r/mikrotik

Hex refresh basic setup

I just redid my home network. I have a hex refresh as my router. Port one is wan. Port 2 has my PC. Port 3 goes to a Netgear POE switch. Off that I have two unifi APs and a reolink camera. I didnt change anything in the router settings, just pluged it in. Everything is working fine. But I pay for 400/400 from Verizon FiOS. I'm getting 250/90 on my PC using Google's speed test. Are there any simple settings changes I can make or any configuration changes to up those numbers? I've read some stuff on here of using port 2 as wan as something is up with the port 1 routing? I'm not an expert but understand a little. Thanks in advance

reddit.com
u/NateDogg2289 — 10 hours ago
▲ 115 r/mikrotik

Deployed Wap AX at my parents home in France

Simple setup, indoor Wap acting as CAPman manager outdoor Wap is managed by indoor one (makes making changes easier if things go wrong). Both just bridge to the ISPs router which also has 6Ghz ax WiFi. House is a old farm house with walls over 80cm thick in some parts so they needed more than one AP.

u/chimbosonic — 17 hours ago

hAP ax S Vs hAP ax 3

I need a switch/WiFi combo to provide wired connectivity to a number of devices and also provide WiFi. I'll have a single cat6a acting as an uplink to a mikrotik switch.

I won't be doing firewalling or routing. Most I will do is tagged vlans on ports and WiFi ssids. Routing, firewalling, DHCP services etc will be handled by a RB5009.

On paper at least the S has superior WiFi performance, but uses a Mediatek chip Vs the 3 which uses Qualcomm. I've read Qualcomm chips are the wiser choice, but my knowledge might be outdated.

Which would you choose?

Thanks

reddit.com
u/DiscoDave86 — 17 hours ago

[RB941-2nD] Travelrouter replacement

Every year we use a RB941-2nD as travel router. The Routerboard is connected as Wifi client to the WiFi network of the house we rent and it acts as AP for al wireless devices we bring with us. Because of this we don`t need to modify the chromecasts for example,they just work because they think there at home. I can also create a tunnel to home if i wanted to.

But the RB941-2nD is getting old, only 2.4ghz and updating is not always woking because of 7.3mb of freespace and the updates needs 7.5mb :-)

The advantage of this setup is that the unit is living in my laptop bag rent free.

What should be the upgrade?

reddit.com
u/raymonvdm — 22 hours ago

2x hAP be3 as purely AP bridges vs Unifi U7-pro

I know a lot of people will be using the be3 as an all in one home router. But I'm trying to shed my unifi system and I'm wondering what sort of experience I can get from using multiple hAP be3 as my primary APs in a residential setting.

This is not about just saying mikrotik lags in wifi. I'm more interested in relevant experience of this new product. Will it perform as well? Does it have features like handoff, or mesh? Anyone know of any performance testing vs the unifi?

reddit.com
u/anixon604 — 1 day ago

hAP ax s forgot the default configuration and behaves weird

It seems like my hAP ax s has forgot its default configuration. I have reset the thing and did a Netinstall multiple times, but the default configuration is just...blank. I can't even set up WiFi as it always says I have to configure a master. Obviously not possible when no master is set up...

Setting up WiFi through Quick Set also doesn't work, when I hit Apply it just doesn't save.

So, can anybody send me the default config for this device? I have found [this](https://help.mikrotik.com/docs/spaces/ROS/pages/167706788/Default+configurations) but this still doesn't work. OK, well, it does, but very weirdly. For example, the LEDs work only on port 1. If I set something up on port 2, the device has a connection, but the LEDs don't work on the port itself. I also can't set the hAP into router mode - it just doesn't fetch the IP.

u/Dull-Fan6704 — 21 hours ago

connect list station mode for wave 2 driver sets

connect list use to be a thing for station mode to connect to multiple ap's, appears its gone in the new wifi wave 2 drivers, anyone know work around solutions etc?

reddit.com
u/BartFly — 1 day ago

MikroTik CHR vs accel-ppp for a GPON L2TP LNS

Yes, I know Cisco or Juniper are better suited for a scenario like in the title. And I actually don't run an ISP at the moment (only a VPS/VPN host).

But if I did, for a small ISP (like 2000-10000 subscribers) running high-end x86 servers for a L2TP LNS, would MikroTik CHR (with all cores/threads allocated to CHR) or accel-ppp be more performant?

This is for 300 Mbps-2 Gbps end user plans, terminated on wholesale GPON/XGS-PON on a cluster of 4-5 LNSes. Each LNS runs 16-core AMD 9950X with 64GB RAM and 4x25GbE (two upstream & two wholesale ports).

reddit.com
u/_sour_coffee_ — 1 day ago

hAP be lite test

Hi, I have found video with tests of new hap be lite. As expected, there are issues with mediatek chipset.

It's from polish youtuber, who used to work at a local ISP and reviewing mostly Mikrotik gear.

youtu.be
u/mordeusz — 2 days ago

RouterOS vs openWRT vs openSense for home router AP?

I need to replace my TP-Link 1g wifi 6 AP & router in a not so distant future. Live in a condo. The first choice would be to replace it with an AP and a separate opensense box, that could do vlans, Pihole etc, and a Mikrotik 10G SFP+ switch, but no point in replacing one China box with another, and for now my inet is 1G base-T, not justifying high spending. The past time has revealed a lot of secuirty flaws in routers, and esp Netgear and TP-Link, or just that they stop updating them. Some has been intelservices that has been revealed with the new AI tools, & we will likely see more of that. I don't need wifi 7.

The second idea was to replace the router 6 AP w a openWRT that is close to the one I have, also non-China and non-US, & also Mikrotik switches, but then the switch would have to do the vlans, as WRT should not be good for that. If there anything I should be aware of in that mix, eg Mikrotik switches and ioenWRT?
Here I have found the Zyxel T-56 which can be gotten for 75€, so it fits my needs. from Taiwan.

Third idea, is how good are Mikrotik's routeros compared to the above, and should that be something I should also consider for the AP-router box?
Regrettably, Mikrotiks R&APs has 2.5G in, and then 1G LAN ports, but as my inet it here it does, using cables for them individually, eg 3 cables is not high WAF... I have a switch a different place, not on the wall. This is a strange choice, when a 2.5g port on the LAN side too does not cost that much and here the CPU should be able to route 2.5G.
Do any of their router-APs support openWRT? That would also ensure a long life, even after official support.

reddit.com
u/Schroinx — 4 days ago

Need help configuring NAT on a Huawei NetEngine AR657W

I have a public IP address and I want external users on the Internet to access a server located on my internal network. I'm trying to understand the correct way to configure this on a router (static NAT).

My goal is:

Public IP → Internal Server

Allow specific services (such as RDP, HTTPS)

Maintain security while allowing external access

I've attempted several configurations, but external users still cannot reach the internal server. I think I may be missing part of the logic involving NAT, routing, firewall policies, or return traffic.

Can someone explain the correct design and the typical steps required to publish an internal server using a public IP address?

reddit.com
u/JacketSharp60 — 3 days ago

hAP be lite turn a wireless to a wired connection?

Heya, got a hAP be lite recently and did a few tests on my network and so far im not pleased with the results. But a last straw is a little corner where I need a wired LAN connection but can't put a wire there, so far I use a TP-Link device to grab my wireless and turn it into a wired network.

Is it possible with the hAP be lite in RouterOS ? Sadly neither the WinBox tool or the MikroTik documentation is very straightforward and it's my first MikroTik device.

Yoinked from the TP-Link manual:

https://preview.redd.it/iuw9j4l6kvah1.png?width=749&format=png&auto=webp&s=bdaa29cd9f6b82e508e8dba2de462dcfff3d2e2c

reddit.com
u/FujinBlackheart — 4 days ago

cAP Lite RBcAPL-2ND – Initial setup: am I doing something wrong?

Hello,

Normally, the MikroTik can be detected directly via WinBox, or you have to put it onto the ...88.0 network. Although instructions were included, they don't seem to be tailored to the cAP lit. Although I have to say, I’ve only had routers so far and nothing with Wi-Fi AC.

The current behavior is such that when I restart the Cap Lite, the MikroTik appears briefly in WinBox—but with a 0.0.0.0 address. Then it disappears.

I’ve also reset the cAP lite before, following this description.

"Hold this button during boot time until LED light starts flashing, release the button to reset RouterOS configuration (total 5 seconds)."

1.) Press Button
1.1) Edit: Plug in POE/Cable
2.) Wait until the LEDs flash.
3.) Release the button
4.) After that, the OS is reset, but I don't know to what state.

Ironically, the CapLite picked up a DHCP address on my network, and I can ping it. However, it doesn't show up anywhere in winbox., I suspect it's stuck in some sort of mode? Maybe I'm performing the wrong reset.

I can simply assign the IP address 192.168.88.2 to my PC—with or without the gateway 192.168.88.1—and connect it directly or via a switch; WinBox ought to find the devices then, right? That should definitely work.

reddit.com
u/JaMi_1980 — 4 days ago

RouterOS 7.24rc1 [testing] released

What's new in 7.24rc1 (2026-Jul-01 16:53):

*) bridge - fixed forwarding through peer-port after disabling MLAG;
*) bridge - fixed stability issue when using DHCPv4 snooping;
*) bridge - improved STP, BPDU and topology change handling with MLAG, ensure dual-connected port STP state is in sync with MLAG peer;
*) console - added comparison operators for array type (additional fixes);
*) console - improved script handling and error logging when running scripts from external sources (e.g. DHCP, SNMP, Netwatch, etc.) (additional fixes);
*) dhcpv4-server - set "ciaddr" in forcerenew messages so a relay, if used, can unicast such messages;
*) discovery - added "dying-gasp" feature for LLDP, MNDP, CDP that sends packet with "TTL=0" before graceful reboot/shutdown/upgrade;
*) discovery - clear neighbor entry when receiving "dying-gasp" packet;
*) l3hw - added HW offloaded VRF support on 98DX8208, 98DX8216, 98DX8212, 98DX8332, 98DX3257, 98DX4310, 98DX8525, 98DX3255, 98CX8410 switches (additional fixes);
*) l3hw - allow VLAN tagged traffic inside VXLAN tunnel;
*) l3hw - fixed VTEP offload on IPv4 /32 route changes;
*) lte - added force-confirmation parameter for eSIM provision command;
*) lte - do not query 5G neighbor cell info until RG650E-EU FW fixed;
*) lte - fixed cases where R11l-LTE7 modem would not display correct cell info after handover;
*) netinstall - added Netinstall package (additional fixes);
*) ospf - fixed stability issue during interface flaps;
*) ppp - added iccid field to ppp info command for BG77 and BG770 modems;
*) ppp - always show current FW version when running firmware-upgrade;
*) ppp - get IPv6 configuration via RA for modems using PPP emulation mode;
*) ppp - toggle radio state on interface disable/enable;
*) wifi-mediatek - improved stability during MLO channel switching;
*) winbox - do not pre-fill "Allowed Address" and "Client Allowed Address" with "::/0" when adding new WireGuard Peer;

View changelogs

u/netravnen — 4 days ago
▲ 38 r/mikrotik+3 crossposts

reflector: bridge mDNS/SSDP/Wake-on-LAN across VLANs, including the DIAL proxy that makes casting work

Disclosure: I wrote this — open source, Apache-2.0.

TL;DR: mDNS reflectors fix discovery across VLANs but not casting. reflector adds the SSDP + DIAL bits so Chromecast/AirPlay/YouTube/Netflix casting actually works between segments.

Segmented networks (separate VLANs for IoT/guest/trusted) break service discovery: mDNS and SSDP ride multicast that routers don't forward, so Chromecast, AirPlay, DLNA, printers, and Sonos stop appearing across segments.

The usual fix — an mDNS reflector (Avahi, the UniFi/pfSense/OPNsense toggle, RouterOS's built-in repeater) — restores discovery but not casting. A DIAL device (the YouTube/Netflix "cast" target) serves its device description and REST control endpoints only to its own subnet, so a client on another VLAN sees the TV but can't drive it.

reflector adds the parts the mDNS-only options miss: SSDP M-SEARCH relay and a DIAL proxy, so the cast actually launches and stops across VLANs. It also does mDNS and WoL, so it can replace your reflector rather than sit next to it.

What it does:

  • mDNS reflection — Bonjour/Avahi discovery (AirPlay, printers, Chromecast) across the two segments.
  • SSDP reflection with active discovery, not just passive NOTIFY: relays the client's M-SEARCH and proxies the device's unicast 200 OK back.
  • DIAL proxy (opt-in) — a terminating HTTP reverse proxy that rewrites the device's LOCATION/description URLs and connects upstream bound to the device's subnet, so it sees an on-subnet client. This is what makes cast launch/stop work.
  • Wake-on-LAN across segments.
  • Per-device MAC filter — expose one device, or omit it to mirror the whole segment.

Config is interface-based, no IPs:

[tv]
source_if = "vlan-trusted"
target_if = "vlan-iot"
mac  = "B0:37:95:C5:60:BE"   # optional; omit to mirror the whole segment
wol  = true
mdns = true
ssdp = true
dial = true                  # requires ssdp; IPv4 only

Every option also has an env-var form, which is easier with containers:

REFLECTOR_TV_SOURCE_IF=vlan-trusted
REFLECTOR_TV_TARGET_IF=vlan-iot
REFLECTOR_TV_MAC=B0:37:95:C5:60:BE
REFLECTOR_TV_WOL=true
REFLECTOR_TV_MDNS=true
REFLECTOR_TV_SSDP=true
REFLECTOR_TV_DIAL=true

Deploys as a single static binary or a tiny container — prebuilt multi-arch images (amd64/arm64/armv7/armv5), uses under 10 MB RAM.

Security: it doesn't merge VLANs. It relays only mDNS/SSDP/WoL on the interface pair you name, and the MAC filter scopes the exposed direction to one device. The DIAL proxy does expose that device's HTTP control endpoint to the source side, and the daemon parses untrusted mDNS/SSDP/HTTP. Tested with ASan+UBSan, Valgrind memcheck, and Docker e2e over real veth/feth pairs.

Single C++23 binary, Linux + macOS. Linux runs unprivileged with CAP_NET_RAW; macOS needs root or the ChmodBPF helper. mDNS, SSDP, and WoL run on both IPv4 and IPv6 (IPv6 best-effort by default, or required per entry). DIAL is IPv4-only because the DIAL spec ties the device's authority to an IPv4 address.

https://github.com/sbogomolov/reflector — Apache-2.0

Feedback welcome, especially on the SSDP/DIAL handling.

u/s3rgb — 6 days ago

swapping switch from unifi to mikrotik, what should I be watching out for?

Hello all.

I'm swapping out my US-16-XG switch to a CRS510-8XS-2XQ-IN. I've been running Ubiquiti stuff for years, but I wanted some faster network gear. I've never used Mikrotik before and was curious as to what I should be looking at to prevent issues later.

The CRS510 will be main switch with unifi stuff on both sides (firewall, other switches + APs). I run a couple VLANS just to keep my IOT stuff away from my servers and workstations, nothing too complicated.

Any suggestions would be greatly appreciated.

reddit.com
u/old_c5-6_quad — 6 days ago

Mikrotik Wireless Wire Cube Pro

Hello,

I have 2 Mikrotik Wireless Wire Cube Pro 300m apart, aligned with a laser pointer and a wood clamp.

Those are the status:
Freq: 64800
Signal: 80
MCS: 8
PHY Rate: 2.3Gbps
RSSI: -46dB
TX Sector: 35
TX Sector Info: left 0.8º, up 0.8º
RX Sector: 101
Distance: 304.42m

Any think else I should change?
I dont know why, but I can't get Signal > 80, is it the limit?

What settings should I activate/desactivate to improve the overall performance of the devices, what services are not needed.

Thank you

reddit.com
u/ervy — 5 days ago

RB5009 newbie help

Hello!

I just got a RB5009 (poe version) and I was looking up how to best setup my network. I don't have many lan devices but I do have a few computers usually running.

I use Verizon for my ISP and I only have 1 gigabit internet.

My router from them is Cr1000A.

What I would like to do if possible is swap the routers flat out. Can I do this with just using the ethernet off of my ont? Releasing my lease first of course.

Additionally if possible I would love to use the Verizon router just for wireless connectivity. This isn't a deal breaker but would be a big plus.

Of course anything that I do I would like to not severely handicap my speeds and would like the most control to implement a better network at home.

Everything I've seen about swapping out the routers deals with the SFP port which I know extremely little about 😅

Thanks to anyone for any advice!

Cheers!

reddit.com
u/LOLJustCarted — 5 days ago