Manual

hEX S (RB760iGS)

The hEX with an SFP port and PoE-out: small, wired, a little more of it.

The hEX S (part number RB760iGS) is the hEX with two additions that often make the difference: an SFP cage and PoE-out on the last port. It fits when fibre should come straight into the device, or when one access point or camera hangs on a cable with no power socket near it. For the rest it is the same small wired router: no Wi-Fi, no antennas, five copper ports.

This model's data has been checked against real hardware.

The ports

  • ether1 to ether4, 1 Gbit: ether1 is the WAN port by default, the rest is LAN.
  • ether5, 1 Gbit, with PoE-out: the port for an access point or a camera.
  • sfp1, 1 Gbit: the SFP cage, for a fibre module or a copper SFP.

The SFP port is a plain 1 Gbit SFP, not an SFP+. It buys you no speed, but it does buy distance and a different kind of cable. Two common uses: the ISP's fibre straight into the router, or a fibre run to a shed or another floor. In the configurator sfp1 is a port like any other: you can make it the WAN, put it in the bridge, or use it as a trunk to a switch.

PoE-out is off by default. You enable it in the Ports section and the script writes /interface ethernet set ether5 poe-out=auto-on. Note the difference with PoE-in: this model can be powered that way too, but that is not a setting in the script. See PoE-out per port.

VLANs

The switch chip is an MT7621A. The configurator writes VLANs the v7 way here, with bridge VLAN filtering, and the warning about losing hardware offload that older chips get (the hAP ac² for instance) does not appear on this model. So a guest VLAN, an IoT VLAN and a management VLAN are all fine. See VLANs and Bridge and ports.

No Wi-Fi

There are no radios. The Wi-Fi step does not appear and the roles that need a radio are not offered. The usual arrangement is a separate access point on ether5, powered over PoE, with the hEX S as the router. To get that right in one go, use a site with several devices: Several devices. Central management of those access points can run from this router with CAPsMAN.

What it is good at, and where it runs out

An MMIPS processor with 256 MB of memory, RouterOS licence level 4. For a router this size that memory is generous: firewall rules, DHCP leases, a DNS cache and a few tunnels all fit without trouble. It is one of the reasons this model turns up in so many small offices.

The CPU is what you run into, and it is modest. With FastTrack on, ordinary traffic goes around the processor and it keeps up with a gigabit line. Once traffic does have to pass through the CPU the picture changes: a queue tree for QoS switches FastTrack off, and the configurator warns that this costs throughput on small routers such as the hEX. WireGuard and IPsec are handled in software on this model too, so a tunnel carries far less than your internet connection does. If you want a fast VPN, look at an RB5009 or an L009.

We do not add benchmark numbers: they depend too much on your own rules and traffic. Measure it on your own device.

Which roles fit

  • Home router: internet, one network, firewall, IPv6, without a Wi-Fi step.
  • Office router with VLANs: six ports including the SFP is enough for a WAN, desks, a trunk and an access point.
  • VPN gateway: fine for a handful of users or a tunnel to another location, as long as you do not ask too much of the speed.
  • Router + CAPsMAN: route and manage the Wi-Fi of separate access points at the same time.
  • Hotspot / guest portal: workable, for a small cafe or a holiday let for example. See Hotspot.
  • Harden only (baseline): for a hEX S that already runs.

The roles that need a radio or a modem do not appear.

The quickest route to a working script

  1. Choose One device, search for hEX S and make sure you do not land on the RB750Gr3.
  2. Pick Home router or Office router with VLANs.
  3. Fill in your internet connection. If fibre comes in directly, choose sfp1 as the WAN port instead of ether1.
  4. Switch PoE-out on for ether5 if an access point or camera goes there.
  5. Set an administrator password, reset the device and paste the script. See Using the script.

What trips people up

  • The WAN port left on ether1. If the fibre module carries your internet connection, sfp1 has to be your WAN. Forget that and the script sits waiting politely for a cable in ether1.
  • An SFP module that will not play. Check with /interface ethernet print that the port is enabled, and when in doubt ask your ISP which module the connection expects. That is nothing a script can fix.
  • Forgetting PoE-out. The access point on ether5 stays dark until you enable that port.
  • Expecting too much of the CPU. QoS with a queue tree and heavy VPN throughput do not belong on a router this size.

Want to try it right away? Open the configurator