MikroTik Router Buying Guide: hEX vs RB5009 vs CCR

MikroTik is unusual among network vendors in publishing a throughput table for every board it sells, measured across packet sizes and configuration modes. That transparency is genuinely useful, and it is also the thing buyers misread most often. This guide explains what those numbers mean, then maps the current tiers onto the jobs people actually buy them for.

How to read MikroTik’s published numbers

Every product page carries a test-results table. The critical detail is that the headline figure is the fast path result at a 1518-byte frame size, with no firewall rules, no queues, and nothing else in the way.

Two consequences follow.

First, large frames flatter the Mbps column. A router forwards packets, not bytes, so the packets-per-second figure is the real capacity measure. At 1518 bytes each, 148,400 packets per second works out to roughly 1,802 Mbps; the same packet rate carrying 64-byte frames is worth about 76 Mbps. Traffic mixes on a real link sit somewhere between, which is why MikroTik publishes several frame sizes and why the small-frame rows are the honest ones for VoIP, gaming, or anything transactional.

Second, the fast-path row is a ceiling, not an expectation. Add connection tracking, filter rules, simple queues, or IPsec and packets take a slower route through the system. MikroTik publishes separate rows for exactly this reason, and the gap between them is often large. The mechanism behind that gap is worth understanding before you spend money, and it is covered in why RouterOS throughput drops when CPU load climbs.

The current tiers, side by side

All figures below are taken from MikroTik’s own product pages: suggested prices as published by MikroTik, and routing throughput from the fast-path, 1518-byte row of each board’s test-results table. Street prices vary by region and reseller.

Model	CPU	Cores / clock	RAM	Ports	Routing, fast path (1518 B)	Suggested price
hEX (RB750Gr3)	MT7621A	2 cores, 880 MHz	256 MB	5x 1G	148.4 kpps / 1,802 Mbps	$59.95
hEX S (RB760iGS)	MT7621A	2 cores, 880 MHz	256 MB	5x 1G, 1x SFP	148.4 kpps / 1,802 Mbps	$79.00
hAP ax3	IPQ-6010	4 cores, up to 1800 MHz	1 GB	4x 1G, 1x 2.5G, Wi-Fi 6	218.9 kpps / 2,658 Mbps	$139.00
RB5009UG+S+IN	88F7040	4 cores, up to 1400 MHz	1 GB DDR4	7x 1G, 1x 2.5G, 1x SFP+	811.2 kpps / 9,851 Mbps	$219.00
CCR2004-1G-12S+2XS	AL32400	4 cores, 1700 MHz	4 GB ECC	1x 1G, 12x SFP+, 2x SFP28	3,138.7 kpps / 38,116 Mbps	$595.00
CCR2216-1G-12XS-2XQ	AL73400	16 cores, 2000 MHz	16 GB	1x 1G, 12x 25G SFP28, 2x 100G QSFP28	6,168.5 kpps / 74,910 Mbps	$2,795.00

The jumps are not linear with price. hEX to hAP ax3 is 2.3x the money for roughly 1.5x the packet rate, plus Wi-Fi 6 and a 2.5G port. hAP ax3 to RB5009 is 1.6x the money for 3.7x the packet rate and a 10G SFP+ cage, which makes that step the sharpest value inflection in the line-up for anyone routing more than a gigabit. Past it the curve turns the other way: CCR2004 is 2.7x the RB5009 price for 3.9x the packet rate, and CCR2216 is 4.7x the CCR2004 price for 2.0x the packet rate. At that end you are buying port density, memory, and 25G or 100G optics rather than forwarding capacity per dollar.

Matching the tier to the job

A home connection up to roughly 500 Mbps, wired, with a separate access point. The hEX is enough, and the hEX S is the same board with an SFP cage and PoE-out on port five. Buy the S variant only if you need fibre in or need to power a single downstream device. Neither has Wi-Fi.

A home connection with Wi-Fi in one unit. The hAP ax3 is the sensible default: Wi-Fi 6 on both bands, a 2.5G port so a faster-than-gigabit service is not immediately bottlenecked, and 1 GB of RAM which matters more than it sounds. The 256 MB on the hEX line is fine for routing and tight once you start running containers, extensive logging, or a large DNS cache.

A small office, a homelab with VLANs, or a symmetric multi-gigabit service. The RB5009 is the board most people should be looking at. Seven gigabit copper ports plus a 2.5G copper port, an SFP+ cage for a 10G uplink or a link to a switch, passive cooling, and a packet rate with real headroom above a 1 Gbps service even once firewall rules are in play: MikroTik’s table puts it at 811.2 kpps on the fast path and still 771.2 kpps with 25 IP filter rules loaded. Note that the hAP ax3 carries the same 1 GB of RAM for $80 less, so the RB5009 is bought for its ports and its packet rate, not for its memory.

An edge router, a small ISP, or anything terminating BGP. The CCR2004 tier is where SFP+ density and ECC memory start; the CCR2216 is where 25G and 100G cages and 16 GB of RAM do. Memory is the specification that matters at this end, and it is the one figure nobody can look up: MikroTik publishes a throughput table for every board it sells but no per-route memory figure for RouterOS v7, so BGP sizing is a planning exercise rather than a lookup. Every full feed you accept is another copy of the table held in RAM, and a router that exhausts memory mid-convergence does not fail gracefully. Size for headroom above the number of feeds you expect, then measure the real footprint on your own hardware before adding another session.

The RouterOS FastPath and switch-chip sizer on this site takes a hardware tier, a FastTrack state, a switch-offload state, and a BGP feed count, and reports the resulting packet ceiling plus a memory-headroom estimate, which is a quicker way to sanity-check a shortlist than reading five product pages side by side.

Specifications that matter more than the headline

Switch chip versus CPU. Every model in the table has a switch chip capable of forwarding Layer 2 traffic in hardware. Traffic that stays inside one VLAN on ports belonging to the same switch chip never touches the CPU at all and moves at wire speed regardless of the routing figures above. Traffic that has to be routed between subnets, or that hits a configuration the chip cannot express, goes through the CPU and is bound by the published numbers. Designing so that bulk local traffic stays on the switch chip is worth more than one hardware tier. The conditions under which offload survives are covered in VLAN filtering on RouterOS bridges.

Port speed versus port count. A 2.5G or SFP+ port is not just about a faster internet service. It is also how you avoid a single gigabit uplink becoming the bottleneck between the router and a switch that aggregates everything else.

RAM. 256 MB is adequate for routing and NAT. 1 GB is the point at which containers, generous connection-tracking tables, and long log retention stop being a consideration. 4 GB with ECC is a BGP specification.

Cooling and noise. Everything through the RB5009 is passively cooled and silent. Rack-mount CCR models have fans, and while some run them slowly at low load, that is a decision to make deliberately if the device lives in an office rather than a rack room.

PoE. Passive PoE-out on a single port, as on the hEX S, powers one access point. It is not a substitute for a PoE switch, and passive PoE is not the same standard as 802.3af/at, so check what the powered device expects before relying on it.

The mistakes that cost money

Buying on the Mbps column alone, without checking the packet rate at a realistic frame size. Sizing against the fast-path row and then building a configuration that disables the fast path. Under-buying RAM because the routing figures looked adequate. Assuming a Wi-Fi model is a downgrade on the routing side when a hAP ax3 outruns both hEX variants. And buying a CCR for a gigabit home connection, where the throughput is wasted and the fan is not.

Whichever board you settle on, the configuration order once it arrives is the same, and it is worth following before the device sees an untrusted network: see securing a new RouterOS box.