Mikrotik hEX RB750Gr3 5-port Ethernet Gigabit Router

Update: 8/7/2024. After nearly 4 years of nonstop usage I can say this is the best (inexpensive, high performance and trouble-free) home networking product I have used in the past 25 years, because 1) I have never needed to reboot it (it would run for hundreds of days until a power outage or an ISP outage), 2) I have never needed to update the firmware to fix a problem - not once, and 3) it's got excellent performance. It's been simply setup-and-forget. Now that I have upgraded to 1 Gig fiber up/down, it is still keeping up. During a speed test, it gets ~940/930 up/down and would only use about 40% of the CPU during the test. Here's a detailed review: Great value for the money. Can do 1 Gbps full-duplex on 2 of the 4 LAN ports (eth2 and eth4, more details later) and runs fairly cool. I bought an Edgerouter ER-X, but returned it because it can't do 1Gbps full-duplex, and was looking at EdgeRouter ER-Lite and ER-4 routers. But those cost 2 to 3 times as much, run quite warm, and are much bigger in size. Even though the Web (and Windows) interface is pretty complex, I was able to get online within 5 minutes using the Quick Set setup page (just set WAN IP to automatic and change LAN IP, DCHP range and password). This default configuration sets up a firewall that blocks all external WAN traffic not originated from LAN. The only additional setup I did was to enable UPNP (WebFig IP->UPNP->Enabled=Check. Then Add Interface: bridge=internal, ether1=external). Initial speed test using iperf3 showed WAN->LAN speed as only 1Gbps half-dulex. When using iperf3 in bi-directional test, the speed was only 450/450 up/down simultaneously. This was with WAN connected to eth1 port and LAN connected to eth3 port. After looking at the Mikrotik online document "Block Diagram with disabled switching", I realized that I need to move the LAN plug to either eth2 or eth4 port to get the full 2 Gbps CPU to Ethernet bandwidth. This is because the CPU has 2 lanes of 1 Gbps each, with one lane connected to odd numbered ports (eth1, eth3 and eth5) and the other to even numbered ports (eth2, eth4). This means to get 2 Gbps bandwidth, the CPU must read from one lane (eth1/eth3/eth5) and write to the other (eth2/eth4) simultaneously, or vise versa. I tested this theory and found that it is true. With WAN at eth1 (default config), when I moved the LAN plug to eth2 or eth4, I got 920/920 up/down simultaneously, but only 450/450 up/down simultaneously when I moved the LAN plug to eth3 or eth5. Test setup: iperf3 in bidirectional mode, using a Synology NAS and an Asus desktop connected to WAN port via a switch, and a MacBook Pro connected to LAN port. Overall, I think this port/bandwidth limitation could be easily overcome, and this router is a great value for the money/space/power. Update: 10/31/2020. Discovered that in the default setup, hardware switching is disabled, which means that LAN to LAN traffic is handled by CPU, and WAN to LAN upload/download speed will be affected by LAN to LAN traffic, i.e., eth2 to eth3 traffic. To check: Click Bridge->Ports->ether2->Status->Hw. Offload (check or unchecked, default is unchecked). There are 2 ways around this: 1) Use a 5 or 8 port switch for ALL LAN devices and then connect the switch to the RB750Gr3 (eth2 or eth4), or 2) change the bridge Protocol Mode from RSTP to none (don't do this if you are not sure you should). RSTP protocol is used for loop prevention in large networks by automatically disabling certain ports in smart switches (or routers) that cause the loop. But using this protocol disables hardware switching on the MT7621A chip in RB750Gr3. If you only have unmanaged switches then they probably don't support RSTP anyway (unless you have a mesh network in your home.)

Apr 2020 update: I recently added two more RB750Gr3 units to my private stable, I have two RB450Gx4 RouterBOARDs shipping, and I see much bigger Mikrotik boxes in my near future. I have just sold the last of my many Ubiquiti products. What's changed? Well, maybe this is just the natural evolution of a geek. In any event, I'll try to walk you through some of the changes in thinking that have caused me to revisit Mikrotik in earnest. Most recently, I've been deploying pfSense and the odd IPFire box for routing/firewalling. These have almost exclusively been Ivy Bridge or Haswell Core i5 Optiplex boxes with an abundance of fast RAM, Intel NICs, and reliable SATA SSDs. None have given me any fits; they've all done what you'd expect. Part of the reason for using these high-horsepower i5 boxes was due to a need for traffic shaping, in my cases via FQ_Codel, but in recent months some of my users have switched to an ISP serving over fiber. A good percentage of the remaining, including myself, now have gigabit connections via cable. The fiber-connected users have essentially no bufferbloat worries. With the cable users, I don't know if it's the migration to DOCSIS 3.1 and its use of OFDM channels, or if it's pie shaping taking place inside the modem, or some combination thereof, but bufferbloat woes have been substantially mitigated on these gigabit cable connections as well. Sure, I can continue to feather this bufferbloat out with FQ_Codel, cake, or pie, but at what cost? These Optiplex boxes are pretty power thirsty. And the other projects, like pfSense, IPFire, and my roll-your-own Debian routers and whatnot were mostly attractive due to having features/functionality missing from solutions like RouterOS in the Mikrotik products. What functionality? Well, things like Squid, Snort, Suricata, pfBlockerNG, that kind of thing. But these all come with an administrative cost, I've learned. Packages need updates. Gobs of additional rules need to be tweaked, gradually over time. And in today's age of encrypt-all-the-traffic-or-else, I see too much cost (maintenance/breakage) in putting a bump on the wire with fake certificates to be bothered using Squid. Snort and Suricata by themselves don't do anything that's interesting to me (they won't peer into encrypted traffic, and that's all I'd really be concerned with). Even pfBlockerNG (or Pie-hole, or whatever) cause some amount of breakage. Just the fact that most of these network-based ad-block mechanisms will kill affiliate links from a place like dealnews or techbargains is enough of a nuisance that I can't even attempt to deploy them. Even on my own network, the administration overhead became tiring. And the benefits...well....according to my logs, they were all pretty inconsequential. Network IDS/IPS and whatever other fancy fangled thing is no panacea, and I consider my security in layers: my device's permissions are super restrictive, everything is patched and updated regularly, I'm careful where I click and ignore all but the most trusted emails. I'm not super worried about security, since I've been paranoid about it for decades, enough to learn where the real threat actors tend to lie and what tools they'll likely prefer. So what if I could get just the things that I *need*, with all the visibility I could want, with very low power consumption, and a small form factor? What would that look like? A dream? Well, for me, it looked like I'd be revisiting Mikrotik. And it now looks like I'll be here for a good while. And I'm serious about it. I consumed two books on RouterOS, I've read a ton of their online documents, and I've scoured the odd forum. I've tried to figure out what it's like to really understand RouterOS and its tooling. I want to understand how to utilize the software to my every advantage. And I'm impressed. I'm excited. This is genuinely a Swiss Army kniferouter. And try as I did, I couldn't break it. I don't use features that break FastTrack, so the bulk of my traffic passes almost completely without overhead. I think that means I see some 930Mbps over the WAN, instead of the occasional 980Mbps-1Gbps I'd see with my beefier boxes. This is absolutely acceptable for a tiny, cool-running box that's spec'd to max at 5W. Nothing "feels" any different to me. Nothing lags. No performance concerns whatsoever. This hEX works and doesn't bellyache. If you need FastTrack disabled for any reason, you'll want to find a resource that can give you some idea of how overall performance will suffer as a result. The tooling is outrageous. It's almost unimaginably great. There's any amount of visibility you desire. Watch anything you can imagine in real time. And this thing can run the Dude server on a $10 microSD card. The box reboots in no time flat. It'll email you about whatever you want it to. If you really try hard to break it and hold the reset button down for the wrong amount of time, you can take your otherwise "bricked" router back to good with netinstall simply and quickly. Backups and restores can be done multiple ways, and you can even snag a text file of all settings, modify the odd IP address or whatever, and use that revised text file to deploy another hEX. Options galore. Updating the firmware is dead simple. Updating packages is dead simple, and there are multiple tracks (long-term, stable, testing, development). The web interface nearly mimics the Winbox interface (you will almost surely prefer Winbox, and it can run reliably on any desktop OS), and the command line interface neatly follows the same parent>child directory structure as the GUI, which makes it a pleasure to learn, once you've found your way around the GUI. The iOS app I use on my iPhone isn't too shabby, and surely about as good as I could want from a phone app for such a device (and again the same design principles follow, so it feels as cohesive as the other administering methods). This thing just begs to be poked and prodded, which makes it just the most amount of fun a network nerd can have for $60 or so. For newbies, you can do the quick config/wizard setup thing (I don't know what it's called), then walk through the online page "Manual:Securing Your Router" to learn how to change user/password, disable unwanted services, etc., and even stop at the part about configuring the firewall (firewall defaults are already well suited to most homes/small businesses), and you'll have a very nice, suitably secure router for practically any home/SOHO (certainly just as good as any other device, embedded or otherwise, would ship out of the box). Pro tip: from Mikrotik's website, pick a product. Under Support & Downloads for said product, see the block diagram. This will give you some understanding of how the hardware is arranged. Pay careful attention to switches/backplanes/ports. Coupled with an understanding of RouterOS bridges and FastTrack, you can probably suss out whether this or any other Mikrotik box is right sized for your environment. You'll likely find IPsec test results from the product page too, if it's important to you, and some boxes have hardware offloading for this. You'll hear people gripe about anything. But the ones who complain about Winbox confuse me immensely. Winbox is brilliant. You can resize a window, move it around, run it next to another window about a related function...I usually find myself looking at three or four windows simultaneously within Winbox, and it makes life so much nicer when you can take in all the data you need in a single pane. I think this is just the coolest. In terms of overall routing and firewall performance (for most users in most common configurations) I’m convinced this will stomp anything in its class and run with or plain smoke most other embedded boxes at multiples its price. To boot, I very much doubt anything compares in terms of useful tooling. I keep some OpenWRT-flashed field units on hand at all times, usually with 1.2GHz or faster dual-core CPUs, 802.11ac, and all the trimmings. I don’t think routing performance compares. And I’m not knocking the OpenWRT project. I love it. It can do glorious things and provide bleeding edge functionality. I don’t knock many networks devices, since it seems that with only rare exceptions all have their place, for the right user. And nothing stops you from running RouterOS or OpenWRT on bare metal with gobs of compute and memory to level the playing field. Fun fact: you can run OpenWRT on this hEX, too. Um, so....yeah. I like this. ........................ Feb 2019 update: Anything that reads as critical of Ubiquiti can be safely ignored. I now have 0 Mikrotik units in service and dozens of Ubiquiti EdgeRouters deployed, a couple USGs, a couple Cloud Keys, a cloud-hosted controller, various PoE switches, and quite a darn big lot of UAP AC access points (LITE, LR, and PRO models only). This shouldn’t take anything away from my love of Mikrotik, but Ubiquiti is now favored for my deployment needs, and it’s been this way for a little more than a year. ........................ My original review: Amazing, just like practically everything from Mikrotik. Hardware more or less speaks for itself. This thing is an animal, and I don't have the ability to really stress the router at all (largely due to my cable connection being limited to about 90/13Mbps cable, no tunnels running, etc.). The RB750Gr3 is simply best of breed. I've run and deployed competing products, namely EdgeRouter PoE, EdgeRouter Lite, and EdgeRouter X. The EdgeRouters are really nice, and I suspect most or all of the EdgeRouters are more performant in terms of pps routing, but my Mikrotik boxes simply NEVER hiccup (running updates exclusively from the bugfix track and keeping firmware current is my personal policy). On the topic of updates, I've had Ubiquiti AP and EdgeRouter updates bork on me a few times. I've always been able to overcome, but not without some frustration. And I've had a client's EdgeRouter X fall over three times, spaced out 4-5 months per occurrence, reasons as yet unknown. Hasn't happened in 4 years with any of my Mikrotik boxes. Also, updating is dead simple with Mikrotik, click and done. Ubiquiti requires you to fetch the update from the web, save to disk, push to router. Isn't hard, by any means, but it's just an extra step. Mikrotik handles much more nicely. And winbox is the greatest config tool ever devised. To be able to drag windows around the screen for all of the various configs you wish to play with is bliss. No need to memorize IP or MAC addresses for anything, just park the relevant window off to the side to keep in view. It's the bee's knees. This is pretty much a no-limits device that professionals will drool over...backup, export, export compact, scripts...I don't even know where to begin...this does it all. And it runs on almost no power, with no noise, and no discernible heat. So affordable it's stupid. Get it.

Awesome and powerful little guy but can bite hard. The performance is crazy when using VLANS with proper firewall rules configured. Less broadcast traffic, etc. storm control, rate limiting, theirs so much you can do and also obv create other DHCP servers as well and route traffic accordingly with my external WIFI 6 AP. Just bought 2 more since you’re in control of your data.

Combined with a Netgear GS105Ev2 and a garden variety home wifi router or access point, this enables SIGNIFICANT security improvements over just the garden variety wifi routers. The hEX is a full-function firewall/router. As others have mentioned, this little piece of hardware costs less than licensing just the RouterOS software. The firewall software gives a very high level of control of traffic, and is far more sophisticated than most home network users would need. But most home wifi routers are LESS sophisticated than really needed. It is, for example, difficult or impossible to set up a "whitelist" firewall policy on most systems, so they tend to come with "blacklist" policies. Immediately on completion of "whitelist" policies on the Mikrotik the rule that finalized the policies began logging attempts from inside the firewall to establish connection outside. This kind of activity is tough to track down in a "blacklist" system. A quick web search on those two terms will provide better information than can fit in this review. It DOES take quite a bit of time and effort to build a "whitelist" policy. And even though the hEX DOES have a built-in sniffer capability, you'll need some way to sniff things the hEX is not connected to, and to filter through the results of both sniffer outputs. The Netgear GS105Ev2 complements the hEX nicely. it can be set up to "mirror" ports, which then allow you to sniff traffic normally not available to your local ethernet sniffer interface. And while the older GS105 needed a special windows client for administration, both the GS105Ev2 and the hEX can be managed with simple web interfaces. The sniffer output from the hEX is easy to download from the router and works flawlessly in the freely available Wireshark. The GS105Ev2 allows your local ethernet (if it has a promiscuous mode) to feed local Wireshark sniffing as well. Then the sophisticated filtering tools in Wireshark allow you to zero in on what traffic you do, and do not, want to allow. Once you know the addresses and ports of traffic you want, the hEX makes it straightforward to not only create the rules, but save them in case a rebuild is needed. For some rules it's easiest to use the web GUI, and some folks really cannot get comfortable with the command line. For those who CAN deal with the command line, hEX can allow telnet, ssh, and sftp access. Using the command set, these facilities can be used to save configurations in eye-readable formats, some of which can be pasted directly back into the router to recover from a rule error or system replacement. Since the sequence of rules is critical in a firewall, it's nice to know that Mikrotik makes it possible to add rules to specific places, especially if you use the generous comment facility to identify distinct rules and purposes. Such comments will be invaluable if the rules ever need to be translated into a different firewall "language." If more homeowners used whitelisting policies there would be more help on the web for making this work. In all likelihood, even the router makers would start shipping with a default whitelist policy. Meanwhile, the Mikrotik hEX is unmatched at its price for enabling significant home network security improvements. So far, highly recommended. I just hope it lasts!

The hEX is a very capable little router, far more than its diminutive size would suggest. hEX runs routerOS, a serious router operating system with many advanced capabilities. If you're a networking expert and you're looking for the best bang for the buck in the home/small biz router market, this is it. Performance even with a realistic set of firewall rules is excellent, and you have the power to do incredibly sophisticated routing with this little box. The bad news: if you don't know what you're doing, you can pretty easily screw up your networking configuration and find yourself mysteriously offline. This isn't a flaw per se, it's just that this is a product for advanced users. Beginners need not apply. Initial setup isn't insanely difficult if you understand networking concepts and protocols, but if you're not versed in the world of IP, you will quickly be in over your head.

The Mikrotik hEX RB750Gr3 5-port Ethernet Gigabit Router has been a reliable addition to my network setup. With its compact design and five Gigabit Ethernet ports, it offers efficient connectivity options for small networks and home offices. I appreciate its robust performance and capability to handle high-speed data transfers seamlessly. The router's advanced features include powerful firewall capabilities and customizable routing options, making it suitable for both basic and more complex network configurations. Setting up the Mikrotik hEX RB750Gr3 was straightforward, thanks to its user-friendly interface and comprehensive management capabilities. It's proven to be a dependable choice for ensuring stable and secure network connectivity. If you're looking for a cost-effective and versatile Gigabit router for small-scale networking needs, the Mikrotik hEX RB750Gr3 is an excellent option. It combines performance, reliability, and advanced features to meet various networking requirements effectively. Highly recommended!

I've owned this router for almost two years now. I bought this because I wanted something that was reliable and would last, after having dealt with consumer-grade equipment that gave out randomly. If you're looking at this router, I'm going to guess it's for one of two reasons. You probably were on Reddit or some other site that sung the praises of Mikrotik, or you are well versed in networking and know the brand. If you're in that first category, I would think long and hard before buying this. I have a CS degree with a basic working knowledge of networking, and I enjoyed figuring out how to make this thing work. If you feel comfortable perusing message board posts from strangers and reading stack exchange for help on configuring this, you will be fine. This router has been rock solid for me; I've been running it on a UPS so it's been up for months at a time and I've had no problems at all. Latency is low and the thing just works once you configure it the way you want. If you are thinking of buying this because someone recommended it, and you have no knowledge of how networking works, do not buy this. I had a minor panic attack when I left for a trip and my wife complained that the internet was out at home - there is no way she could debug problems with it, let alone figure out how to change settings on this thing. Thankfully the issue was resolved by rebooting the modem as opposed to having to dig into Winbox (the software package that allows you to configure this router). Here's a litmus test of sorts. Do you know what qos stands for? Do you know what a DHCP server is? Have you ever assigned a static IP address to things like IoT devices or media servers? If your answer to any of these is no - stay away and buy from a mainstream vendor. However, if you do know your way around building a proper home network, this router is rock solid and gives you all the levers to configure it the way you want. Just know that finding the right combination of levers to do the thing you want might take a few hours.

Been using for the last 4 years at home as the ISP-facing gateway (ISP link is <<1 Gbps, so the Gigabit speeds are sufficient). Not a network professional, so I'm only using the most bare bones features of RouterOS, but it looks like it has any configuration option you'd want. Mainly just using NAT, DHCP-- which I just checked with `/export`! I always use WebFig now. I think Quick Set is enough to get internet access at all, but otherwise you can't configure anything. There's a CLI, but I haven't found it any easier to use than WebFig, except for `/export`. Can be hard to setup at first with so many options and terms to lookup, but once it's working, I've never had issues. The Mikrotik documentation is fairly good too. Experience was so good, I recently got a CRS305 for the local network, which has also been great, although the bang/buck is not as high as this. The price at ~$60 is phenomenal.