MikroTik hAP ax3 vs ax2: Specs, Throughput, Which to Buy

In the MikroTik hAP ax3 vs ax2 choice, buy the hAP ax2 ($99) for a one-AP home on a gigabit-or-slower connection, and buy the hAP ax3 ($139) for a multi-gigabit WAN, a heavy firewall or queue configuration, or more radio power. Both run the same quad-core IPQ-6010, 1 GB of RAM and AX1800 Wi-Fi chips.

The extra $40 buys a 2.5G port, USB 3.0, a CPU clock listed as auto 864–1800 MHz instead of 864 MHz nominal, and higher-power radios on detachable antennas. Every figure below comes from MikroTik’s hAP ax3 and hAP ax2 product pages, whose test tables follow RFC 2544, Benchmarking Methodology for Network Interconnect Devices on the same SoC.

hAP ax3 vs hAP ax2: the spec table

MikroTik publishes no NAT-specific row, so the routing rows are the nearest proxy, and RouterOS has no inline IPS engine to produce an IPS-on figure. The Mbps columns aggregate all ports in the test: the ax2 posts 2,630 Mbps while its WAN is still a 1G port.

Is the hAP ax3 actually faster than the hAP ax2?

Only when the CPU has work to do. On the routing fast path, with no rules loaded, MikroTik’s tables put the two boards within 1.3 percent of each other at every frame size. Add 25 IP filter rules or 25 simple queues and the ax3 forwards 25 to 41 percent more packets per second at 64 and 512 bytes.

At 1518 bytes the rules barely register: with 25 filter rules the ax2 still forwards 216.2 kpps and the ax3 215.3 kpps, because large frames saturate the ports first. At 64 bytes the same rules leave the ax2 at 225.1 kpps (122 Mbps) and the ax3 at 281.8 kpps (153 Mbps), and VoIP, DNS, game traffic and TCP ACKs all live at that small end.

Which row applies depends on FastTrack. The default configuration fasttracks established and related connections, keeping a typical home on the fast-path row. FastTracked packets skip simple queues, so any shaping setup must exclude traffic from FastTrack, and that traffic lands where the ax3’s clock pays off. See why RouterOS throughput drops under CPU load and, for rule order, RouterOS firewall rules explained.

Does the 2.5G port on the hAP ax3 matter?

It matters only if one side of the router runs faster than 1 Gbps. Used as the WAN port, it lets a 2 Gbps or 2.5 Gbps service land at full rate, and four 1G clients plus Wi-Fi can share it in aggregate. No single wired LAN device gets more than the 1G port it is plugged into.

A multi-gig WAN at full rate still needs the fast path: the ax3’s 25-filter-rule row reads 2,614 Mbps at 1518 bytes but 1,145 Mbps at 512 bytes, so keep FastTrack on. Beyond that, or for a 10G SFP+ uplink, the step up is an RB5009 plus a separate AP, compared in the MikroTik router buying guide.

LAN-side, with the WAN on a 1G port, the 2.5G port uplinks to a 2.5G switch so a NAS and the Wi-Fi clients stop sharing one gigabit link. On the ax2, the WAN and the switch uplink both cap at gigabit line rate.

Wi-Fi: same chips, louder radios on the ax3

The radio silicon is identical: QCN-5022 for 2.4 GHz and QCN-5052 for 5 GHz, two chains per band, 574 plus 1200 Mbit/s, sold as AX1800. Maximum PHY rates match, so up close an ax3 is no faster than an ax2. What differs is the front end, the “HP” in the ax3’s product code.

MikroTik’s tables give the ax3 2 to 3 dB more transmit power at every OFDM rate on both bands: 29 against 27 dBm at MCS0 on 2.4 GHz, and 28 against 26 dBm at MCS0 on 5 GHz. The ax3 also ships an HGO indoor antenna kit on RP-SMA connectors, rated 5.5 dBi at 5 GHz and 3.3 dBi at 2.4 GHz, against the ax2’s 4.5 and 4 dBi. Add power and gain and the ax3 is 3 to 4 dB ahead at 5 GHz on paper, and about 1.3 dB ahead at 2.4 GHz.

Two things eat into that. The country setting enforces a regulatory EIRP ceiling, and range is set by the weaker direction: a phone does not transmit louder because the AP does, so a hotter AP yields clients showing full bars that still retransmit on the uplink. If coverage is the problem, two wired ax2s ($198) under CAPsMAN usually beat one ax3. The controller build is in the MikroTik CAPsMAN setup guide, and MikroTik’s WiFi manual strongly recommends RSTP on the bridge of any hAP ax2 or ax3 CAP.

What the two boards share

• The same switch-chip limits. Both use the IPQ-PPE switch inside the SoC on ether1 to ether5, per Switch Chip Features. The bridge hardware offloading table says HW-offloaded bridge support for IPQ-PPE “is still a work in progress” and recommends the default non-offloaded bridge with RSTP; VLAN filtering, IGMP snooping and DHCP snooping are not offloaded. An IoT VLAN is therefore switched in software, and the 64-byte bridge-filter row shows the cost: 347 kpps on the ax2, 468.5 kpps on the ax3. The safe build order is in VLAN filtering on a RouterOS bridge.
• The same software. Both run the arm64 RouterOS v7 image with the wifi-qcom package, and both product pages currently list 7.24.5, so updates arrive together. The license is preinstalled on both.
• The same IPsec ceiling. The IPsec tables are identical, 878.1 Mbps for a single AES-128-CBC + SHA1 tunnel at 1400 bytes, so site-to-site IPsec is no reason to upgrade. Neither page publishes a WireGuard row; treat WireGuard throughput claims for either board as unverified until you measure your own RouterOS WireGuard configuration.
• The same memory. 1 GB of RAM and 128 MB of NAND on each, with only the ax3 offering a USB 3.0 port for container images, a disk share or an LTE modem.

Where the hAP ax3 wins, and where it loses

The ax3 wins on:

• Multi-gig WAN or uplink, through the 2.5G port.
• CPU headroom off the fast path, 25 to 41 percent at small frames.
• Radio margin, from 2 to 3 dB more transmit power and antennas you can reposition.
• License level 6. Level 4 on the ax2 caps PPPoE, PPTP, L2TP and OpenVPN at 200 tunnels each, HotSpot at 200 active users and User Manager at 20 sessions, per MikroTik’s license documentation.
• Environmental rating: tested to 70 °C ambient against 50 °C, MTBF about 200,000 hours against 100,000.

It loses on:

• Price: 40 percent more than the ax2, for fast-path routing within 1.3 percent.
• Power: 38 W maximum against 27 W, and 15 W against 12 W without attachments.
• PoE-out, marginally: 15 W total against 16.8 W, both passive rather than 802.3af/at.

What you actually need

• Gigabit-or-slower service, one AP, LAN plus guest network: hAP ax2. You live on the fast-path row, and the $40 is better spent toward a second AP later.
• 2 Gbps or 2.5 Gbps fibre, or a 2.5G switch with a NAS behind it: hAP ax3, with FastTrack left on.
• Homelab with an IoT VLAN, inter-VLAN policy and queues: hAP ax3, since software VLAN filtering and non-fasttracked traffic are where its clock shows. Past the 1,145 Mbps it filters at 512 bytes, route on an RB5009 and keep the hAP as an AP.
• Two or three APs on wired backhaul: hAP ax3 as router and CAPsMAN controller, hAP ax2 units as CAPs.
• Small business with HotSpot above 200 users or more than 200 tunnels: hAP ax3 for level 6, though at that load the CPU becomes the next wall.
• Fibre on an SFP module, tight budget: the hAP ax S ($79) adds a 2.5G-capable SFP cage, but runs a 32-bit dual-core EN7562CT with 512 MB of RAM and routes 117.8 kpps with 25 filter rules at 1518 bytes, against the ax2’s 216.2.
• Wi-Fi 7 or 6 GHz: neither. The hAP be3 Media ($179) has a quad-core IPQ-5322, 2 GB of RAM, five 2.5G ports and level 6.

Whichever arrives, work through the first-hour RouterOS checklist before it sees the WAN.

FAQ

is the hap ax2 enough for gigabit internet?

Yes, the hAP ax2 is enough for a gigabit service on a typical home configuration. Its routing fast path is within 1.3 percent of the ax3’s, and with 25 IP filter rules it still forwards 2,625 Mbps aggregate at 1518 bytes. The real ceilings are the 1G WAN port and small-packet traffic kept off FastTrack.

does the hap ax3 have better wifi range than the ax2?

On paper, yes, mostly at 5 GHz. MikroTik’s tables give the ax3 2 to 3 dB more transmit power plus 5.5 dBi antennas against 4.5 dBi, roughly 3 to 4 dB more radiated power at 5 GHz and about 1.3 dB at 2.4 GHz. Regulatory limits and weak client uplinks shrink that advantage in a real house.

can i use a hap ax3 and hap ax2 together?

Yes, the usual pattern is the hAP ax3 as router and CAPsMAN controller with one or more hAP ax2 units as wired CAPs. Both use the wifi-qcom package, so they join the same WiFi CAPsMAN, and MikroTik’s WiFi manual strongly recommends enabling RSTP on the bridge of any hAP ax2 or ax3 acting as a CAP.

does the hap ax2 support vlans?

Yes, both the hAP ax2 and hAP ax3 support 802.1Q VLANs through bridge VLAN filtering, but neither offloads it to the switch chip. MikroTik’s bridge offload table lists VLAN filtering as unsupported on IPQ-PPE, so tagged traffic is switched by the CPU, which is where the ax3’s higher clock buys headroom.