Manual

L009 (L009UiGS-RM)

Eight gigabit ports, a 2.5 Gbit SFP and PoE-out, in a rack-mount case.

The L009 (part number L009UiGS-RM) sits neatly between the small hEX and the larger RB5009: eight gigabit ports, an SFP cage rated at 2.5 Gbit, PoE-out on the last port, and a case that fits a rack. It suits an office or a plant room that needs more ports than a hEX offers, without moving to the size and the price of an RB5009. There is no Wi-Fi in it.

This model's data has been checked against real hardware.

The ports

  • ether1 to ether7, 1 Gbit: ether1 is the WAN port by default, the rest is LAN.
  • ether8, 1 Gbit, with PoE-out: the port for an access point or a camera.
  • sfp1, 2.5 Gbit: the SFP cage, for fibre or a copper module.

With eight copper ports a small office rarely needs a switch at all: a WAN, a handful of desks, a NAS, an access point and a port to spare. The SFP cage is the interesting part: it is rated at 2.5 Gbit, so if your line or your uplink is faster than a gigabit, that is where it belongs. What you actually get depends on the module you fit and on what the other end supports.

PoE-out is off by default and exists only on ether8. You enable it in the Ports section and the script writes /interface ethernet set ether8 poe-out=auto-on. See PoE-out per port.

The switch chip is an 88E6190. The configurator writes VLANs with bridge VLAN filtering, and the warning about lost hardware offload that older chips get does not appear on this model. An office with an office VLAN, a guest VLAN, IoT and management is entirely reasonable here. See VLANs and Bridge and ports.

What it is good at, and where it runs out

A 32-bit ARM processor with 512 MB of memory and RouterOS licence level 5. That memory is ample for a substantial firewall list, plenty of leases, a DNS cache and several tunnels at once; it is not the part you will run into.

The CPU is, as soon as traffic has to go through it. With FastTrack on, plain routing mostly bypasses the processor. A queue tree for QoS switches FastTrack off and hands everything to the CPU, and VPN traffic is encrypted in software. For a tunnel to a second site or a dozen people working from home that is fine; if you want to push a whole 2.5 Gbit line through a VPN, this is not the device. We add no figures: measure it on your own hardware with your own traffic.

The second limit is the cabling: one port faster than a gigabit. If you need several fast uplinks, you end up at an RB5009 or a CCR.

Which roles fit

  • Office router with VLANs: the role this model is meant for. Separated networks, a trunk to a switch or access point, isolation in the firewall.
  • Home router: fine, certainly in a house with a lot of wired sockets.
  • VPN gateway: WireGuard for remote staff, or a tunnel between two sites. See WireGuard and Site to site tunnels.
  • Router + CAPsMAN: route and manage the access points' Wi-Fi at once. An AP on ether8 takes its power from that same port.
  • Hotspot / guest portal: for a venue or a holiday park with a portal page. See Hotspot.
  • Core router: available, but only pick it when you really want routed interfaces without NAT.

Roles that need a radio or a modem do not appear.

The quickest route to a working script

  1. Choose One device, search for L009 and pick Office router with VLANs.
  2. Fill in your internet connection. If your line is faster than a gigabit, choose sfp1 as the WAN port instead of ether1.
  3. Walk through the VLAN table and decide which port becomes the trunk. The configurator makes the last port in the list a trunk, which on this model is sfp1. If an access point on ether8 carries several SSIDs on their own VLANs, set that port to trunk yourself.
  4. Switch PoE-out on for ether8 if an access point or camera goes there.
  5. Set an administrator password, limit management access to your management VLAN, reset and paste the script. See Using the script.

The whole office build, including the firewall between the VLANs, is in Example: office with VLANs.

What trips people up

  • Treating the SFP as a gigabit port. The cage is rated at 2.5 Gbit, but what comes out depends on the module and the far end. After pasting, check what was negotiated with /interface ethernet monitor sfp1 once.
  • Looking for PoE-out on the wrong port. Only ether8 supplies power, which is why the configurator offers only that port in the list.
  • Pasting the script onto a device that is not at factory defaults. The scripts assume a fresh configuration; reset first, or compare the lines against what is already there.
  • Leaving management reachable from every VLAN. Put management on one VLAN and narrow the access list. See Management access.

Want to try it right away? Open the configurator