RB5009UPr+S+IN (PoE)

The RB5009UPr+S+IN is the variant of the RB5009 that puts power on its ports. Seven of the eight ethernet ports supply PoE, the first port does 2.5 Gbit and there is a 10 Gbit SFP+ cage on it. That makes it one of the few devices that can power and route a complete small office from one box: access points, cameras, phones and desks on the same router.

There is no Wi-Fi in it. That is not a shortcoming but the point: this device belongs in a cabinet or a rack, and the Wi-Fi comes from the access points it powers.

The ports

• ether1: 2.5 Gbit, the default WAN port. This one does not supply power.
• ether2 through ether8: seven gigabit ports, all seven with PoE-out.
• sfp-sfpplus1: a 10 Gbit SFP+ cage, for fibre or a DAC cable to a switch or a server.

Because there are seven powering ports, the PoE-out per port field in Bridge and ports gives you seven rows, each with auto-on, forced-on or off. This is one of the places where this model really saves time: no injectors, no separate power supplies, and a per-port view of what is on. Read PoE-out and Cabling and PoE in practice before you switch seven devices on at once, because a PoE budget is finite.

The SFP+ cage is the obvious trunk to a switch, or the fast link to a server. See Bridge and ports. For two internet connections, ether1 plus the SFP+ cage is a comfortable pair; see Multiple WAN connections.

No Wi-Fi

There are no radios in this device. The Wi-Fi step does not appear in the wizard, and Access point, CAP, Wi-Fi repeater and Wireless CPE are greyed out with the message that there is no Wi-Fi radio. LTE / 5G router is greyed out too: no modem.

The practical answer is a site with several devices: this router, a few access points on the PoE ports, the same VLANs and SSIDs, one script per device and checks across the whole site. See Multiple devices. To manage those access points centrally, pick the Router + CAPsMAN role; see CAPsMAN.

What is inside

The catalogue records ARM 64bit, 1 GB of memory, the 88E6393 switch chip and RouterOS licence level 5. A 64-bit ARM with a gigabyte of memory is a different kind of device from the MIPS boards: there is room for containers, for a firewall that means something, and for routing with more than a handful of routes.

For VLANs there is no hw_vlan: switch-menu, so you do not get the note that bridge VLAN filtering turns hardware offload off. Bridge VLAN filtering is the ordinary route on this model, and with eight ports plus SFP+ a setup with desks, guests, IoT, cameras and management is comfortable. See VLANs and Planning VLANs.

The small-board note never appears here; the configurator only gives that at 64 MB of memory and below.

What it is good at, and where it runs out

Good at: routing with VLANs, a firewall worth the name, VPN tunnels, and powering seven devices. With a 2.5 Gbit WAN and an SFP+ cage it also fits a line above a gigabit.

Where it runs out: the PoE version shares one budget across seven ports, so a row of hungry access points or cameras can hit the ceiling. What the catalogue does not record, this page does not claim: our data holds nothing about throughput figures, encryption speed or the PoE budget for this model. Measure it, and do the sums, on your own unit.

Which roles fit

• Office router with VLANs: the default choice for this model.
• Router + CAPsMAN: routing and managing the Wi-Fi of the access points hanging off the PoE ports at the same time.
• VPN gateway: WireGuard or IKEv2 with enough CPU to do something with. See WireGuard and Site-to-site tunnels.
• Core router: routed interfaces without a bridge, with OSPF or BGP, no NAT and no fasttrack. See OSPF and BGP.
• Home router, Hotspot and Harden only (baseline): all available.

The quickest route to a working configuration

1. Pick One device and search for RB5009UPr. The plain RB5009 without PoE is a separate entry in the list.
2. Pick Office router with VLANs.
3. Fill in your internet connection on ether1, optionally through a provider preset.
4. At the VLAN step: mark the management VLAN and set the port towards your switch to trunk.
5. Go to Bridge and ports and set the PoE mode for each port that has something on it.
6. Set an admin password, reset the device and paste the script. See Using the script.

If this device sits in a network with switches and access points, Multiple devices is faster: you draw the cables on the network board and the cabling decides which ports become trunks.

What trips people up

• Grabbing the plain RB5009. Without the UPr letters the model has no PoE-out, and your script then carries lines for something that is not there.
• Expecting PoE on ether1. The WAN port does not supply power. The powering ports are ether2 through ether8.
• Going over the PoE budget. Seven ports with power is not the same as seven devices at full draw.
• An empty SFP+ cage. Without a matching module or DAC that port does not come up. Check with /interface ethernet print.
• Management on a desk VLAN. Send the management VLAN tagged towards your switch, never untagged to a desk. See VLAN checks.