Mikrotik hEX RB750Gr3 5-port Ethernet Gigabit Router

Combined with a Netgear GS105Ev2 and a garden variety home wifi router or access point, this enables SIGNIFICANT security improvements over just the garden variety wifi routers. The hEX is a full-function firewall/router. As others have mentioned, this little piece of hardware costs less than licensing just the RouterOS software. The firewall software gives a very high level of control of traffic, and is far more sophisticated than most home network users would need. But most home wifi routers are LESS sophisticated than really needed. It is, for example, difficult or impossible to set up a "whitelist" firewall policy on most systems, so they tend to come with "blacklist" policies. Immediately on completion of "whitelist" policies on the Mikrotik the rule that finalized the policies began logging attempts from inside the firewall to establish connection outside. This kind of activity is tough to track down in a "blacklist" system. A quick web search on those two terms will provide better information than can fit in this review. It DOES take quite a bit of time and effort to build a "whitelist" policy. And even though the hEX DOES have a built-in sniffer capability, you'll need some way to sniff things the hEX is not connected to, and to filter through the results of both sniffer outputs. The Netgear GS105Ev2 complements the hEX nicely. it can be set up to "mirror" ports, which then allow you to sniff traffic normally not available to your local ethernet sniffer interface. And while the older GS105 needed a special windows client for administration, both the GS105Ev2 and the hEX can be managed with simple web interfaces. The sniffer output from the hEX is easy to download from the router and works flawlessly in the freely available Wireshark. The GS105Ev2 allows your local ethernet (if it has a promiscuous mode) to feed local Wireshark sniffing as well. Then the sophisticated filtering tools in Wireshark allow you to zero in on what traffic you do, and do not, want to allow. Once you know the addresses and ports of traffic you want, the hEX makes it straightforward to not only create the rules, but save them in case a rebuild is needed. For some rules it's easiest to use the web GUI, and some folks really cannot get comfortable with the command line. For those who CAN deal with the command line, hEX can allow telnet, ssh, and sftp access. Using the command set, these facilities can be used to save configurations in eye-readable formats, some of which can be pasted directly back into the router to recover from a rule error or system replacement. Since the sequence of rules is critical in a firewall, it's nice to know that Mikrotik makes it possible to add rules to specific places, especially if you use the generous comment facility to identify distinct rules and purposes. Such comments will be invaluable if the rules ever need to be translated into a different firewall "language." If more homeowners used whitelisting policies there would be more help on the web for making this work. In all likelihood, even the router makers would start shipping with a default whitelist policy. Meanwhile, the Mikrotik hEX is unmatched at its price for enabling significant home network security improvements. So far, highly recommended. I just hope it lasts!

Update: 8/7/2024. After nearly 4 years of nonstop usage I can say this is the best (inexpensive, high performance and trouble-free) home networking product I have used in the past 25 years, because 1) I have never needed to reboot it (it would run for hundreds of days until a power outage or an ISP outage), 2) I have never needed to update the firmware to fix a problem - not once, and 3) it's got excellent performance. It's been simply setup-and-forget. Now that I have upgraded to 1 Gig fiber up/down, it is still keeping up. During a speed test, it gets ~940/930 up/down and would only use about 40% of the CPU during the test. Here's a detailed review: Great value for the money. Can do 1 Gbps full-duplex on 2 of the 4 LAN ports (eth2 and eth4, more details later) and runs fairly cool. I bought an Edgerouter ER-X, but returned it because it can't do 1Gbps full-duplex, and was looking at EdgeRouter ER-Lite and ER-4 routers. But those cost 2 to 3 times as much, run quite warm, and are much bigger in size. Even though the Web (and Windows) interface is pretty complex, I was able to get online within 5 minutes using the Quick Set setup page (just set WAN IP to automatic and change LAN IP, DCHP range and password). This default configuration sets up a firewall that blocks all external WAN traffic not originated from LAN. The only additional setup I did was to enable UPNP (WebFig IP->UPNP->Enabled=Check. Then Add Interface: bridge=internal, ether1=external). Initial speed test using iperf3 showed WAN->LAN speed as only 1Gbps half-dulex. When using iperf3 in bi-directional test, the speed was only 450/450 up/down simultaneously. This was with WAN connected to eth1 port and LAN connected to eth3 port. After looking at the Mikrotik online document "Block Diagram with disabled switching", I realized that I need to move the LAN plug to either eth2 or eth4 port to get the full 2 Gbps CPU to Ethernet bandwidth. This is because the CPU has 2 lanes of 1 Gbps each, with one lane connected to odd numbered ports (eth1, eth3 and eth5) and the other to even numbered ports (eth2, eth4). This means to get 2 Gbps bandwidth, the CPU must read from one lane (eth1/eth3/eth5) and write to the other (eth2/eth4) simultaneously, or vise versa. I tested this theory and found that it is true. With WAN at eth1 (default config), when I moved the LAN plug to eth2 or eth4, I got 920/920 up/down simultaneously, but only 450/450 up/down simultaneously when I moved the LAN plug to eth3 or eth5. Test setup: iperf3 in bidirectional mode, using a Synology NAS and an Asus desktop connected to WAN port via a switch, and a MacBook Pro connected to LAN port. Overall, I think this port/bandwidth limitation could be easily overcome, and this router is a great value for the money/space/power. Update: 10/31/2020. Discovered that in the default setup, hardware switching is disabled, which means that LAN to LAN traffic is handled by CPU, and WAN to LAN upload/download speed will be affected by LAN to LAN traffic, i.e., eth2 to eth3 traffic. To check: Click Bridge->Ports->ether2->Status->Hw. Offload (check or unchecked, default is unchecked). There are 2 ways around this: 1) Use a 5 or 8 port switch for ALL LAN devices and then connect the switch to the RB750Gr3 (eth2 or eth4), or 2) change the bridge Protocol Mode from RSTP to none (don't do this if you are not sure you should). RSTP protocol is used for loop prevention in large networks by automatically disabling certain ports in smart switches (or routers) that cause the loop. But using this protocol disables hardware switching on the MT7621A chip in RB750Gr3. If you only have unmanaged switches then they probably don't support RSTP anyway (unless you have a mesh network in your home.)

This router has NO wifi capability!!! Ethernet only!! This review is mainly for other users like myself who are NOT router specialists and are looking for a 1 Gigabit router to connect up to 4 devices via ethernet to your internet modem. There are many reviews by people who do use and understand this device's advanced features (which are many!). There is excellent documentation at the manufacturer's website including a Quick Guide. I mention this because the only complaint that I have about the device is that it comes in a small box which requires that the included printed documentation ends up in a 2 inch by 2 inch booklet with EXTREMELY small type! :( I could not read it. But you can find the same information online in a very readable format. The router comes without a password preset for the admin account. This is a big security hole that you really should fill as soon as possible. You can access the router using your browser via the IP address provided in the documentation. Click on the Quick Set tab and set a password for the admin user. You will probably have to scroll down to see the Password box which is at the bottom of the default settings. I highly recommend that you save that password however you save your other important passwords so that a year or two from now, if you become curious and or knowledgeable about using the advanced features, you will be able to log in and look at them! Right out of the box, the router works great to connect multiple (up to 4) devices to the internet! :) I ran internet speed tests with a single PC connected directly to my modem. Top results were 482 and 483 Mb/s. Ran speed tests from the same PC once the router was connected to the modem and the PC connected to the router. Top results were 485 and 486 Mb/s. Connected a second PC which immediately received an internet address. Ran speed tests simultaneously on both PCs. Results were in in the 483 to 485 range for BOTH PCs!! So there is no slow down connecting through this router in its default mode! :) Users using advanced features and encryption will probably have different results as there is overhead for encryption. But in default mode, the router connected immediately to my modem. It then assigned IP addresses to both of the PCs that I connected to it via ethernet cables and provided excellent internet service to both of those PCs. I have been using the router for about 3 weeks now and have had no issues at all. Highly recommended!

The Mikrotik hEX RB750Gr3 5-port Ethernet Gigabit Router has been a reliable addition to my network setup. With its compact design and five Gigabit Ethernet ports, it offers efficient connectivity options for small networks and home offices. I appreciate its robust performance and capability to handle high-speed data transfers seamlessly. The router's advanced features include powerful firewall capabilities and customizable routing options, making it suitable for both basic and more complex network configurations. Setting up the Mikrotik hEX RB750Gr3 was straightforward, thanks to its user-friendly interface and comprehensive management capabilities. It's proven to be a dependable choice for ensuring stable and secure network connectivity. If you're looking for a cost-effective and versatile Gigabit router for small-scale networking needs, the Mikrotik hEX RB750Gr3 is an excellent option. It combines performance, reliability, and advanced features to meet various networking requirements effectively. Highly recommended!

I've owned this router for almost two years now. I bought this because I wanted something that was reliable and would last, after having dealt with consumer-grade equipment that gave out randomly. If you're looking at this router, I'm going to guess it's for one of two reasons. You probably were on Reddit or some other site that sung the praises of Mikrotik, or you are well versed in networking and know the brand. If you're in that first category, I would think long and hard before buying this. I have a CS degree with a basic working knowledge of networking, and I enjoyed figuring out how to make this thing work. If you feel comfortable perusing message board posts from strangers and reading stack exchange for help on configuring this, you will be fine. This router has been rock solid for me; I've been running it on a UPS so it's been up for months at a time and I've had no problems at all. Latency is low and the thing just works once you configure it the way you want. If you are thinking of buying this because someone recommended it, and you have no knowledge of how networking works, do not buy this. I had a minor panic attack when I left for a trip and my wife complained that the internet was out at home - there is no way she could debug problems with it, let alone figure out how to change settings on this thing. Thankfully the issue was resolved by rebooting the modem as opposed to having to dig into Winbox (the software package that allows you to configure this router). Here's a litmus test of sorts. Do you know what qos stands for? Do you know what a DHCP server is? Have you ever assigned a static IP address to things like IoT devices or media servers? If your answer to any of these is no - stay away and buy from a mainstream vendor. However, if you do know your way around building a proper home network, this router is rock solid and gives you all the levers to configure it the way you want. Just know that finding the right combination of levers to do the thing you want might take a few hours.

This might be too technical of a device for some people. If so, lease something from your Internet Service Provider and call it a day. That said, this device compares to others I have owned that cost way more money. The RouterOS takes some getting used to but there is an abundance of documentation available online. Command line is a bit simplistic but gets the job done. Web UI is decent. Windows UI is powerful and quite nifty in that you can open multiple windows simultaneously and get a bunch of related configuration side by side, a feature I do not recall having with other security gateways. Passive cooling is working just fine. My only complaint is that the Ethernet lights are in the rear while the ports are in the front. I'd prefer them together and in the front. I will likely buy a second MikroTik security gateway as a backup since they are so reasonably priced, and keep it one firmware and OS update behind as a sort of rollback option.

Mikrotik hEX RB750Gr3 5-port Ethernet Gigabit Router I highly recommend getting one of these. Make sure it's the RB750Gr3 model, not the RB750Gr2. The main difference is the processor, and home networks have finally become busy enough that that can matter. As of spring 2017, I don't think there's a better buy in a router, and getting the routing function off the wireless device noticeably sped up my wireless network. I was surprised. I had noticed that my second AP was faster than the one connected to the modem, but did not realize how much the routing overhead was slowing down my other access point. Speedtest went from ~30 mbps over wireless to about 60 mbps. This device has a fast processor for a router, and enough memory to keep all the sessions of a busy household in memory. Only one device on my network has been flaky since, and it has its own internal problems. The only real caveat is that out of the box, this device is not as secure as it should be. I work in tech, on teams where lots of other network guys see my ip address in logs, and I'm sure some guys scan each others' firewalls to make sure they've secured their home network. I scanned this, and found there was some work to do. The device is very secure-able, just doesn't ship as locked down as I'd like. There are several great write-ups online on how to do so; I'm not gonna put that here. But you'ell need to be comfortable with logging into a router using ssh to do so. I wouldn't say it's for tech-heads only, but some experience configuring routers is probably a good idea. IIRC, I had to turn of SSH on the external interface, filter BOGONs and a coupla other things. No major changes. I think the link I followed was Manito Networks or something like that. Still, this is the best router out there for under ~$150, and it's been rock solid since installing it. Figuring out how to make a DHCP lease for my printer was a pain, but apart from that, the OS has been easy to configure.

I expect a router to work with default functions of passing Internet Connection through to the known working PCs out of the box without configuration. My intent was to upgrade from a Mbit Linkcsys Mbit wireless router which has been working flawlessly for many years to Gbit. I first tried a Netgear basic non wireless and it would not provide throughput on Linux machine and on Windows machine would not allow Thunderbird to connect. Refunded that one for this and all worked immediately without configuration as expected.

★★★★★ (5/5) 𝐖𝐢𝐫𝐞𝐝 𝐭𝐡𝐫𝐨𝐮𝐠𝐡𝐩𝐮𝐭 ★★★★★ (5/5) 𝐖𝐢𝐫𝐞𝐝 𝐬𝐭𝐚𝐛𝐢𝐥𝐢𝐭𝐲 ★★★☆☆ (3/5) 𝐂𝐨𝐧𝐬𝐮𝐦𝐞𝐫 𝐮𝐭𝐢𝐥𝐢𝐭𝐲 ★★★★★ (5/5) 𝐒𝐎𝐇𝐎 𝐮𝐭𝐢𝐥𝐢𝐭𝐲 𝐏𝐫𝐨𝐬: ► Plug and Play as a basic home Internet router. Just four simple instructions that are on the underside of the box ► symmetric Gigabit Ethernet on LAN even with realistic firewall rules, tested with router Bandwidth Test tool and free third-party iperf3 standard tool. Widespread user reports of symmetric Gigabit Internet speeds for those lucky enough to have fibre ► minimal bufferbloat making it great for low latency applications (hello gamers!), tested with DSLReports Speed Test site and a cable modem in bridge mode ► fanless and silent. Case is plastic but good quality ► power efficient: maximum of 5W ► externally secure by default configuration (zero ports accessible from WAN side except for ICMP). Tested with nmap tool ► every port can be independently or collectively configured, i.e. no special WAN ports required ► has almost every pure routing feature you can imagine for consumer, prosumer and small businesses, including software support for VLANs. Powered by the exact same software used in Mikrotik's ISP and enterprise products called RouterOS ► great multi-document, highly responsive and "flat" (no deep drilldown menus) WinBox software for Windows PCs or Linux Wine or Windows VMs makes the router configuration very accessible. Can also be configured by http, https, and ssh ► comes with exactly one QuickSet configuration ("Ethernet"). So, you cannot go wrong with the simplest default configuration ► upgrading the router is a button click away or just dragging a file from your web browser directly into "Files" of WinBox ► powerful stateful firewall similar to Linux's iptables, including Layer 7 (application) rules. The action of each rule can be logged ► full size USB 2.0 port for storage, modems, usb host or other devices ► hardware accelerated IPSEC support ► trivial to backup to binary file or export whole configuration to text to share with others or for support ► many bundled networking tools with RouterOS ► even more powerful networking tools by adding microSD storage space or using a USB drive for Mikrotik's free Dude Server software ► very configurable logging including to email, file or syslog server ► mode button and LEDs can be configured to do/show arbitrary actions ► real-time counters and statistics available everywhere, from interfaces to ports to firewall rules to bridges to router resource usage, etc. ► temperature and other sensor information, but it never gets remotely hot (30 C / 86F) under temperate conditions ► free firmware and unlimited RouterOS updates for life ► 12 months hardware warranty ► Level 4 RouterBOARD License comes with the device = 15 days free support, including over email ► if you need it: command line interface and scripting is very powerful, flexible and easy to get used to ► quick to boot, power cycle and reset ► very stable in both uptime and performance 𝐂𝐨𝐧𝐬: ► outside of the basic QuickSet profile(s), far more complex to configure than a typical consumer or even technical enthusiast router. This is no exaggeration, plan for DAYS not minutes for anything harder than port forwarding or client VPN the very first time. But once you understand what you need, it's straightforward and even inviting ► currently missing support for OpenVPN with UDP and other OpenVPN features. Can only use OpenVPN with TCP ► currently no hardware acceleration for OpenVPN ► no easy Content Filtering and no UTM services. Layer 7 rules are not trivial. Easiest and most performant way to content filter is by DNS, following the guidelines from OpenDNS and then redirecting all DNS network traffic to these settings ► no consumer-friendly, centralized documentation ► no port forwarding or UPnP wizard or other obvious task wizards. This would be helpful for retail customers since that's their number one reason to touch a router's configuration after initial setup and upgrades ► for a tiny, plain looking white box, it activates a lot of big LEDs on the box cover, including blue ones, instead of the traditional embedded port LEDs. Be aware where you want to place it. The LEDs cannot all be disabled at this time on this specific Mikrotik device 𝐀𝐝𝐯𝐚𝐧𝐜𝐞𝐝 𝐂𝐨𝐧𝐬: ► no PoE out nor PoE pass-through (unlike the Ubiquiti Edgerouters) ► Passive PoE in, not standard 802.3af or 802.3at PoE ► no SFP cage ► weaker switch chip than previous hEX (RB750Gr2), which had the powerful QCA8337 switch chip. This RB750Gr3 (using MT7621 SoC) does not have hardware support for VLANs on switch nor switch rules, despite having a more powerful CPU ► no standard Linux or other unix support, despite Terminal support that looks like unix ► currently MetaRouter (a type of "virtual router") cannot be used with devices using SPI flash in RouterOS ► not easy to load up other operating systems, e.g. OpenWRT/LEDE, though it can be done ► despite a comprehensive command line interface (everything a user can do in RouterOS can be done by a command and almost all also by GUI), there is no logging of changes as commands. This is poor for enterprise audit reasons 𝐓𝐢𝐩𝐬: ► upgrade your RouterOS and firmware ASAP. Just like any other router, you need security updates and may get useful new features and performance improvements. There are Bugfix/Stable, Current/Release and Beta/Release Candidate update options. Unless it is for business use, just get the Current update ► change your Router password, just like on any other router. It is empty by default ► the router is not in stealth by default. It still allows ping responses from the entire Internet. If you don't need pings/ICMP from the Internet (extremely unlikely), you should consider disabling this Accept rule in the IP Firewall Filter Rules section. You can test with the famous Shields Up! GRC Security site, which advises the same ► if you want help configuring anything, the online Mikrotik Wiki can be very useful, or consult the Mikrotik forums or Reddit /r/mikrotik. Youtube should also have the very basic, e.g. port forwarding, and some advanced configurations (it's in-between where it is less useful) ► many things are easier or just a copy & paste away using commands in the Terminal, e.g. based on the default factory configuration, port forwarding is just "/ip firewall nat add chain=dst-nat action=dst-nat protocol=tcp dst-port=1234 to-address=192.168.1.234 to-port=1234" (change the ports, change the to-address, DONE) ► you can use the "/export hide-sensitive" command to share your configuration with others without sharing passwords. In short, you won't find any more value in a wired-only router at this price point. Mikrotik appear to have it on lockdown with the feature set of the hEX RB750Gr3.

Works perfect

with change to apple ios 14, many l2tp-ipsec vpn’s from many firewall routers failed. this microtik with routeros >6.0 works! not for the noob, but its more easy to config then cisco catalyst. in fact this router is perfect to learn the networking technologies. the router comes with full routeros license with all functions and lifetime upgrades included. not only CLI, but using the wintool almost all configs are possible. a lot of documentation and a good user forum is available This small box handles my routing firewall requirements very well. vpn’s, vlans, ip routing. established home,game,office,guest segments. throughput is good, especially with the fast track technology (i use tp link switches in addition) lot of functionality for good price.

Sólido, 2 años después sigue como el primer día, no falla.

Always wanted to have a proper router at home with periodic security patch updated. Picked this one during prime day sales. Coming to router it is a wild beast. There are tons of configuration options. Regarding RouterOS there is a bit of learning needed. To start with fire up "WinBox", use menu "Quick set" to enter your broadband USERID details. Mine was ACT so all i needed to enter was PPPOE, USERID, PASSWORD.At this stage your router is not hardened enough but then you could do that slowly as you explore more about RouterOS.By splitting router functionality my options are wide open for Wireless Access Points. This router supports load balancing, so you could combine 2 or 3 ISP connections.