The hAP ac lite (product code RB952Ui-5ac2nD) is MikroTik's cheapest complete device: router, firewall, DHCP and dual-band Wi-Fi in one small box. It suits a studio flat, a second floor, a holiday home or a test bench. What it is not is a device for a fast line.
Two facts from the catalogue decide everything on this page. The five ports are 100 Mbit, not gigabit, and there is 64 MB of memory. The word "lite" in the name refers to both. The hAP ac and the hAP ac² are different devices with gigabit ports.
The ports
Five ports, ether1 through ether5, all five at 100 Mbit. ether1 is the default WAN port; the other four go into the bridge. There is no SFP cage. ether5 has PoE-out, and because the catalogue knows that port, the PoE-out per port field appears in the Bridge and ports section, with only that one port in the list. See PoE-out.
With four LAN ports and a 100 Mbit ceiling this is a device for a handful of fixed things: a printer, a NAS for backups, a TV box. If you put a switch behind it, one port becomes the trunk; see Bridge and ports.
The Wi-Fi
Two radios: wlan1 on 2.4 GHz and wlan2 on 5 GHz. That is the difference with the plain hAP, which only has 2.4 GHz, and it makes this model usable for phones and laptops that want 5 GHz.
Worth knowing: the Wi-Fi can be faster than the cabling. A laptop on 5 GHz can do more than 100 Mbit towards the router, but anything that then has to cross an ethernet port stops at that 100 Mbit. On a 200 Mbit line you see that in a speed test immediately.
The catalogue puts this model on the old Wi-Fi package, wireless. The script therefore writes /interface wireless lines, and the settings belonging to the new wifi package are absent from the screen: no band steering, no 802.11r fast roaming, no choice of management frame protection. See Wi-Fi settings and RouterOS packages.
With two radios the repeater role is usable: one radio connects to the existing router, the other rebroadcasts. Note that station-bridge only works when the upstream router is also a MikroTik running the same package; for another brand, pick station-pseudobridge.
64 MB of memory, and what that means
The configurator reads the memory figure from the catalogue and adds a note for this model when it generates: RouterOS v7 runs on it, but there is not much room. In practice:
- Keep the configuration small. Every section you switch on costs memory and lines.
- Do not install packages you are not using. An unused extra package costs more here than on a bigger board.
- After pasting, check what is left with
/system resource print. - If it fills up, RouterOS v6 is often calmer on a board like this than v7. That is not advice to buy something else, it is how the board behaves.
The architecture is MIPSBE. The licence level and the switch chip are not in our catalogue for this model, so this page does not name them.
VLANs on this model
This model is listed with hw_vlan: switch-menu: the VLAN table belongs in the switch chip, under /interface ethernet switch. The configurator uses bridge VLAN filtering, and says at the same time that hardware offload goes off with it, so VLAN traffic is forwarded by the CPU. On 100 Mbit ports that usually stays workable, but it is why a guest VLAN on this device costs noticeably more CPU than running without VLANs. See VLANs.
Which roles fit
- Home router: the usual choice. One network, dual-band Wi-Fi, firewall, IPv6.
- Access point or CAP: as a separate access point behind another router. For a small house with one extra AP this is a fine use.
- Wi-Fi repeater: works, with two radios, and halves the throughput. A cable is always better.
- Office router with VLANs: available, but expect the combination of 100 Mbit and VLAN traffic through the CPU.
- Harden only (baseline): for a hAP ac lite that already runs.
Only LTE / 5G router is greyed out, with the message that there is no LTE modem. Switch and Core router are offered, but they are not meant for this box.
The quickest route to a working configuration
- Pick One device and search for
RB952. That is the only way to be sure you do not land on the hAP ac or the ac². - Pick Home router.
- Fill in your internet connection, optionally through a provider preset.
- At the Wi-Fi step: set your country, one SSID, and tick both bands for it.
- Set an admin password, reset the device and paste the script. See Using the script.
A worked example for a household is in Example: a home network.
What trips people up
- Thinking this is a small hAP ac. It is a different device: slower ports, less memory, almost the same name.
- The 100 Mbit ceiling. The Wi-Fi does more than the cable. On a fast line this is the bottleneck, and no setting fixes it.
- Switching on too many sections. With 64 MB of memory, containers, a hotspot and long firewall rule sets really do add up.
- QoS with a queue tree. FastTrack goes off and the work lands on the CPU. Fair sharing per host is the better choice here. See Bandwidth (QoS).
- A guest SSID without a plan. Really separating guests means a VLAN, with the CPU cost above. See Example: a guest network.