tidy way to do that in one go is a site with several devices: the hEX lite as the router, one or more access points behind it, with the same VLANs, SSIDs and passphrase, and one script per device. See Multiple devices in one site. This router can also be the controller for those access points: pick the Router + CAPsMAN role, or switch the CAPsMAN block on top of an ordinary router role. See CAPsMAN.

What is inside, and a word about the article number

This board has 64 MB of memory, 16 MB of storage and a MIPSBE processor (QCA9533). That puts it under the line where the configurator says RouterOS v7 runs but there is not much room: keep the configuration small, do not install packages you are not using, and check what is left with /system resource print after applying it.

Mind the numbering. We sell this as RB750r3, while MikroTik only ever published an RB750r2; our supplier's own product name says so as well. It is the same board: five 100 Mbit ports, the same processor. The specifications on this page therefore come from MikroTik's RB750r2 page. If you are looking for firmware or documentation, search for RB750r2.

What the catalogue does not record is the switch chip and the licence level, so those are not quoted here.

What it is good at, and where it runs out

Good at: NAT, firewall, DHCP, DNS cache, IPv6 and a handful of port forwards on a quiet line. For a small network it does exactly what it should, and as long as the firewall uses FastTrack most traffic goes around the processor.

It runs out the moment traffic does have to go through the processor. That happens with a queue tree for QoS (FastTrack goes off then) and with VPN tunnels, which are encrypted in software here. We quote no throughput figures: they depend on your rules, your connections and your packet sizes. Measure it on your own device.

Which roles fit

• Home router: internet, one network, firewall, IPv6, without a Wi-Fi step.
• Office router with VLANs: five ports is plenty for a WAN, a few desks and a trunk to a switch.
• VPN gateway: as an endpoint at a second site. See WireGuard and Tunnels between locations. Expect software encryption, so modest speeds.
• Router + CAPsMAN: routing plus managing the Wi-Fi of separate access points.
• Harden only (baseline): for a hEX lite that already runs and that you only want to lock down.

The Access point, CAP, Wi-Fi repeater, Wireless CPE and LTE / 5G router roles do not appear: no radio, no modem.

The quickest route to a working configuration

1. Pick One device, search for hEX lite and make sure you take the RB750r3 and not the hEX or the hEX S.
2. Pick Home router for one network, or Office router with VLANs if you want guests and desks separated.
3. Fill in your internet connection: DHCP or PPPoE, optionally through a provider preset. See WAN: the connection to the internet.
4. Set an admin password, reset the device and paste the script. See Using the script.

A whole office from start to finish is in Example: an office with VLANs, a switch and access points.

What trips people up

• Assuming it is gigabit. The name looks like the hEX, the ports do not. If you measure 94 Mbit, that is this device's maximum.
• Picking the wrong model. hEX, hEX lite and hEX S are three different catalogue rows with different ports. Pick the wrong one and your script has lines for a port that is not there.
• Expecting Wi-Fi. There is no radio in it. Plan the access point in rather than improvising it later.
• QoS on a line that is already full. A queue tree turns FastTrack off and puts the work on the processor. See QoS and bandwidth.
• An ISP router that keeps routing. Put it in bridge mode, or you sit behind two layers of NAT and port forwarding will not work. See Replacing your ISP router.