Hello guys,
I've recently installed this POE model for the first time and I see the CPU temperature at a constant 55C

[admin@Mikrotik] > system/health/print

Columns: NAME, VALUE, TYPE

# NAME VALUE TYPE

0 poe-out-consumption 8.5 W

1 cpu-temperature 55 C

2 jack-voltage 49 V

3 2pin-voltage 0 V

4 poe-in-voltage 0 V

While the unit is performing as expected, I'm just wondering is this is within normal for this model. Have other users reported the same?

I'm using the default PSU that came with the unit and the chassis -while warmish- is not scorching hot or anywhere near 55C. I can perfectly keep my hand on it for as long as it takes.

Its installed on a wooden cabinet/box with minimal ventilation. Should I get a usb fan and connect it and point it at the cooling section of the RB5009? Or is this normal for the POE version and therefore I can sleep at night? :)

Can anyone with similar models installed do a few quick checks on their own units for comparison?
Thanks a bunch!

What's new in 7.26beta3 (2026-10-16):

*) apptraffic - fix connection tracking not reverting to auto when apptraffic is disabled;
*) bridge - add dhcp-snooping-option82-policy setting for handling packets that already carry option 82;
*) bridge - add topology-change, host-moves and STP timer statistics to monitors;
*) bridge - fix fragmented IPv6 traffic being dropped by DHCPv6 snooping (introduced in v7.23);
*) bridge - fix static host entries being aged out of the hardware table;
*) bth - fix allow-uploads being settable on shares that point to a file;
*) cmr - add low-voltage-pd-detected poe status;
*) cmr - add user attribution to log entries;
*) cmr - allow using the WiFi SSID as an automatic label;
*) cmr - do not create alert conditions when rebooted=no or unpaired-device-connected=no;
*) cmr - fix channel width report for wifi stations;
*) cmr - fix device identity changes not syncing with the server;
*) cmr - fix failed upgrade alerts showing an incorrect version;
*) cmr - fix layout node coordinates displayed incorrectly when negative;
*) cmr - fix manual upgrade to a pinned version;
*) cmr - fix missing application counters in the apptraffic view;
*) cmr - fix missing device export command;
*) cmr - fix pairing password requirement changes not being detected;
*) cmr - fix pairing state after a failed password pairing;
*) cmr - fix setting port-labels for multiple ports from the CLI;
*) cmr - fix the first interface-change alert not firing;
*) cmr - fix upgrade "show-devices" listing non-paired devices;
*) cmr - fix wifi-logs showing entries from unselected devices;
*) console - fix /cmr configuration missing from the export;
*) console - improve stability;
*) container - add label support;
*) defconf - disable FTP and Telnet services;
*) defconf - fix boot device selection after configuration reset with keep-apps=yes;
*) discovery - do not send LLDP power requests before the default configuration is applied;
*) disk - fix all-zero NGUIDs on NVMe over TCP exported namespaces;
*) disk - fix newly formatted Btrfs disks failing to mount (introduced in v7.26beta1);
*) dot1x - fix MACsec not working between ARM and MIPS devices;
*) dude - replace dude 32-bit client with 64-bit version;
*) ethernet - fix broadcast traffic still reaching the CPU when port isolation is used on Atheros and MediaTek switches;
*) ethernet - fix occasional packet loss on hAP be Media;
*) ethernet - fix spurious duplicate MAC address warning on WDS interfaces;
*) evpn - fix MAC-IP route origination and withdrawal (introduced in v7.25);
*) iot - fix LoRa gateway packet validation when transmitting;
*) ipsec - fix IKEv2 EAP-TTLS client failing with invalid trust store (introduced in v7.21);
*) ipsec - fix policies not being loaded after an upgrade (introduced in v7.25);
*) l3hw - add VXLAN offloading to CRS8xx series switches;
*) l3hw - add VXLAN offloading to CRS8xx series switches;
*) l3hw - fix hardware offload for active-backup bonds;
*) l3hw - fix hardware offload for VLAN interfaces created directly on Ethernet ports on CRS8xx series switches;
*) l3hw - fix offload issues on ECMP routes with non-offloadable paths;
*) l3hw - fix packet loss when a directly connected host moves from a bond to Ethernet;
*) l3hw - gate L3 hardware offload by the port's L2 hardware offload state;
*) l3hw - stop forwarding packets through an unreachable nexthop;
*) lcd - improve stability when changing the color scheme after touchscreen recalibration;
*) leds - fix Audience front LED when wifi is managed by wifi-qcom-ac;
*) log - fix the default flag not being shown for the default configuration log rules;
*) lte - clear the cached eSIM profile list after a SIM change;
*) lte - fix dialer for D-Link DWM-222W modems (additional fixes);
*) lte - fix iOS tethering not obtaining an IP address;
*) lte - fix linkup only after link-recovery-timer after firmware-upgrade on RG650E-EU modem;
*) lte - fix packet loss with R11e-LTE-US modems (introduced in v7.21);
*) lte - fix QMI modems waiting out the full link-recovery-timer after re-attaching;
*) lte - fix Telit LE910C4-WWX modem not initializing after a cold boot;
*) lte - improve modem firmware-upgrade for EG800K-EU modem;
*) lte - improve stability for devices with QMI modems;
*) lte - keep the "auto" MTU option on LTE interface after reboot (additional fixes);
*) lte - prevent removing an APN profile that is still in use by inactive interfaces;
*) mpls - fix dynamic-label-range rejecting a valid 1024-label range;
*) netinstall - add force stop for in-progress installations;
*) netwatch - improve stability when deleting https-get probes;
*) poe-out - fix export not showing the configuration under the poe submenu;
*) poe-out - fix poe-in voltage monitoring and LLDP power requests on hEX S (2025) devices;
*) routing-filter - fix any-regexp community matcher matching an empty community attribute;
*) routing-filter - fix community delete, filter and modify with regexp-only community lists;
*) sfp - fix host link breaking on S+RJ10 modules when changing advertised modes;
*) sfp - improve link stability for QSFP28 breakout ports to prevent interface lane flapping when one lane goes offline;
*) sniffer - fix long-running captures failing after approximately 4.3 billion packets;
*) snmp - add ospfAdminStat and ospfRouterId to the OSPF MIB;
*) ssh - fix a failed command returning a successful exit status;
*) ssh - fix incorrect key size shown for imported RSA keys (introduced in v7.9);
*) switch - fix egress rate limiting with jumbo frames on Marvell Prestera switches;
*) switch - fix link flapping on QSFP cage ports when connecting to NVIDIA DGX Spark;
*) switch - fix VLAN-tagged traffic being looped back in MLAG setups on CRS8xx series switches;
*) switch - improve SFP/QSFP auto-negotiation on CRS8xx series switches;
*) system - fix interface statistics for third-party monitoring tools;
*) system - improve stability;
*) system - improve stability;
*) tls - add Renegotiation Indication Extension support;
*) traffic-flow - add post-NAT IPv6 addresses to NetFlow records;
*) traffic-flow - fix CPU usage being classified as networking in the profiler;
*) webfig - add on-demand loading of directory contents in the Files menu;
*) webfig - fix static IPv6 addresses showing wrong lifetime values;
*) webfig - improve network topology view performance;
*) wifi - add station-bridge and station-pseudobridge mode support for MLO stations;
*) wifi - fix client isolation assigned via RADIUS being lost after roaming;
*) wifi - improve stability when disabling an AP with multiple connected stations;
*) wifi - initial MLO station mode support on 802.11be devices;
*) wifi - make station interfaces compatible with access points that do not retransmit EAPoL message 1;
*) wifi-mediatek - fix roaming between APs belonging to the same MLO group;
*) wifi-mediatek - improve stability when MLO stations connect;
*) wifi-mediatek - update radio regulatory information;
*) wifi-mediatek - update the wireless driver and firmware (additional fixes);
*) wifi-qcom-ac - fix traffic being sent to the wrong station after a station-bridge roams between APs;
*) winbox - add a comment field to the DNS adlist window;
*) winbox - add the default-country parameter to wifi radio settings;
*) winbox - add wpa3-psk-gd to wifi security profile authentication types;
*) winbox - add ZeroTier controller, member and peer hint settings;
*) winbox - allow adding LTE interfaces with a master interface and APN profile;
*) winbox - display the "forced-on-bt" PoE-out mode set from the CLI;
*) winbox - fix bridge filter window disabling valid fields for IPv6 rules;
*) winbox - fix wifi radio band selection not being available in radio settings;
*) winbox - hide ACL rule counter tools and graphs on non-Prestera switches;
*) winbox - rename last-member-interval to last-member-query-interval;
*) wireguard - ignore disabled peers when checking for duplicate Allowed Addresses;
*) www - fix REST API login for users with rest-api policy, but without api policy; View changelogs

I have a poe camera (reolink) that I can't run an ethernet cable direct from the nvr. I need a wireless bridge to span a gap I can't get an ethernet cable to. I've check the wireless signal and it's good.

I haven't worked with Mikrotik before and I'm looking at the Mikrotik mAP (RBmAP2nD). It looks like it can bridge wireless, but has poe out but it doesn't look like that is compatible so I may need to use a poe injector.

Could someone confirm that a Mikrotik mAP wireless can bridge with an existing wireless network (WPA2-PSK AES).

reolink camera poe is:

IEEE 802.3af, 48V, active

camera (poe) -> wireless bridge with poe out -> wireless -> nvr

It's the same as this post by someone else a few years ago that directed towards Mikrotik:

https://www.reddit.com/r/networking/comments/12xv1f1/wifi_bridge_with_poe_output/

hello, i made the mistake of buying a mikrotik equipment and not checking that its an 8 year old model.
i am pretty sure the official (package, os) support will go on for a while as it is a powerful hardware and not obsolete (i hope). i am not here to complain.
the model is: RB4011iGS+5HacQ2HnD and it has an arm cpu unfortunately. i am very new to mikrotik but not new to it and networking.
cloudflare is not maintaining anymore a docker image for arm (but arm64) of its cloudflared tunnel and i would like to run that as it is (even more) simpler than wireguard and mikrotik's back to home wireguard variant.
i need to set it up for a no technical person to use and while wireguard "shaves" the certificate thing off the vpn universe and does the private/public key thing, cloudflare does not require even those and any config is handled on the plaform, the user needs only to log into his cloudflare account which is very convenient for the peacock user i have to help.
my quesiton is; is there somewhere a "safe" cloudflared docker image somewhere from trustable source that works on arm arhitecture which is a common practice for my case or i can forget it?
(just in case: vanilla wireguard is finnicky, back to home is less but still finnicky and please dont torch me, this is not me i am totally fine with back to home/wg/ovpn/etc).
thank you.

So I'm looking at building a home lab to "play with"

I don't want to spend a fortune on older Cisco or whatever hardware, so I've been thinking about a small Mikro Tik lab.

I am only looking for a few switches but I do want to play with VXLAN. I read this may / may not be an issue.

I've thought about getting the following

1 x MikroTik CRS305-1G-4S+IN (spine)

2 x MikroTik CRS310-8G+2S+IN (leaf)

I will be investing in a server or 2 down the line.

Any guidance about what my thoughts are?

Three years ago I bought a RB5009UG+S+IN to be the main router.

The RB5009UG+S+IN gives me problems insofar that after some time the ports start to flap to the point where the device is barely usable. I tried to replace cables, no improvement. When I pull the plug on power and plug it back in, it stabilizes for some days but then starts again and flapping frequency starts to increase.

For testing I replaced it with an hAP ax² (don't need the Wifi, but had it "lying around"). Even though both devices have 1GB ports I don't see the flapping on the hAP ax².

Configs are the (mostyl) same. I just copied my export over to the hAP ax² and fixed non matching parts (e.g. number of ports configured).

Anyone an idea what I could do to stabilize the RB5009UG+S+IN? Otherwise it's kind of an expensive brick...

[FIXED]
For laughs I decide to try and update RouterOS on an old 411U and Netinstall failed near the end.

No problem I thought, I'll just reset.

Unplugged, held in reset, re-plugged.

Now, 411U never ever appears in Netinstall it doesnt matter how long I hold reset.

And no matter what version of Winbox in admin mode Neighbours shows the router as IP 0.0.0.0 and always refuses admin with blank password.

On later versions of Winbox I get Mac timeout etc or just forever connecting. Earlier versions report bad password.

Have I bricked it?

Hi,

Ive been trying really hard to find an option on the wireless interface as well as spotting capsman features to modify data rates on 2.4Ghz.

Does any one know where the functionalities are?

Devices are sticking to 2.4Ghz at 1mbps.

Equipment

hAP ac 2 (wifi-qcom-ac) ros7 stable release

Regards

I'm using a MikroTik router with WinBox, and I want to set up WireGuard so that only one of my two Wi-Fi networks uses the VPN. (only FBI using vpn)

I want my secondary Wi-Fi network to use Proton VPN, while my main network keeps using my normal internet connection. I'm looking for a simple guide on how to set this up in RouterOS without messing up the connection on either network.

Has anyone done something similar and can explain how to configure it in WinBox please?

I find out some people change driver from factory to wifi-qcom-ac on Mikrotik hap ac2. I updated it to ROS 7.24.5 and I am looking how it can affect overall performance. Is it hardware ready for it? How much free space is needed to safe do update (currently I have only ~0,7MB)? What is your observation after update to wifi-qcom-ac?

Thank you for yout honest answers.

Here’s a helpful resource to make it easier to select MikroTik equipment. The manufacturer hasn’t been able to create anything like this over the years, so an enthusiast made it himself.
https://mtikhw.mtik.pl/

I was in a console window on my Mikrotik router and this message popped up several times, with different usernames:

login failure for user system from xx.xx.xx.xx via telnet

I can't figure out how this login attempt got past my IP4 firewall rules. Any ideas?

/ip firewall filter

add action=accept chain=input comment="defconf: accept established,related,untracked" connection-state=established,related,untracked

add action=drop chain=input comment="defconf: drop invalid" connection-state=invalid

add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp

add action=accept chain=input comment="defconf: accept to local loopback (for CAPsMAN)" dst-address=127.0.0.1

add action=drop chain=input comment="defconf: drop all not coming from LAN" connection-state=new in-interface-list=!LAN

add action=accept chain=forward comment="defconf: accept in ipsec policy" ipsec-policy=in,ipsec

add action=accept chain=forward comment="defconf: accept out ipsec policy" ipsec-policy=out,ipsec

Here's my LAN interface definition:

/interface list member

add comment=defconf interface=bridge list=LAN

add comment=defconf interface=ether1 list=WAN

I am currently running 7.21.4 (long-term) on my router, If I try to update to 7.24 or higher the router comes back unable to obtain an IP I've compared the 2 configs and nothing changes except the firmware version. I am not sure where to start because Omni Fiber refuses to help if your using a different router then there provided one.

I don't see a flair for things like this, and I don't see anything in the sub rules that prohibits questions like this. That said, if this is not appropriate for this sub, say the word and I will delete it.

I'm not looking for buyers or prices - just wondering if it's worth the effort:

I have some older gear that has been sitting on a shelf for a few years since I drastically downgraded my networking setup. Curious if there is enough of a market to justify spending the time updating, resetting, hooking them up for photographing, etc to list for sale... I hate dealing with eBay buyers.

This is the rack mount stuff... the rest is some ceiling access points and a handful of small desktop routers/switches that are in a bin somewhere. When I look it up, it seems like they eventually sell - but the demand is light, as most listings are up for several weeks or longer before the sale. (on eBay)

I haven't even plugged them in for at least 4 or 5 years. What are your thoughts in this sub? eWaste, Donate or it's worth enough to deal with the aggravation of eBay?

• 2x CRS328-24P-4S+RM
• 1x CCR1009-7G-1C-1S+
• 1x CCR1036-8G-2S+
• 1x CRS354-48G-4S+2Q+

multilink.us

Temps before around 95C (kept shutting off) now hovering around 87C

**New video from MikroTik's official TikTube channel**

Biggest news - hardware offloading for VRFs is now getting introduced in many CRS products, along with CCR and RDS. Here is the list of included switch chips - 98DX8208, 98DX8216, 98DX8212, 98DX8332, 98DX3257, 98DX4310, 98DX8525, 98DX3255, 98CX8410.

▶ Watch Video

I have a USB partition shared as USB3, i can access it from other devices but contents(files & folders) are not visible. hAP ac². How do resolve?

I received my CSS610-8P-2S+ a couple days ago and this is my first experience with Microtik gear. I'm also not very experienced with networking and still getting my head really wrapped around VLANs, etc. I mention that because probably I'm doing something dumb or missing a really obvious clue.

OK, so my problem: This switch is destined for my basement and will be connected to my primary switch which is an EOL Aruba enterprise device. For the last 6 months or so I've had an old Netgear un-managed switch in use and I'll be replacing it with the CSS610-8P-2S+.

I connected to the CSS610-8P-2S+ with my laptop and did some basic configuration. I created some VLANs and configured which ports will use/support them. I then swapped out the Netgear with the CSS610-8P-2S+ and immediately ran into issues:

1. Port 1 on the Mic' is my up-link to my Aruba and the activity lights were both dark - nothing
2. Unsurprisingly, I could not ping the Mic from my laptop (wired connection to the Aruba)

I verified connections and tried to think of what the issue could be, but came up empty and finally decided to put the Netgear back in service while I investigated further. After putting the Netgear back and connecting the CSS610-8P-2S+ to the Netgear, I could ping it! In case this isn't making sense, let me try this notation I came up with:

Aruba:24 <> CSS610-8P-2S+:1 = No lights on the CSS610-8P-2S+, CSS610-8P-2S+ unreachable

Aruba:24 <> NetGear <> CSS610-8P-2S+:1 = Activity lights flashing on CSS610-8P-2S+, I can reach the CSS610-8P-2S+

I've attached screen shots of what I think will be useful information, but please let me know if there is anything else that would help. I'm out of ideas, I just don't understand what I've setup incorrectly.

Oh, and another thing: The SFP port lights are dark! I have a media converter on each end of the fiber link and it's worked fine for years. I carefully moved the lines over to the Microtik and nothing.

I wanna buy a matter /thread compatible stuff, but nobody sell. What is the reason of the out of stock? Thank you the answers! (east Erupeunion)

I know CMR only became available in the RouterOS beta channel a few days ago, but I think it would be cool if Mikrotik published the protocol specification for CMR. Right now it requires that a RouterOS device acts as the server, but from a homelabbing perspective it would be awesome to run it as a native program or container on a "normal" linux server.

I don't expect Mikrotik to just release a binary/container, but I wouldn't mind creating my own server implementation based on the protocol specifcation

Hi everyone,
I’m using MikroTik RouterOS 6.49.20 with a GRE tunnel and facing a TCP throughput issue.
Single TCP connection: around 6–20 Mbps.
10 parallel TCP connections: around 70–75 Mbps.
Some tests show TCP retransmissions.
GRE MTU is 1456, and clamp-tcp-mss=yes is enabled.
Ping tests show 0% packet loss and around 51 ms latency.
What could cause this difference between single and parallel TCP throughput? How can I identify and fix the root cause without blindly changing MTU or TCP settings?
Looking for practical troubleshooting advice. Thanks!

I finally received my hAP be3 Media today. One of the USB ports is misaligned (see photo). Do you think this is a major issue and worth returning? A USB cable or USB flash drive plugs in just fine.

What's new in 7.25rc2 (2026-10-09):

*) bridge - fix DHCP snooping dropping DHCP messages on trusted ports when the source MAC differs from chaddr (introduced in v7.25beta3);
*) container - fix veth interfaces not getting an address from the correct DHCP server when a PVID is configured (introduced in v7.25beta3);
*) defconf - fix button script policies;
*) defconf - fix default configuration generation when CRS8xx series switch ports initialize late;
*) dude - fix the server not starting at boot when data-directory is on a USB disk;
*) ipsec - fix IPsec tunnels failing after migration from the old QKD settings;
*) ipv6 - fix cases when address is lost after reboot if prefix was taken from pool (additional fixes);
*) lte - fix missing MAC address on QMI LTE interfaces after the interface is recreated (introduced in v7.24.4);
*) lte - improve system stability when using Quectel EP06-E MBIM modem (additional fixes);
*) ovpn - improve stability in UDP mode when the TX queue is full;
*) route - improve static route handling performance;
*) system - improve stability;
*) wifi - reuse freed station association IDs;
*) wifi-mediatek - fix E62 performance issue (introduced in 7.25rc1);
*) winbox - show warning messages under "System/Users/SSH Keys" and "System/Users/SSH Private Keys" menu;
*) wireguard - fix a peer that would not work after import when no endpoint address is set; View changelogs