RB5009

The RB5009 (part number RB5009UG+S+IN) is the router you reach for when an hAP or a hEX has become too small: eight gigabit ports, a faster WAN port, a 10 Gbit SFP+ cage and enough processor to actually push traffic through them. It suits an office, a server cabinet, a house on fibre faster than a gigabit, or a site where the router is also the VPN endpoint. There is no Wi-Fi in it; that comes from access points.

This model's data has been checked against real hardware.

The ports

• ether1, 2.5 Gbit: the WAN port by default, and the only copper port faster than a gigabit.
• ether2 to ether8, 1 Gbit: seven LAN ports.
• sfp-sfpplus1, 10 Gbit: for a DAC cable or a fibre module to a switch, a NAS or a hypervisor.

There is no PoE-out on this model, so the PoE-out per port field does not appear. Access points and cameras get their power from a PoE switch or an injector.

The layout you usually want: ether1 to the ISP, sfp-sfpplus1 as the uplink to your switch, and the gigabit ports for equipment hanging directly off the router. If you want two internet connections instead, pick a second port as WAN; see Multiple WAN connections. Joining two ports towards the same switch is possible as well, see Bonding.

The switch chip is an 88E6393. The configurator writes VLANs with bridge VLAN filtering, and the warning about lost hardware offload that older chips get does not appear on this model. See VLANs.

What it is good at, and where it runs out

A 64-bit ARM processor with 1 GB of memory and RouterOS licence level 5. That is a different class from the hEX and the hAP: long firewall lists, many VLANs, a heavy DHCP and DNS load and several tunnels at once are no trouble here, and there is room for sections that would show up immediately on a smaller box.

Honest about the limits: with FastTrack, routing largely bypasses the processor, but anything that switches FastTrack off hands the work back to the CPU. That goes for a queue tree with QoS and for VPN traffic. A WireGuard tunnel does not reach plain routing speed on this device either, though it carries noticeably more than on the small models. We do not print numbers, because they depend on your packet sizes, your rules and the number of connections. Measure it yourself, with /tool speed-test or with real traffic.

The second limit is the cabling: one 10 Gbit port and one 2.5 Gbit port. If you need several fast uplinks, you end up at a CCR.

Which roles fit

• Office router with VLANs: the usual choice. Separate networks for office, guests, IoT and management, with trunks to the switch and to the access points.
• Core router (CCR / RB5009): routed interfaces without a bridge, OSPF or BGP, static routes, a strict management ACL, no NAT and no fasttrack. This is the role for a router in a network where routing itself is the job. See OSPF, BGP and Static routes.
• VPN gateway: WireGuard for remote staff, or a tunnel to a second site. See WireGuard.
• Router + CAPsMAN: route and manage the Wi-Fi of every access point at the same time.
• Home router: perfectly reasonable, certainly on a line faster than a gigabit.
• Hotspot / guest portal and Harden only (baseline) are available too.

Roles that need a radio or a modem do not appear.

The quickest route to a working script

1. Choose One device, search for RB5009 and pick Office router with VLANs for an office, or Home router for a single network.
2. Fill in your internet connection on ether1.
3. Walk through the VLAN table: numbers, addresses, which VLAN is the management VLAN, and which port becomes the trunk to your switch.
4. Set an administrator password and limit management access to your management VLAN.
5. Reset, paste the script over a cable and log back in. See Using the script.

If there is more than one device, this router plus a switch plus access points for instance, use a site: Several devices. The full office build is in Example: office with VLANs.

What trips people up

• Picking the Core router role for an ordinary internet line. That role switches NAT and fasttrack off and assumes routed interfaces, so your LAN never reaches the internet. For an office behind an ISP line you want Office router with VLANs.
• Taking the SFP+ cage for granted. After pasting, check with /interface ethernet print that sfp-sfpplus1 has link; a module or DAC the other end refuses is not something a script can fix.
• 2.5 Gbit that turns out to be 1 Gbit. Both ends have to support it. Check what was negotiated with /interface ethernet monitor ether1 once.
• Leaving management open on every VLAN. On a router with eight ports and four networks, a management VLAN with a strict access list is half the work. See Management access.