r/mikrotik

First impressions of the MikroTik hAP be3 from ax3 to be3, MLD, WiFi defaults, storage, and thermals

First impressions of the MikroTik hAP be3 from ax3 to be3, MLD, WiFi defaults, storage, and thermals

I recently replaced my hAP ax3 with a hAP be3, and these are my first impressions after setting it up and moving my network over.

I'm still learning some of the changes introduced with Wi-Fi 7 and MLO/MLD, so some of the points below are observations and questions rather than definitive conclusions. I'd be interested in hearing how others are configuring theirs.

MLD / Wi-Fi 7

The first major change for me is MLD (Multi-Link Device).

It appears to work as I expected with my Wi-Fi 7 clients, but I need to adapt to a very different way of thinking about Wi-Fi compared with how I managed my hAP ax3.

Previously, I had separate SSIDs for 2.4 GHz and 5 GHz. For example, I could explicitly identify a device as being on 2.4 GHz and apply different QoS rules or expectations based on that. Devices on 5 GHz generally had significantly higher expected throughput.

With MLD, my understanding is that, for the intended multi-link operation, the participating bands need to be configured consistently, particularly using the same SSID and WPA3 configuration across the 2.4, 5, and 6 GHz radios. And its a must that needs to be WPA3

That changes things quite a bit from the way I previously managed my network.

For example, I used to have explicit QoS policies for certain devices depending on whether they were connected to 2.4 or 5 GHz. With MLD, I'm not yet sure what the best approach is when a client can potentially use multiple links/bands.

I also have a question about band steering.

If MLD allows a Wi-Fi 7 client to use multiple bands simultaneously, does traditional band steering become largely irrelevant for those clients? Or does MikroTik still use steering mechanisms to determine which links/bands should be used?

My understanding may be incomplete here, so I'd appreciate clarification from people who have been working with MLO/MLD more extensively.

The default Wi-Fi configuration surprised me

Something else that caught my attention is how the hAP be3 presents the wireless interfaces by default.

In the WiFi configuration I see four entries:

  • MLD1
  • wifi1
  • wifi2
  • wifi3

I initially expected the three radios to be configured with something close to the best capabilities available for their respective bands.

However, the defaults are interesting.

For example:

MLD1

  • WPA3-PSK only

2.4 GHz (wifi1)

  • 20 MHz channel width
  • 802.11G band
  • WPA3-PSK
  • WPA2-PSK

5 GHz (wifi2)

  • BE
  • 20/40/80 MHz
  • WPA3-PSK
  • WPA2-PSK

6 GHz (wifi3)

  • BE
  • 20/40/80/160/320 MHz
  • WPA3-PSK only

The 2.4 GHz configuration in particular surprised me. Why is it explicitly configured as 802.11G rather than N, AX, or BE?

What's even more interesting is that when I look at the registration table, I can see older devices connected to wifi1. Some show G, while others show N, despite the interface apparently being configured for G.

So I'm trying to understand exactly what MikroTik is doing here.

Is the band=2ghz-g default intentional for compatibility reasons? Would it be recommended to change this to AX/BE, or is there a good reason to leave the default configuration alone?

I'd be interested to hear what others are doing with the 2.4 GHz radio.

Check the country setting!

Another thing I noticed, which I think is particularly important for people who are new to MikroTik:

The default country/regulatory setting appears to be Latvia, even though it is not particularly obvious in the configuration that a specific country has been explicitly selected.

This is important because the country setting has a significant impact on the maximum permitted TX power and available channels for each wireless band.

If you set up the hAP be3 and leave the default configuration as it is, you may notice significantly lower transmit power and wireless range compared with what you were getting from your previous router. It can easily give the impression that the hAP be3 has weaker radios.

So one of the first things I would recommend doing is checking the country setting and selecting the actual country where you are operating the device.

Once the correct country is selected, MikroTik will apply the corresponding regulatory limits for each band, which can make a very noticeable difference in the maximum allowed TX power and channel availability, depending on your country.

This is especially worth mentioning for less experienced MikroTik users, because someone could easily leave the default Latvia setting in place and assume that the wireless power they are seeing is simply what the hAP be3 is capable of.

Containers / USB storage

On my hAP ax3 I had AdGuard Home running in a container using the router's internal storage, so I had not really paid much attention to the newer MikroTik App functionality.

With the hAP be3, I understand that the App functionality requires external storage, meaning that I would need a USB device connected to the router 24/7.

This raises a question for me:

What type of USB storage would you recommend for permanent 24/7 use on a MikroTik router?

I'm asking because I remember using USB storage with MikroTik/MetaROUTER and other applications more than 10 years ago, and heavy read/write activity could eventually destroy cheap USB flash drives.

So I'm reluctant to just plug in a random inexpensive USB stick and leave it running permanently.

Would a high-endurance USB flash drive be appropriate? An external SSD? Something else?

It's also a little disappointing that there isn't an NVMe/M.2 connector for storage. I think that would have been a much more interesting solution for this kind of workload.

If anyone is running containers or MikroTik Apps from USB storage 24/7, I'd really appreciate recommendations on what type of device to use.

Thermals

https://preview.redd.it/1q71b8ehedkh1.jpg?width=4096&format=pjpg&auto=webp&s=821006e3b5c2bdda7ee21f57cb816ccdd7181956

Finally, something that immediately caught my attention physically:

The hAP be3 gets noticeably hotter than my hAP ax3.

The heatsink appears to be integrated around the MikroTik logo area, and that entire section of the router gets quite warm to the touch compared with the ax3.

At first I thought perhaps the hAP be3 was simply consuming significantly more power.

However, after configuring it similarly to how I had my hAP ax3 configured, I'm seeing roughly 7–8 W of power consumption, which is actually very similar to what I was getting from the ax3.

https://preview.redd.it/bzakd1ztedkh1.jpg?width=939&format=pjpg&auto=webp&s=04880413a3a7f734e48df3f51218814bd8fd6331

So the higher surface temperature doesn't appear to be explained simply by significantly higher power consumption.

I'm curious whether this is just a consequence of how the hAP be3 transfers heat from its SoC/radios to the enclosure, or whether there is something else going on thermally.

Overall

So far, I'm happy with the hAP be3. The move to Wi-Fi 7/MLD is probably the biggest change for me, not necessarily because it is difficult to configure, but because it changes some of the assumptions I previously made when managing my wireless network.

I'm still experimenting with the best way to handle QoS, band selection, MLD, and the different radio capabilities.

I'd especially like to hear from other hAP be3 owners about:

  1. How are you configuring MLD?
  2. Are you using the same SSID/WPA3 configuration across all three bands?
  3. Does band steering still have a meaningful role with MLD clients?
  4. What are you using for the 2.4 GHz wifi1 configuration?
  5. Are you running containers/MikroTik Apps from USB storage? If so, what type of USB storage?
  6. How are your hAP be3 temperatures compared with the hAP ax3?

These are just my first impressions after moving from an ax3, so I'm very interested in hearing what I'm misunderstanding or what others have discovered.

u/IcyBlueberry8 — 1 day ago

Mikrotik vs TP-Link vs UCG for home network

I am looking to replace my Edgerouter 6p router that died. It was a good router and was rock solid.

My topology is cable modem -> router -> POE switch (unmanaged netgear) -> 6 POE Cameras, 5 TVs, 1 computer, 3 APS, 1 AP controller (TP Link APs).

My internet is 500Mbps, I MAY go up to 1G in the next few years.

Essentially, I am looking for a rock solid router that I will be able to set up and essentially forget is there. I have a background in computing, but to be blunt I have a family and I'd rather spend time with them than configuring/playing around with a router.

I won't be doing any "special" configurations or actions. I just want a router that I can basically set up and forget about.

The routers I am considering are:

My primary question is if the Mikrotik RouterOS is going to be a PITA for me to initially configure and maintain. I dont mind spending a few hours during set up, but I don't want to routinely spend hours on. I've been reading great things about router, but as I said I'd rather not get myself in over my head for what I essentially want to be a basic router.

reddit.com
u/dan7800 — 1 day ago

Mikrotik router as hardware WireGuard VPN client experiences?

As the title says, I’m curious how well using a Mikrotik router of various models has gone for people using them as a WireGuard VPN client. I have a L009UiGS-RM that I’ve connected to my CHR and I’m just wondering if I can rely on this long term.

Edit: thanks for the positive feedback everyone!

reddit.com
u/superpj — 2 days ago

XBox Series X not seeing 5GHz on new CAP AX

I've been running a CRS328 and CAP AC for several years, using CAPSMAN on the CRS328 to manage the wifi.

I recently purchased a CAP AX to replace the AC. I have gone through and recreated everything, as close as possible since the options are slightly different, in the new WiFi CAPSMAN on the CRS328 to use the CAP AX.

My 2.4GHz network(s) are running fine. The 5GHz are not.

My Pixel 7 Pro can see and connect to the 5GHz network fine, but my XBox Series X and Samsung Galaxy Tab 7 cannot even see the network. All of my Google Home devices also do not see the 5GHz network either. I cannot figure out what band setting (or whatever else) in Configuration or Provisioning I need to set to get it to work.

Below are the settings I have in the old CAPSMAN for the CAP AC which work fine. (I have updated the regexp statement for the name of the new AP, 2.4GHz picks it up fine.)

/caps-man security
add authentication-types=wpa2-psk comment="5 Home" encryption=aes-ccm name=\
    security_MY5GHZWIFI1
/caps-man configuration
add channel.band=5ghz-a/n/ac .extension-channel=XXXX country="united states3" \
    datapath=datapath1 datapath.bridge=bridgeLocal \
    .client-to-client-forwarding=yes installation=indoor name=cfg_MY5GHZWIFI \
    security=security_MY5GHZWIFI1 ssid=MY5GHZWIFI
/caps-man provisioning
add action=create-dynamic-enabled comment="5 Ghz WLAN" hw-supported-modes=\
    an,ac,a identity-regexp=CAPAC* master-configuration=\
    cfg_MY5GHZWIFI name-format=prefix-identity name-prefix=5GHz
reddit.com
u/AllArmsLLC — 3 days ago

Availability of CCR2004-1G-2XS-PCIe

I buy these to use as out-of-band remote access devices to support servers out on customer's sites. Recently I've noticed that availability isn't great. The suppliers we normally use are either out of stock or are carrying reduced stock. Is this unit being retired/replaced, or is it just a temporary blip in supply?

reddit.com
u/tychocaine — 3 days ago

Updated to routerOS 7.23.3 on my hap ac^2, now getting an error in the logs?

Other than the obvious contact support, anyone else run into this? Everything seems to be working at the moment.

u/kryo2019 — 4 days ago

Noise level on MikroTik CRS320-8P-8B-4S+RM ?

Hello,

I can't seem to find anything regarding noise on this switch, it only mentions that it has 3 fans.

It may sound silly, but i want to use this at home and it looks very.. enterprise, like it belongs in a business rack, so i'm a bit worried that it's loud?

Just want it for the PoE++ and add 2 AP's and 2-3 Outdoor 4k cameras. But I'm not sure if those devices would even use PoE++ or only PoE+ and i'm guessing this makes a difference in how loud it will be, depending on how hard it's working?

reddit.com
u/Drahngis — 3 days ago

Tayga NAT64 Container on HEX S 2025 no ip command

Hi,

I'm trying to run Tayga https://github.com/apalrd/tayga as a docker container on a Hex S 2025 using this recompiled for Arm32 image https://hub.docker.com/r/axelrindle/tayga-nat64

Anyone had any success with it on this hardware?

Container starts but traceroute packets to a DNS64 synthesised address are looping back - looking at logs I see

/app/launch-nat64.sh: 36: ip: not found
/app/launch-nat64.sh: 37: ip: not found
/app/launch-nat64.sh: 38: ip: not found

Seems like the container image doesn’t have the linux 'ip' command available to it?

Edit: Working in a fashion

So I connected to the terminal console for the container, ran apt-get update, apt-get install iproute2 and restarted container and it now works. I guess its okish until there's a Tayga update or I need to redeploy the container

Next step is to figure out how to inject the iproute2 package on container pull

u/IPvTwelvetySeven — 3 days ago
▲ 2 r/mikrotik+1 crossposts

Built a Wi-Fi deauth tool in Go, mainly because I wanted to understand how 802.11 actually works under the hood

Been meaning to properly learn how the 802.11 stack works instead of just reading about it, so I built a tool instead. Called it deadair.

Scans for APs and clients, sends deauth frames, but honestly the stuff I liked building more was around that part:

  • captures the WPA handshake, dumps it in hashcat format
  • passive PMKID grab too
  • writes a live pcap so you can just tail it in Wireshark
  • there's a WIDS mode that flips it around and detects deauth attacks instead of sending them
  • GPS wardriving if you're into that
  • little Bubble Tea TUI so it's not just a wall of logs

Go + gopacket. Linux only really, macOS blocks injection at the kernel level so it's sniff-only there

Standard disclaimer since it's a deauth tool: Educational/authorized use only, don't point it at networks that aren't yours

Mostly curious if anyone's dealt with similar channel hopping or sniff and inject concurrency stuff in Go and has thoughts on how I did it. Code's here: https://github.com/meetsoni15/deadair

u/MeetSoni15 — 4 days ago

Sxt r - no free storage

Hi

I have a Sxt r which has only 16 Mb of storage. Currently is working with 7.1 RouterOS. Yesterday I tried to do a back up and it was impossible for not having free space, al 16Mb are full. Obviously, there is no possibility of upgrade to the latest stable version for same reason. Is there any way to expand the storage? Maybe with sd card?

reddit.com
u/sosouk75 — 4 days ago
▲ 244 r/mikrotik

Setting up and testing equipment before deployment and handover to the client. Ensuring strong signals and seamless connectivity!

u/Affectionate_Sky8388 — 7 days ago

When will hAP be³ Media become available?

For some time now I have been planning to change my router at home, and when I did research what would be the best solution for my house and the whole self-hosting that I have set up, I came accross hAP be³ Media and it seemed like the perfect solution.

This was 2-3 months ago, I have signed up on multiple reselers websites to "pre-order" the device, but whenever I go to these websites to see the status, I notice that their expected time when they'll have the device in stock, just move further.

What is the deal with it, is there some definite date when this device will be available for purchace?

reddit.com
u/atanstef — 7 days ago

RB5009UG+S+ POE in on eth1 does not work on some POE switches

Router: RB5009UG+S+, RouterOS 7.23.3, connected on ether1, DC adapter

physically disconnected for all tests.

works - Cisco WS-C2960S (802.3at):

  Interface Admin  Oper  Power  Device    Class Max
  Gi1/0/1   auto   on    15.4   Ieee PD   4     30.0

Detected, classified class 4, powered, boots normally.

Fails - Cisco WS-C3850-12X48U (UPOE), IOS-XE 16.12.11:

  Interface: Gi2/0/26
  Inline Power Mode: auto
  Operational status: off
  Device Detected: no
  IEEE Class: n/a
  Absent Counter: 0
  Over Current Counter: 0
  Short Current Counter: 0
  Invalid Signature Counter: 0
  Power Denied Counter: 0

No ILPOWER log entry for this port, ever. Not a rejection - the switch

behaves as if nothing is connected.

Switch and cable are fine:

- Other PoE devices (incl. a TP-Link Omada AP) power on this exact port

with this exact cable

- Three class-4 PDs powered on the same module right now

- 493W of 600W free

- 10cm patch cable, switch straight to router

- Link comes up at 1Gbps, zero CRC errors

Tried on the Cisco side: power inline auto, static max 30000, 2-event,

shut/no shut, multiple ports including mGig.

Interesting detail: on RouterOS 7.22 it wouldn't power from the 2960-S

either. 7.23.3 fixed that, but the 3850 still doesn't see it at all. So

PoE-in behaviour does seem to be firmware-influenced on this board.

Anyone running an RB5009 off a UPOE or 802.3bt switch successfully? Trying

to work out whether this is my unit or the model.

My goal is to power the mikrotik form the switch like i used to do with my 2960 but on the 3850.

reddit.com
u/fagghujjakob — 5 days ago

Which version of the Linux kernel am I running?

Is there an easy way to find out? I have a RB5009UG running with 7.23.3, but it's not visible which version of the Linux kernel the MikroTik is running.

Reason I'm interested in, is that sometimes I get a lot of port flapping, sometimes to the point where ports are basically unsable (especailly when using VPN or Citrx or alikes).

What I found is, that powering off the router and restart helps to stabilizes it for some time. But that's not something I'd like to do on a regular basis.

As there are updates for the mv88e6xxx driver (which includes the switch chip on the RB5009UG), I was wondering if there might be something in the newer drivers which would fix the observed behavior (even if I cannot update the kernel myself).
I think to remember to have found a discussion with a patch for a similar issue (switch chip not MikroTik) in past, but can't re-find it...

reddit.com
u/XoTrm — 6 days ago

RB5009UG+S+in does not turn on?

Hey guys,

Ordered my first ever mikrotik router (RB5009UG+S+in) from Amazon and after a week, it finally arrived today.

I plug it in, doesnt turn on. Maybe a dumb question, but I should see some LEDs turn on once plugged in right? Nothing special I need to do?

I tried other outlets, same thing.

I figured I’d got a dud…dissapointed I may need to wait another week for a replacement…

reddit.com
u/truetech — 7 days ago

State of MLAG + VRRP in 2026 for ROS7

Curious how well this combo works on CRS500 series devices in 2026. I'm thinking of deploying a pair of MikroTik CRS518-16XS-2XQ-RMs for top-of-rack switching. Both switches would be in an MLAG configuration with a VRRP gateway setup, and one fiber run to each server from each switch.

I know that historically, MLAG precluded L3 hardware offloading on RouterOS v7. Is v7.21 and above stable enough now for running active-active VRRP on these switches without major CPU bottlenecks, or are people still strictly separating L2 MLAG (on the CRS) and L3 VRRP (to a separate CCR/router)?

reddit.com
u/sysadminsavage — 7 days ago

DNS cache full errors in log

I've got some sort of DNS cache memory leak going on with multiple routers and the cache as-listed is virtually empty. The only thing that clears it and stops the errors (temporarily) is a reboot. "Used" cache will slowly grow and fill up any size that is set.

I've seen reference to, I think, FQDN address list entries causing this, but there wasn't much info. I do use FQDNs in my address lists, for what it's worth.

Is this something acknowledged anywhere?

reddit.com
u/ZivH08ioBbXQ2PGI — 8 days ago

Is Mikrotik the right choice, or should I go with Unifi?

Hello together.

I live in germany and we have a Fritzbox as Router and Modem. I have my flat in the first floor and my parents, where the Router is, is in the ground floor.

The Fritzbox has one normal network+wifi and a guest network+wifi

I wanted for me a bit more options and security. Thats why I want to work with VLANS (and the right firewall rules ofc.).

My plan is to let my parents keep their two networks and use the Fritzbox as gateway (set static routes in the fritzbox for all the networks/VLANs that I will use).

Now the question. I searched and saw that this is good doable with unifi. So I need the cloud gateway and an unifi AP (+maybe a switch).

But I also heard a lot about Mikrotik. I searched a bit and found the hAP ax³. So I would have router and wifi all in one and the ability to work with VLANS etc.

Would you adivse me to go with Mikrotik or Unifi?

Thx

reddit.com
u/TheDangerSnek — 13 days ago