• out of stock

Mikrotik RB5009UPr+S+IN 8xPoE/1xSFP+ Network Router $382 + $10.95 Delivery ($0 Pickup Fortitude Valley, QLD) @ Gigafy

350

$382 for the MikroTik RB5009UPr+S+IN is a great deal considering this PoE unit is a similar price as what the non-PoE unit (RB5009UG+S+IN) usually goes for.

The next cheapest price I've found for the RB5009UPr+S+IN was from Amazon US via Amazon AU for $502.53 delivered.

The RB5009UPr+S+IN may be overkill for your regular user but there is an Android/iOS app but I havent used it so maybe someone else can comment.

I might be worth it if you need/want…
  • 7 x 1gbe PoE ports (25w/port max)
  • 1 x 2.5gbe PoE port (25w max)
  • 1 x SFP+ port
  • A rabbithole of network customisation

Note: Maximum total PoE output is 130w

Postage
  • Pickup In Store: $0.00
  • Australia Post (Parcel Post): $10.95
  • Australia Post (Parcel Post Small Satchel): $11.30
  • Australia Post (Express Post): $14.45
  • Australia Post (Express Post Small Satchel): $14.80
Mikrotik's kitchy product video.
Specifications source
  • Product code: RB5009UPr+S+IN
  • Architecture: ARM 64bit
  • CPU: 88F7040
  • CPU core count: 4
  • CPU nominal frequency: 350-1400 (auto) MHz
  • Switch chip model: 88E6393
  • RouterOS license: 5
  • Operating System: RouterOS v7
  • Size of RAM: 1 GB
  • Storage size: 1 GB
  • Storage type: NAND
  • MTBF: Approximately 200'000 hours at 25C
  • Tested ambient temperature: -40°C to 60°C
  • IPsec hardware acceleration: Yes
  • Suggested price: $299.00 *(USD)
Powering
  • Number of DC inputs: 3 (DC jack, 2-pin terminal, PoE-IN)
  • DC jack input Voltage: 24-57 V
  • 2-pin terminal input Voltage: 24-57 V
  • Max power consumption: 150 W
  • Max power consumption without attachments: 16 W
  • Cooling type: Passive
  • PoE in: 802.3af/at (ether1), Mode B (ether2-ether8)
  • PoE in input Voltage: 24-57 V
PoE-out
  • PoE-out ports: Ether1-Ether8
  • PoE out: 802.3af/at
  • Max out per port output (input 18-30 V): 900 mA
  • Max out per port output (input 30-57 V): 440 mA
  • Max total out (A): 2.59 A
  • Total output current: 2.28
  • Total output power: 130
Ethernet
  • 10/100/1000 Ethernet ports: 7
  • Number of 1G Ethernet ports with Reverse PoE (PoE-in): 7
  • Number of 2.5G Ethernet ports: 1
  • Number of 2.5G Ethernet ports with Reverse PoE (PoE-in): 1
Fiber
  • SFP+ ports: 1
Peripherals
  • Number of USB ports: 1
  • USB Power Reset: Yes
  • USB slot type: USB 3.0 type A
  • Max USB current (A): 1.5
Details
  • CPU temperature monitor: Yes
  • Current Monitor: Yes
  • PCB temperature monitor: Yes
  • Voltage Monitor: Yes
Certification & Approvals
  • Certification: CE, EAC, ROHS
  • IP: 20

Related Stores

Gigafy
Gigafy

closed Comments

  • +21

    this was not something i expected to come up on ozbargain at all.

    For what it's worth I usually buy my mikrotik gear from duxtel (IT business) but when stocks are short I've bought from these guys and they've been great.

    The android app is decent.

    However I'm going to say that if you aren't in the field of IT do not buy this. Even if you are and you don't have a thorough understanding of how networks operate at a low level you're going to have a horrible time with this.

    They are amazingly feature rich, so customizable and amazing value for money. However they do not hold your hand through this process in the slightest.

    Need to setup bandwidth management? Well you'd better be quite familiar with mangle rules, the mikrotik way of using queues etc.
    Need to forward a port? Add a rule to the correct chain in the firewall, add a nat rule to forward traffic to where you need to go.

    The second one isn't overly complex, but 99% of users just want to jam the IP and port number in and call it a day.

    TLDR: I wouldn't use anything else, but if you're reading this chances are you don't have my skillset and won't have a good time.

    • +1

      Thinking of starting my first home networking setup, eyeing off an M1 Mac Mini to run Scrypted and get PoE wired to maybe 4 cameras, it’d be a fully new setup. Had been looking at the TP link switches until this post came up, thanks for your sage advice or I may have been tempted!

      • I believe, out of the box, the first Ethernet port is WAN and the others are LAN like a typical home router but if you want to play with the config and you have other people sharing the connection don’t make this your primary internet gateway.

        I have 2 for this reason; staging and production.

        • If you use quickset / default config this is correct yeah.

          Or you can have all of them as WAN ports, or whatever you want! So many options to make you want to end it all when you make a configuration mistake.

          Thankfully it's been years, but the hour drive out to see a pissed off client because i forgot to put a (profanity) M after I pushed enter on a queue and locked myself out and hard limited the network to like 20kbps wasn't a fun time. I never forget safe mode now.

    • +1

      One other thing they can do that other switches often can't - handle higher temperatures. We use loads of these at work in dusty places where there is no cooling. They just keep chugging away.

      • they never die lol

      • My latest uptime for hap ac2 is 180+ days on a window sill.

    • +1

      Thanks for the heads up! Gonna try and set up a 5 camera, self-hosted recorder.

      Keeping the cameras and this router off the house internet, as a subnetwork just into the recording computer should make it harder to screw-up, right?

      • +1

        I'm not sure where the tik comes into this honestly. If you want to segregate networks and are a networking noob just slap another router behind your existing one and double nat it.

        If you wanted to segregate your networks it is better done on the router / one device.

        I have a middle ground for my CCTV gear though:
        -Cheapo chinese recorder taking constant footage, blocked from web access.
        -Homeassistant connected to the rtsp streams of the cameras and monitoring the onvif sensors. The sensors on these state of the art aliexpress chinese besder cameras detect people quite reliably, once HA receives this trigger it records some footage and sends me a video via telegram.

        • Good advise, I guess this is overkill. I just happened to be looking for a decent PoE router and this popped up so I got excited, but I can see there are plenty of "good enough" options for a third of the price.

          I have an unRaid NAS and was looking to add cameras to it, don't need remote access, so slapping in an extra router seems like a good option.

          • +1

            @Joost: Yeah, or use a different platform that holds your hand through this a little more if you can.

            Don't quote me on it but I'm fairly sure the unifi gear is pretty noob proof from a routing point of view. I really dislike their routing side of things from the limited experience I've had but I'd struggle to know what else to recommend that's pretty easy to use.

      • +4

        This is my situation where I’ll lock the cameras down as much as possible.

        Warning: potential acronym overload

        • Each camera on it’s own VLAN
        • Each VLAN has an IPv4 /30 CIDR for 2 usable IP addresses (1 for the router and 1 for the camera)
        • NTP server configured to listens on all internal router IPs
        • Only ARP, ICMP, DHCP, NTP and established communications are permitted to the router IP
        • Communications to the cameras SNATs to the router IP and only HTTPS and RTSP are permitted
        • DHCP server has a 1 IP scope that’s reserved for the camera’s MAC after first lease
        • No DHCP options specified

        This is going pretty hard but it’s ¡FUN! and once you’ve done one it’s just a find and replace for the next.

        Might not be for everyone.

        • +5

          as someone who understood all that bro, who hurt you? hahaha

          But that's a very solid setup I do agree and very secure. Honestly I just have my chinese cameras / NVR on a separate vlan and that has no internet access via fw rules.

          • @knk: That's some next level stuff from Edgy. I'm slightly less restrictive, cameras on a "surveilance" VLAN with the NVR and no internet access, run a firewall on the NVR so its only available on the specific ports on that VLAN.

        • Bit overkill with having each camera on its own separate vlan - there is not much benefit, but adds a lot of extra effort and can easily break. One ring vlan to rule them all is usually good enough (its not like one camera will affect another camera which is likely containing the same spyware and backdoors).

          My approach is: all CCTV on one VLAN, not able to talk to internet (obviously). Then to make sure no other device can sneak in, go with 802.1x.
          If dot1x is not possible (either not supported by cameras or no suitable network switch), then lock it via L2: Once cameras gets address from DHCP make that lease static, set DHCP server to add-arp=yes, powercycle cameras (to make sure you got those ARP records) and set VLAN to arp=reply-only and remove the pool. That way router will be unable to talk to any other device on that VLAN except those with already assigned static leases. Attacker would have to spoof existing camera's MAC address, but that will likely break the video so when there is disturbance of the force stream, you can get alerted and look into it. I also recommend to use logging for DHCP server and get notifications (e.g. telegram/email) for any unusual activity. e.g. new device asking for IP on cctv/mgmt network?

    • +2

      Lol yep!!
      I was playing around with some hAP acs we use at work. Loaded the factory UI, man, what a learning curve :(

    • +1

      Unlike Ubiquiti, this type of equipment is not intended for beginners. Despite spending over a month studying CCNA lectures, I am still struggling to set up a basic 100M Cisco router correctly.

  • “Suggested Price $299”, hope that’s USD or it’s pretty bold to put in the item description!

    • My buy price is around $500 as a business. This is dirt cheap

    • Done.

  • I understand Mikrotik is among the best when it comes to networking but just wonder if it’s because they provide the most customisable and configurable options, or it’s also because of the reliability. I’m more interested in the second part, i.e. how reliable can it be compared to an equivalent Omada or Unify router? Also can a Pfsense or Opnsense box be as good as a Mikrotik when it comes to features and reliability?

    • +2

      I've been using these exclusively as routers / p2p bridges where needed in my business for about 8 years now I think.

      See my above comment re complexity.

      Reliability wise I have not had a single device fail, outside of failed power supplies. I can still see an rb2011 I setup 7 years ago online and connected back to me. Omada I can't comment on, ubiquity have been reliable but I have had failures. I only use them for wireless though.

      Your pfSense box is never going to be as reliable as a Mikrotik, or at least not statistically as reliable unless you're buying supported hardware through pfSense. Mikrotik control the hardware and the software here so it's just going to be a better experience from that point of view.

      PF/OpnSense the answer is it depends. As these run BSD there are a heap more plugins / options etc available since you / others have access to the underlying OS etc (more on this shortly).. So say you wanted to run openvpn with both TCP + UDP you can on opnsense because hey that's normal and supported. RouterOS nope, one or the other. Want to run tailscale? I'm not even going to check but I know it'd be supported.

      This is kinda getting better in RouterOS now that we can run containers (ie docker) under it. So rather than having to have a separate container on a server / other device for my tailscale nodes, I can simply add a container running this under rOS..

      However bandwidth management and general customizability, making it bend to do whatever weird shit you need it to do etc is considerably better on routerOS at the cost of complexity.

      If you're dead set on running your own router in software I'd prefer openwrt over pfsense personally.

      Happy to answer any questions, I love this shit.

      • Thanks for your detailed answer. It’s appreciated.
        It makes sense to me that Mikrotik is probably the most reliable given they control both hardware and software and their stuff are enterprise grade.
        However your first comment scared me a bit admittedly, and I honestly don’t know if I’m willing to invest considerable time for it.

        I bought an overpriced Synology NAS to not have to build and tinker with a custom NAS, and hoped to find something similar that is reliable and “just work” I.e. Apple-like in the network domain as well, but I guess the Mikrotik is a totally different beast and there’s no such a thing when it comes to networking.

        I guess I should focus on building a network with Omada switches and AP and a mini PC with Opnsense for router for now. But I will keep an eye in case something better but simple enough that may be introduced from Mikrotik or another brand in the future.

        • Yeah, like if I gave you an address of 192.168.69.69/23 would you know what that refers to and what it implies? It's not so much investing time, it's can you actually do this.

          I'd be impressed if you managed to get it to do what you want, and more impressed if you didn't break things most of the time when you made a config change.

          You're gonna have a massive learning curve. I knew my stuff before I touched these and still had a hard time getting my head around the little intricacies. I will say the lack of hand holding made me much better at what I do though.

          I haven't touched omada gear, but if say you should be right with either / or them or ubiq. Why not use a router from one of those? I really think running a router on your own hardware is idiotic outside of a niche use case.

          They're cheap enough you can just buy one and add a cheap mini pc for the rest of your x86 needs. N100 boxes off aliexpress cost nothing these days, and at least when it shits itself you still have internet access.

          • @knk: Yeah I know what 192.168.69.69/23, have learned it back in uni and also occasionally have to touch them at work :) Still need those basic knowledge even for the Omada stuff I guess, but I don’t fancy going much deeper than that and too often after work.

            The main reason I planned to go with Opensense is its flexibility and features and community support which I assume a lot better than Omada and Ubi. Also heard they either can have spotty updates or simply abandon their hardware after a few years. Switches and APs are kind of ‘dumb” compared to the router so I don’t mind them as much.

            You raised a very good case about the backup router though. I already bought a 4-port mini PC as a backup for my Lenovo 720Q which I plan to use as the main one. And there’s always the good old Telstra Smart modem handy if things go really bad with the Opensense stuff I guess.

            • +2

              @GreenRomeo: The reason I mentioned the addressing was more so that it's the only place I've seen it referenced like this. ie specifying subnet on the interface IP not the network. Nothing wrong with it, this probably makes more "logical" sense but I'm still scarred from when I first started using these and it took me way to wrong to realize where the issue was…

              That said -maybe you should just run both honestly?

              So you know enough, have omada wifi gear presumably so wifi isn't an issue.

              https://store.duxtel.com/hap_ax_lite_lte6?search=lte&sort=p.…
              https://store.duxtel.com/hap_ax_lite?search=hap%20ax

              I'd use this if i were you they will route at wire speed so no dramas for NBN.

              Since you've already got a server, just add *sense to do whatever else you'd like. This is actually how I have my VPN setup for my "linux ISOs" so that the traffic isn't visible. pfsense connects and provides a route, and we just add a route with a routing mark to the routing table to send traffic via this interface. You then add a mangle rule to tag the traffic with the appropriate routing mark if it originates from your required device.

              Obviously this isn't your exact scenario, but you can do similar with any service on pfsense you need to access via another router be it a tik or omada.

              If you do it this way it's the best of both worlds because your internets reliant on a dedicated device. I had assumed that you knew less than you do so apologies there, given you have some level of study / understanding already I'm sure you could get your head around it all eventually but it might piss you off / you might not be willing to invest the time and I wouldn't blame you.

              Or just docker it on the tik, I'm going to setup a full debian instance under a container on my CHR (router on a VPS) soon to see how that goes.

              • @knk: Thanks again for lots of useful info and aspects and options I haven’t thought of. Will go through them and incorporate to my network plan.

              • @knk: linux isos - lol

                • @r0nmac: Hahahahhahah I'm just a good bloke helping people get their software

          • @knk: I agree with difficulty level. I haven't touched one in a loong time (more than 12 years ago) .

            I'm not sure if it's the gui/layout or something else but it wasn't as straight forward as other devices. I do this for a living (ccie) and can confirm its not for your average home user (at least that's how I rememeber it) .

            • @butter: I completely agree.

              Even if we'd say you and I have equivalent knowledge (I'm assuming you're more knowledgeable given the size of the environments you'd deal with using cisco) - I've done a CCNA a decade ago and never worked with cisco equipment outside of playing around or changing a vlan tag I'd struggle similarly with the gear you use.

              The interface you're thinking of is winbox if you're using the app or the web ui which is basically a mirror that's less nice to use. It's complicated, weird and in what world does a router have a management interface with different windows, terminals etc. I love it, but it's very unusual don't get me wrong, things are just different, understanding which network chain does what etc, ip addresses specified with different terminology, the way vlans and bridges are represented etc.

              On the flipside I had the absolute displeasure of subcontracting to a mate for a clients office / warehouse move, pretty large job. He used Meraki, I wanted to (profanity) neck myself.

              There is no granularity, we're professionals we shouldn't be playing with the apple equivalent of enterprise hardware. Hate that things are going this way.

              All that said, I do feel like if Mikrotik made a separate "noob mode", ie a gui that was similar to other residential grade routers they'd do amazingly and I really can't see it being that much work. Opens up a whole new market.

              • @knk: Another option is to run WRT on these routers. People who have done it - love it.
                OTOH, I wouldnt touch my rock solid microtik hapac2 with a 10foot pole.
                Took several days to get the vlans etc going.
                Now, my house (50+ wifi clients) will bail out if my router is messed up with.
                Havent even moved to router os 7. Setup a sideby GL-Inet beryl as wireguard gateway instead.
                Its a love/hate thing.

                • @r0nmac: Yeah ros7 gave me grief initially, but it's very stable now. Works quite well.

                  I do still have a CHR running ros6 that desperately needs an upgrade, but I'm making some infrastructure changes that'll make me less reliant on it so I figure I'll get that sorted first.

    • Easily more reliable than a Unifi router, but that's because Ubiquiti uses it's users as beta testers.
      I'd put Microtik at the same level as a OPNsense router.
      Microtik will handle throughput better because the optimisations are already done (no fiddling with tuning parameters), while the UI on OPNsense is a little more user friendly.
      That said, you can cli the hell out of an RB, whereas OPNSense is GUI (or API) only

      • Thanks, I heard the same as well, and that’s mostly why I chose Omada over Ubi.

        Also I’ve used CLI enough at work, so wouldn’t mind some nice GUI of Opnsense. I also bought a used Lenovo micro box for hardware and hope it’s stable enough.

  • mmmm routeros 😋😋

    • 🍆

  • 1 x SFP+ port

    I read as SPF+…it will protect us from getting sun burnt?

    • +1

      If you buy one and you get into it, you may never go outside again. At least, not during the day otherwise you might sparkle.
      So… maybe.

    • +1

      No. But if you install correct SFP module and look into it, it may burn your eyes.

  • Thinking of getting rid of my opnsense combo.
    Any ngfw features on mikrotik? Can it do line rate with layer 7 inspection? I'm guessing no?

    It doesn't need to be fancy but as long as I can schedule on/off time (kids) and have a robust (preferably reputation based) Web filtering capability, I'm good.

    • +2

      This does lots of things but isn’t as user friendly as OPNSense and, to my knowledge, doesn’t have web filtering as a simple option.

    • If you fast-track for whatever rules you can prior, then I suspect you'll be ok.

      With good use of fast track I get line speed on gig, but I'm not doing a lot of layer 7 stuff.

      • you want to just completely disable fasttrack, I never use it unless it's to push something like voip traffic through.

        Fasttrack will bypass all queues and traffic management will not apply. So it's good in cases where you set your queues up to have some bandwidth spare and then push all the voip / video / whatever important traffic across without it applying to the queue.

        Fasttrack was really handy back when these things were slow. You could handle gigabit speeds on an rb2011 with it. Realistically now days even a cheap axlite will route NBN with anything a residential user can throw at it at wire speed. That is unless you have some really complex rules setup, even then the newer arm ones are damn quick.

        The ax lite with lte6 failover is like $160, a much better choice for residential users imo (if they have another access point because 2.4g only). Otherwise my go to is the chateau with lte for about $250ish.

        • Could not disagree more, you must have a very simple rule set or slow net. I'm using an ac3.

          I had to come back and look at it in another way, removing it completely reduces your own rule set complexity but using it prevents un-nessesary processing, anyway I tried to see it both ways.

          • @dibbz: Yeah I understand how it works, definitely agree on removing unnecessary processing particularly for voip/comms data.

            That said perhaps I haven't pushed an ac3 hard enough, your ruleset isn't too efficient, or our definition of complex / simple just varies. I will say that I do design everything to have minimal intervlan/routed traffic locally, but that's not always practical depending on what you're doing.

            I did find that my old ac2 a while back was getting pegged due to some inefficiencies in how I had everything setup which were pretty easily rectified by me not being an idiot

            Now days I'm using an rb1100ahx4 at home for 1000/50 so that's just idling. It was free, a client pretty much went out of business (serviced offices and covid lockdowns)

            I prefer to have fasttrack disabled where possible as I go pretty hard on the bandwidth management side.

            My house is a dual living / dual occupancy type of place and I rent the back half out so there's a touch more complexity there with everything going on, but it's nothing insane and was previously fine with a hex S (250/50 prior to the rb1100 upgrade).

    • nope, these are purely raw networking devices with no built in web filtering or anything to that effect.

      You can use layer 7 firewall rules but they're not going to inspect https traffic, you can do it over DNS but it's still a crapshoot. I'd be opting to use something separate to handle this probably at the DNS level.

      The on / off times you can do I think there's something built in and if not you could script it.

      For the kids can you just use adguards family protection or do you need more granularity? https://adguard-dns.io/en/public-dns.html

      • Purely raw networking device is a bit low brow. It's a fully featured network router.

        https://help.mikrotik.com/docs/display/ROS/Extended+features

        You can run containers with web filtering.

        • Just a difference in our terminology I would say, when I say purely raw networking I mean that they're just networking devices without all the fancy IPS / IDS / filtering etc.

          Outside of containers of course as you've said. I'm really happy I can run tailscale nodes on them now also.

    • https://www.sophos.com/en-us/free-tools/sophos-xg-firewall-h…

      sophos xg home is a fully featured ngfw for $0

      works quite well

  • Looks cool.

  • Lovely! Needed a new tech project and recently started my Masters in IT - so time to pick up a networking elective! My small apartment block have been wanting to get cameras installed but don't currently have the funds, might be able to use this as a starting point and invoice them later haha

    • buy an old optiplex and some cheapo nic (preferably intel) and start with opn/pfsense. much cheaper if you want to just mess around

  • RouterOS CHR (routerOS on hypervisor) license is very affordable - buy-once-use-forever lifetime license. If you are comfortable with using a hypervisor coupling this with a low-end x86 box makes a very capable router. It needs very little RAM and boots up lightening fast.

    I got into RouterOS a few years ago and struggled with the initial learning curve - however after getting the hang of it now I wouldn't consider using anything else. Definitely not for the people after a simple setup. However its difficulty does force you to understand computer networking at a much deeper level. Its Winbox GUI is different to the clicky web interface of pfSense/OPNSense and I really like it - it's fully customisable and I can squeeze in a lot of info into a dashboard like layout. The compactness means I can see everything I need with far less clicks.

    A while back the VLAN setup was quite confusing when different switches require different setup - but I believe this situation has been simplified a lot these days.

  • Could this router to specify the amount of data assign to a certain user? i.e. user A only have 200GB data per month.

    • I haven't tried that but I'd be very surprised if it wasn't possible.
      Get ready to watch a bunch of YouTube videos.

    • Can't do this but you could use prtg (if they still have a free tier) or one of the many other free options to monitor it via netflow.

      From there you could get your prtg server to talk to it via the api or have a file / flag of some sort the Tik can access to notify it.

      Chatgpt will slap something together for you.

    • Yes, you can use the Mikrotik hotspot and user manager package to achieve this.

  • Page not found…

Login or Join to leave a comment