MikroTik RB5009UG+S+IN: the router for network enthusiasts
Review of the compact eight-port wired router with 10G SFP+ and RouterOS 7: architecture, capabilities, power consumption, temperature and limitations to know.
The MikroTik RB5009UG+S+IN looks like a small switch, but its real value lies behind the ports. This wired router combines a 64-bit ARM quad-core processor, RouterOS 7, a 10 Gbit/s SFP+ port, a 2.5 Gbit/s Ethernet port, and seven Gigabit ports. It is aimed less at the household looking for Wi-Fi ready in five minutes than at the network enthusiast, the home lab, or the small infrastructure wanting to control its VLANs, VPNs, routes, and traffic queues.
After getting hands-on with it, the verdict is clear : the hardware offers a lot in a compact and silent case, but it requires an understanding of RouterOS. Its versatility is precisely what makes it interesting — and what prevents recommending it to everyone.
An unusual spec sheet in this form factor
| Processor | Marvell 88F7040, 64-bit ARM, 4 cores from 350 to 1,400 MHz |
|---|---|
| Memory and storage | 1 GB DDR4 and 1 GB NAND |
| Ethernet | 1 × 2.5 Gbit/s and 7 × 1 Gbit/s |
| Fiber or DAC | 1 × 10 Gbit/s SFP+ |
| Expansion | 1 × USB 3.0 type A, up to 1.5 A |
| Switching | Marvell 88E6393, 10 Gbit/s full-duplex link to the processor |
| Power supply | DC jack, two-pin terminal block, or PoE-in on ether1, from 24 to 57 V |
| Power consumption | 14 W without accessories, up to 25 W with peripherals |
| Cooling | Passive, fanless |
| Dimensions | 220 × 125 × 22 mm |
| System | RouterOS 7, level 5 license |
The metal chassis also acts as a heatsink. It is low-profile, heavily finned, and fanless : no noise, no moving parts, but heat is deliberately transferred to the case. The side openings are also used for mounting. With the appropriate accessories, four units can sit side-by-side in 1U.
Port tour: everything is accessible on the front
From left to right, there is the reset button, the DC power jack, the SFP+ cage, the USB 3.0 port, and then the eight Ethernet ports. Ether1 is the only 2.5 Gbit/s copper interface and also accepts PoE-in power. Ether2 to ether8 are limited to 1 Gbit/s. A 24–57 V terminal block on the side provides a third way to power the device.
The SFP+ port accepts a fiber module or a compatible DAC cable. A 10GBASE-T copper module can also work, but it consumes more power and runs hotter ; therefore, you should check the compatibility list, ventilation, and module temperature. For a short link to a switch or server, a DAC remains often the simplest and coolest solution.
An architecture that requires distinguishing switching from routing
All interfaces connect to the 88E6393 switching chip. It communicates with the processor via a 10 Gbit/s full-duplex link. This does not mean the router can endlessly add up 10 Gbit/s, 2.5 Gbit/s, and seven times 1 Gbit/s across every conceivable rule.
A frame switched in hardware within the same bridge can stay in the switch chip. A packet that changes subnets, crosses the firewall, undergoes address translation, enters a QoS queue, or goes into a tunnel will demand more from the processor. Performance then depends on packet size, the number of rules, connection tracking, the type of encryption, and the configuration.
The manufacturer's throughput tables are therefore useful for comparing scenarios, not for promising 10 Gbit/s in any topology. You must test your own configuration with iperf3, monitor the four cores, and verify that the hardware offloads what it can offload.
RouterOS 7: the real reason to buy this router
The hardware would just be a dense box without RouterOS. The system allows building a much more precise network than an ordinary ISP router :
- bridges, VLAN filtering, and link aggregation ;
- multiple Internet connections, policy routing, and failover ;
- OSPF and BGP for a lab or advanced infrastructure ;
- IPv4 and IPv6 firewalls, NAT, and address lists ;
- WireGuard, IPsec, and OpenVPN VPNs as needed ;
- DHCP, DNS, time server, captive portal, and diagnostic tools ;
- simple or hierarchical queues for QoS ;
- scripts, scheduler, API, and SNMP monitoring.
This depth comes at a cost : it is easy to create a rule that cuts off access to the router, places a port in the wrong VLAN, or allows too much traffic. Safe mode in WinBox and the terminal is essential during remote changes : if the session drops unexpectedly, RouterOS automatically reverts the changes made in that mode.
First boot: five steps before any experimentation
- Connect a computer locally and open WinBox or WebFig at the configuration address indicated by MikroTik. WinBox can also find the device by its MAC address.
- Create a dedicated account with a unique password, then disable the default account if your configuration still uses it.
- Update RouterOS and RouterBOOT to a stable branch suited to your deployment.
- Keep the input firewall and restrict WinBox, SSH, the API, and WebFig to administration networks. For remote access, prefer a VPN such as WireGuard.
- Export the configuration and create a backup before major changes. Keep both files off the router.
Also disable unused services, MAC administration outside the maintenance network, neighbor discovery on untrusted interfaces, and the bandwidth test server in production. An unused interface can simply be disabled.
VPN, BGP, QoS: enough headroom for a real lab
With four ARM64 cores, the RB5009 can run several functions simultaneously that would saturate a small consumer router. In a home lab, it can handle inter-VLAN routing, a WireGuard tunnel, firewall rules, a queue to protect latency, and a few BGP sessions without appearing to constantly work at its limit.
However, beware of shortcuts. FastTrack speeds up many established flows, but it can bypass certain queues, rules, or inspection functions. Disabling it makes processing more predictable for a QoS or accounting lab, while increasing CPU load. The right setting depends on the goal : maximum throughput, complete flow observation, or detailed traffic policy.
For a VPN, the protocol and encryption significantly change the outcome. A local measurement between two wired hosts, then another across the tunnel, is more informative than a single figure found in a spec sheet. Monitor per-core usage : a moderate overall load can mask processing mostly concentrated on a single core.
Containers: possible, but the router does not become a server
RouterOS 7 offers an optional package to run containers on this ARM64 architecture. This opens up light use cases : DNS relay, small collector, auxiliary service, or network tool. The feature is disabled by default and enabling it requires confirmation with physical access, a deliberate protection against silent takeover.
The integrated gigabyte of NAND is not an application disk. For a container, use an external SSD over USB 3.0 instead and limit writes. An active database, an indexing engine, or a critical service will remain better placed on a server or a NAS. The router must continue to route even if a USB device or a container fails.
Temperature: the hot case is the heatsink
Without a fan, the surface temperature varies with load, power supply, the SFP+ module, and airflow. On the unit photographed, a spot measurement showed about 38 °C on the top face and 43 °C under the case, while RouterOS reported a processor close to 49 °C. These figures describe a specific environment : they constitute neither a guarantee nor a failure threshold.
The official range of –40 to +60 °C refers to the tested ambient temperature, not an internal temperature target. Leave space above and below, do not place the device on fabric, and avoid trapping a very hot copper SFP+ module in a cabinet without airflow.
Taller feet can improve natural convection. In the setup photographed, a 3D-printed stand elevated the router and the processor temperature dropped by about 5 °C. This result obviously depends on the furniture, the load, and the ambient air.
What works, and what is missing
| Strengths | Limitations |
|---|---|
| Extremely comprehensive RouterOS 7 | Steep learning curve |
| 10G SFP+ and 2.5G Ethernet in a small case | Only one 2.5 Gbit/s copper port |
| Metal, passive, and silent case | Hot chassis if convection is poor |
| Three power inputs and wide voltage range | No PoE-out on this version |
| Dynamic routing, VLAN, VPN, QoS, and automation | No integrated Wi-Fi |
| USB 3.0 and containers for light services | NAND storage is not suited for write-heavy workloads |
The lack of Wi-Fi is sometimes presented as a flaw, but it can be an advantage in a clean architecture : the router stays in the rack or cabinet, while access points placed in the right spots handle the radio. You just need to plan for their PoE switch or injectors, since this version of the RB5009 does not power them.
Who is it for?
The RB5009UG+S+IN is particularly suited for the person who wants to segment their network, connect a NAS at 2.5 Gbit/s, use an SFP+ link to a switch, learn BGP or OSPF, host multiple VPN tunnels, and keep headroom to evolve the configuration. It also finds its place in a small business that already has separate access points and an administrator comfortable with RouterOS.
It is less suited for someone expecting a mobile app with three buttons, integrated Wi-Fi, or eight multigigabit ports. For a simple Gigabit Internet connection and two devices, its software richness will remain largely unused. For a rack entirely at 2.5 or 10 Gbit/s, its mix of one 2.5G port and seven 1G ports requires adding a switch.
Conclusion
The MikroTik RB5009UG+S+IN is an excellent enthusiast router because it dictates almost nothing. It can become the VLAN core of a house, the gateway of a lab, a WireGuard hub, a compact BGP router, or the interface between a multigigabit connection and an SFP+ rack. Its silence, its three power inputs, and its form factor reinforce this impression of a serious tool.
In return, you must accept to document its configuration, test the rules, back up before changes, and learn the RouterOS logic. The hardware has headroom ; the final quality depends mostly on how it is administered.
Technical references
Read next
About the author
Jeremy Kraft runs the infrastructure and the self-hosted services of the IBCSC. These guides describe configurations that were actually deployed and re-checked before publication.
Discussion
Comments
No comment yet. Feel free to open the discussion with a question or your own experience.