RB4011 (RB4011iGS+RM)

The RB4011 (part number RB4011iGS+RM) has the most copper ports of any router in this manual: ten gigabit ports plus a 10 Gbit SFP+ cage, in a rack-mount case. It suits places where a lot of equipment plugs in directly and you would rather not add a switch: an office, a studio, a plant room, a bench with many networks on it.

Note that this is the version without Wi-Fi. There is also an RB4011 with radios, listed as a separate model. This catalogue entry has no radios, so the Wi-Fi step and the wireless roles do not appear.

This model's data has been checked against real hardware.

The ports

• ether1 to ether9, 1 Gbit: ether1 is the WAN port by default, the rest is LAN.
• ether10, 1 Gbit, with PoE-out: the port for an access point or a camera.
• sfp-sfpplus1, 10 Gbit: for a DAC cable or a fibre module to a switch, a NAS or a server.

Every copper port is gigabit; anything faster goes through the SFP+ cage. That keeps the layout simple: the SFP+ is your uplink to the rest of the network or to fast storage, and the ten copper ports serve everything on an ordinary cable.

PoE-out is off by default and exists only on ether10. You enable it in the Ports section and the script writes /interface ethernet set ether10 poe-out=auto-on. See PoE-out per port.

The switch chip is an RTL8367SB. The configurator writes VLANs with bridge VLAN filtering, and the warning about lost hardware offload that older chips get does not appear on this model. One thing to know: in the VLAN step the tool makes the last port in the list a trunk, which on this model is sfp-sfpplus1. If a copper port is your trunk to the switch instead, set that port to trunk yourself. See VLANs.

What it is good at, and where it runs out

A 32-bit ARM processor with 1 GB of memory and RouterOS licence level 5. Memory is not something you will run short of: long firewall lists, many VLANs, many leases and several tunnels all fit comfortably. The port count is the reason to choose this model, not the speed per port.

The honest caveat is the CPU, and what the hardware is not allowed to handle. Plain routing with FastTrack largely bypasses the processor. Anything that switches FastTrack off, a queue tree for QoS for instance, hands the work to the CPU, and on a 32-bit processor you notice that sooner than on the newer 64-bit models. VPN traffic is encrypted in software and therefore stays well below the line rate of the SFP+ port. If you mainly want throughput, look at an RB5009; if you mainly want ports, this is the device.

We add no benchmark numbers. They depend on your rules, your packet sizes and the number of connections; measure them on your own hardware.

Which roles fit

• Office router with VLANs: the usual role. With ten ports you can put whole departments on a VLAN of their own without a separate switch.
• Router + CAPsMAN: route and manage the access points' Wi-Fi centrally. An AP on ether10 takes its power from that port.
• VPN gateway: fine for tunnels between sites and people working from home, with the speed caveat above. See WireGuard.
• Home router: possible, although ten ports is generous for most houses.
• Hotspot / guest portal: for a venue with a portal page. See Hotspot.
• Core router and Harden only (baseline) are available too.

Roles that need a radio or a modem do not appear for this variant.

The quickest route to a working script

1. Choose One device, search for 4011 and check that you are picking the version without Wi-Fi.
2. Pick Office router with VLANs.
3. Fill in your internet connection on ether1, or choose sfp-sfpplus1 if the uplink is there.
4. Walk through the VLAN table: numbers, addresses, the management VLAN, and access or trunk per port. With ten ports, this is where the work is.
5. Switch PoE-out on for ether10 if an access point or camera goes there.
6. Set an administrator password, reset and paste the script. See Using the script.

The full office build is in Example: office with VLANs. If there are more devices, use a site: Several devices.

What trips people up

• Picking the wrong RB4011. The version with radios is a separate model in the list. Choose the wrong one and your script either has no Wi-Fi or configures radios that are not there.
• Ports that exist but are not in the bridge. With ten of them it is easy to miss one. After pasting, check which ports joined with /interface bridge port print.
• Taking the SFP+ cage for granted. Check with /interface ethernet print that sfp-sfpplus1 has link; a module the far end refuses is not something a script can fix.
• QoS at full speed. A queue tree switches FastTrack off, and on this model that costs noticeable throughput. See Bandwidth (QoS).