Strengths and weaknesses of MikroTik hAP lite RB941. Mikrotik hAP AC - Router for all occasions The best choice in the price category up to $ 25

MikroTik hAP Lite – one of the affordable and renowned routers on the market for similar equipment. Since 2016, the router has been very popular and is not inferior to more expensive and recommended models.

What is the advantage of MikroTik hAP Lite in comparison with other routers, and why the model takes a leading position, we will determine based on technical characteristics router and user reviews.

Set

For an overview of the Mikrotik Hap Light router, see the following video:

The product is delivered in a cardboard box containing:

• instruction;
• power supply unit for 5V and 0.7A;
• Router BOARD hAP Lite (RB 941 2nD TC) is the official model name.

Design

The appearance of the router is shown in the picture:

The microtik hAP Lite has a plastic case, consisting of white and blue parts. The front side of the case is equipped with ventilation holes. On the back side there are activity lamps for the interface of four network ports, two diodes, a multifunctional key and a Micro USB port (for power supply). The bottom of the router is equipped with vents to dissipate heat away from the center chip area.

The case with connectors is shown in the picture:

The shape of the model's case allows the product to be used only in an upright position.

Software and functionality

The functionality of MikroTik hAP Lite RB941 2nD matches the high performance of the Qualcomm Atheros QCA9533 processor. The processor frequency is 650 MHz. The port transfer rate is 100 Megabytes. RAM - 32 MB (16 MB permanent).

The gain of the two antennas of the router is 1.5 dB, which allows you to maintain speeds up to 300 Mbps. The Wi-Fi power of the hAP Lite router is up to 158 mW (22 dB).

WiMikroTik hAP Lite Fi-routeroperates under a specialized operating system - Router OS.

Customization

For a video instruction on setting up a router, see the following video:

The Router OS system is presented in English, and therefore, many users experience certain difficulties when setting up the Mikrotik hAP Lite router . How to configure the router and set the required parameters, we will consider below.

At the first stage, you need to do the following:

1. Connect a router to a PC (tablet, laptop, smartphone). Activate power.
2. Connect the Internet to the router. It is possible to activate the connection via Wi-Fi network. If it is not possible, connect the LAN port of the router and the port network card PC.
3. Connect to the “MikroTik” Wi-Fi network.

If the network password is valid, reset the settings.

Regardless of the presence / absence network connection, you can proceed to the next step. To go to the router settings, you should go to the page at 192.168.88.1. We will get access to the RouterOS control panel. At this stage, you need to make sure that the device is in "Home AP" mode.

How to find out in which mode the router is operating, look at the picture:

The list of parameters is divided into three blocks and looks like this:

• connection to the network (Internet);
• Wi-Fi network (Wireless);
• password to protect the system interface (System).

Dynamic IP Settings

Provided that the Internet is already working through MikroTik hAP Lite in additional settings not necessary. Thanks to automatic connection, you can immediately set Wi-Fi options networks.

For connection type (no dynamic IP), contact your Internet service provider. It should also be clarified whether the Internet provider allows you to bind by MAC address.

Provided there is a dynamic IP and the absence of binding by MAC address, the operation of the router at this stage is carried out in full.

If you need to bind by MAC address, you should designate the MAC address network equipment(either from your Internet service provider or in the "MAC address" field in the router parameters). The equipment address is reflected in the MAC Address field.

Entering parameters when connecting PPPoE

How to connect can be seen in the picture:

This type of connection is not very popular. Here you should select the "PPPoE" connection type and indicate the username and password. Then activate the "Reconnect" button and go to the Wi-Fi network settings. The data containing the username and password is provided by the Internet service provider.

Setting up a password and Wi-Fi network

Let's turn to the “Wireless” section (located on the left side of the page). It is suggested to change the name of the Wi-Fi network in the “Network Name” field. Further, in the opened menu "Country" we designate the password ("WiFi Password").

This is the window where you can change the network name and update the password:

The password to access the Internet must contain at least eight characters. It is also recommended to specify the region where the user is located.

Here you can also specify the list of clients connected to the router, and set the parameters of the guest Wi-Fi network. Before exiting the section, save the settings using the “Apply Configuration” button.

Password for the web interface

In order to protect the RouterOS interface from unauthorized persons, it is recommended to set a password. To do this, it is proposed to go to the "System" section (in the lower sector on the right). Further, in the fields "Password" and "Confirm Password" specify the password. To save the parameters, use the “Apply Configuration” button.

The page for entering a new password looks like this:

At this stage, the user will be kicked out of the system. To re-enter and gain access to the interface, you will need to re-enter the specified password. In addition to the password, you must enter the username (admin).

The login page looks like this:

Router in operation

Numerous positive reviews from the owners of Mikrotik hAP Lite routers testify to the simplicity, but at the same time, the reliability of this router model. The indisputable advantages of the RB941 2nD TC router are:

• the ability to simultaneously connect an unlimited number of gadgets (the scale of the connected devices does not adversely affect the operation of the router);
• price - the cost of the device does not exceed 1,500 rubles;
• compactness;
• functional operating system;
• support - regular updates;
• quality of performance;
• wireless signal strength;
• convenience and simplicity of the interface;
• Micro USB power supply;
• design.

Pay attention to functionality Router Mikrotik hAP Lite and reviews of its work , we can confidently conclude that this model is still the best in its price segment.

The hAPac microtik is supplied with the following configuration:

• MikroTik hAPac (RB962UiGS-5HacT2HnT);
• Power supply 24V 1200mA;
• Quick start instructions.

The appearance of the model does not particularly differ from the classic MikroTik RB951 device. On the front side there are 5 gigabit Ethernet interfaces and an SFP interface of 1.25 Gbps. There is also a connector for connecting a power supply.

hAP ac has the ability to receive power over PoE on the first port. The fifth port can act as a PoE source for MikroTik devices and other compatible devices.

At the top of the model there are indicators of activity of ports, WiFi interfaces and a power light. There are ventilation holes on the top side to dissipate heat from the device.

On the reverse side of the hAP ac there are special anti-slip feet, holes for fastening to vertical surfaces, a sticker with serial number and MAC addresses of the interfaces.

On the side there is a USB interface for connection peripheral devices... There is also a RESET button. It is responsible for resetting the device to factory settings and can control the hAPac boot mode.

Another function of this button is to activate the WPS mode. Designed to quickly set up WIFI between the access point and the client.

If you look inside the router, you can see internal structure devices. The presence of 6 antennas, two of which are fixed on the device body. They can be replaced with external antennas if necessary.

When Mikrotik presented hAP lite at one time, it became a real impetus for wider use of the company's routers. An excellent set of features, rich functionality, flexibility, reliability and an affordable price turned into a real bestseller, which to this day leads the sales ratings of many online stores.

Meet hAP ac²!

Many people mistakenly think that hAP ac² is a replacement for the previous flagship hAP, this is partly true, but not entirely. We'll figure out.

The hAP ac² is delivered in the usual cardboard packaging, the only thing that has changed over the past few years is the pattern added to the box and resembling an embroidered shirt.

As before, the device comes without a patch cord and color printing. However, many would not refuse a quality patchcord.

Due to the matte soft-touch coating, hAP ​​ac² is packed in polyethylene, which should ensure safety until the device falls into the hands of the end customer.

Of the non-standard options, the package contains only a support-mount and a short illustrated instruction on how to use this very stand.

The article of the model turned out to be very intricate - RBD52G-5HacD2HnD-TC, if for the same hEX in places when communicating on the forums users could use the article identifier, then in the case of this model, not everyone will succeed in remembering the article the first time.

However, a lot of information can be gleaned from the article:

RB - RouterBOARD

D - Dual-Chain (Full)

52 - Dual-Band 5 + 2.4 GHz

G - Gigabit Ethernet

5HacD - 5GHz 802.11ac, High-Power (Type 1), Dual-Chain

2HnD - 2.4GHz 802.11n, High-Power (Type 1), Dual-Chain

As for the transmitter power, Mikrotik has 4 gradations:

normal power (no index), less than 23-24 dBm;

H - increased power, 23-27 dBm;

HP - high power, 25-29 dBm;

SHP - very high power, more than 27-30 dBm;

Actually, "type 1" means the index "H". But the index "U" (USB) is not used in the name, although this interface is present here.

In general, the design itself is rather unusual. The company continues to experiment with the Tower-Case, with the hAP lite TC being the first "experimental" device. Then hAP ac lite TC (RB952Ui-5ac2nD-TC) and hAP mini (RB931-2nD) appeared.

Surveys show that almost 70% of respondents approve of the domesticated design of the hAP ac2.

The indicators and the interfaces themselves are located on opposite sides, which is the standard for home and SOHO solutions. The port indication is not very convenient, but it is not intrusive and will not bother you with its work at night.

All 5 interfaces are shielded, and there is no ground connection on the case.

In addition to the power indicator, hAP ​​ac² also has an additional user indicator, which is convenient to configure, for example, according to the status of the VPN connection.

The WPS and reset buttons are combined, you no longer need to carry a paper clip with you, now a pen or pencil will do - holding the button for a long time is still inconvenient, which will protect against accidental reset.

One of the highlights in the hAP ac² design is the stand.

It's not just a stand, it's a ceiling or wall mount. We have already installed one of our clients this device it is on the plasterboard ceiling. The installation process is quick and convenient, with a placement height of 4 meters there are absolutely no problems with the quality of the coating.

The element is fastened with a latch to the bottom edge or to the cover. In the first case, you will receive a desktop standing version, in the second - a desktop recumbent version, or a wall (ceiling) mount. On the legs there are silicone inserts that provide anti-slip properties of the stand.

The ac2 itself is extremely compact, the size of the novelty is comparable to the usual hAP lite, and in a standing position it takes up a minimum of space.

Filling Mikrotik hAP ac²

Many owners tried to look into the insides of ac ^ 2, but not everyone succumbed to it, some of those to whom it succumbed simply broke the latches. For this reason, we urge you to refrain from opening this model.

The first thing worth paying attention to is the closedness of the internal space of the case. That is, there are ventilation "slots" on the front panel, but it is not necessary to say that they especially improve ventilation. The filling of the device easily warms up to 45 degrees when idle, and during load it can rise up to 52 degrees.

You shouldn't panic about this, the old hAP ac warmed up much more. The device that we have chosen as a server even warms up to 62-65 degrees in idle time.

Almost half of the upper part of the RBD52G-5HacD2HnD-TC board is covered with a massive needle-type heatsink.

On the same side of the board, 2 antennas, interfaces, a power subsystem and a USB port are soldered.

There are 4 mounting holes along the perimeter of the board, probably the company has previously experimented with different case options, including the classic one.

All the basic stuffing of hAP ac ^ 2 is on back side PCB.

The device is based on the Qualcomm IPQ-4018 chip. It is a highly integrated solution combining a 32-bit ARM processor and wireless modules.

Despite the strong resemblance to the IPQ-4019, these 2 chips are not interchangeable. The older IPQ-4019 has a larger physical size, a different design and wiring diagram.

Although in general, IPQ-4018 and IPQ-4019 differ only in the set of interfaces.

The main computing unit of the IPQ-4018 is 4 ARM Cortex A7 cores with a clock frequency of 717 MHz. The chip includes a Hardware NAT and Crypto Engine block, as you might guess, the first block is responsible for NAT unloading, the second for hardware encryption.

Both wireless modules are MIMO 2x2 (Dual-Chain) configurations, with each module having its own co-processor that provides hardware offloading. They are labeled CPU # 1 and CPU # 2 in the block diagram.

At the output of each chain, one amplification unit is wired (hidden under the screens), in total there are 4 of them.

If you look at the official hAP ac2 block diagram, it lists the AR8327 gigabit switch, and it is labeled as built directly into the IPQ-4018.

At the same time, next to the processor, the QCA8075 is soldered on the board, which implements 5 gigabit ports.

If we return to the official Qualcomm block diagram, the IPQ-4018 contains "5GE L2 / 3/4 Switch Engine", a little to the left of the diagram there is an external block "QFE8075 / 2 (5/2 ports PHY)".

Thus, in fact, the physical layer (PHY) is implemented on a separate external chip QCA8075, but the rest of the harness is located directly in the SoC. RouterOS itself identifies the switch as Atheros-8327.

As usual, there is not a lot of permanent memory - only 16 MB (Winbond 25Q128JVSM).

The situation with RAM is more interesting. Officially for hAP ac2 128 MB declared random access memory... At the same time, the first batches are equipped with 256 MB Nanya NT5CC128M16IP-DI chips.

The end user has 233 MB available. Mikrotik confirmed this fact, but they will not correct the description and characteristics for hAP ac ^ 2, because there are batches with 128 MB. Someone from the logistics department messed up a lot.

So far, we have not come across a single device with 128 MB, all copies we tested were equipped with 256 MB of RAM.

The hAP ac2 platform will be partially used in the RB450Gx4, although it is based on the IPQ-4019 with disabled wireless interfaces... The cost of the board will be almost double that of the tested device. In return, Mikrotik offers 1 GB of RAM, 512 MB of NAND Flash, a 5th license level and microSD support.

HAP ac 2 performance with L2TP / MPPE

At the moment, there is a fairly wide range of possibilities for combining remote networks into a single computer network... The most popular tools are PPTP, L2TP, OpenVPN, and IPsec.

PPTP is the oldest and most insecure protocol, at the same time, oddly enough, the overwhelming number of Mikrotik users for remote connection use the outdated pptp protocol. Due to the fact that this protocol is completely outdated and even in Apple devices its support has been discontinued, we will not test this protocol.

The most optimal protocols are IPsec and OpenVPN.

IPsec is one of the most secure methods of network interconnection available today. With strong AES encryption with support for 128 and 256-bit keys, this protocol provides the highest reliability and confidentiality of transmitted data, which can be of critical importance for business and government agencies. Today, even using the power of supercomputers, it will take billions of years to decrypt data encrypted with AES. Cons of this method also available - the presence of external static IP at both ends of the connection and high requirements for the hardware platform. In principle, an IPsec connection is also possible between dynamic IPs, although in this case you will have to reconfigure the parameters each time one of the addresses changes. The hardware platform is also not so simple, budget RouterBOARDs entry level can provide at best 10-20 Mbit with a full CPU load.

More advanced devices such as RB750Gr3, RB850Gx2 (discontinued), RB450Gx4, RB3011, RB1100AHx2, RB1100AHx4, and CCR1009 are capable of faster IPsec speeds. With the advent of hAP ac2, this list can be supplemented with one more model, but first things first.

There is also the possibility of using L2TP in conjunction with IPsec, the main advantage of this combination is high security, quick and easy configuration, as well as great loyalty to NAT on the end client side. Of the serious disadvantages of this option, it should be noted that very high requirements for the hardware platform are, perhaps, L2TP / IPsec is the most demanding protocol. It's all to blame for the double encapsulation of data and the need for encryption.

The OpenVPN protocol, which is based on the OpenSSL library and the SSL / TLS protocols, is devoid of these shortcomings. OVPN itself is extremely flexible in configuration and even allows you to mask traffic as normal HTTPS, making it possible to bypass all sorts of restrictions on the part of the provider. Generally, OVPN is faster than IPsec and still supports a variety of encryption algorithms, including AES. There are still disadvantages to this method - more complex configuration and high hardware requirements (as well as for IPsec).

For our part, to begin with, we will test L2TP with standard MPPE 128-bit encryption.

L2TP is more reliable and secure compared to the previous generation protocol - PPTP. We strongly recommend that you abandon the use of PPTP in favor of more modern protocols... If you do not have the ability and / or desire to use OVPN / IPsec / L2TP + IPsec, we recommend using L2TP / MPPE.

The main recommendation for increasing L2TP / MPPE security is to use very long passwords consisting of a set of random letters (with different layouts), numbers and special characters. The use of "dictionary" passwords is not recommended, since L2TP / MPPE has a number of shortcomings that allow using dictionary methods of password guessing, which ultimately leads to a decrease in the security of a 128-bit key, making it equivalent to 56-bit (). In any case, this is much better than using PPTP.

As a pair for hAP ac2, we chose the proven CCR1009 platform, namely the.

It is the most affordable member of the CCR line, which has a powerful 9-core Tile Gx processor and 1 GB of RAM. This combination provides high productivity and the ability to handle up to 2.5 Gbps of IPsec traffic.

During testing, stability and reliability were additionally checked under high loads, performance data are indicated for user traffic (useful traffic), the average sample is taken into account. Peak performance values ​​are not included in the calculation of the average indicator if their duration is less than 30 seconds.

On both sides, PCs with iperf are used as traffic generators, which gives more reliable values ​​and flexibility than the built-in BTest.

CCR1009 - WAN IP 192.168.106.20 / VPN 10.0.0.1 / LAN 192.168.1.0

hAP ac2 - WAN IP 192.168.106.30 / VPN 10.0.0.2 / LAN 192.168.2.0

For CCR1009, a manual configuration was used, similar to defconf on low-level devices. ETH1 (not Combo) is used as WAN, standard Firewall rules, port 1701 is additionally open.

The L2TP Server configuration is based on a standard encrypted profile, MTU has not been changed, and the "Allow Fast Path" option is additionally activated.

All legacy authentication methods MSCHAP1, CHAP and PAP are disabled, only MSCHAP2 (MS-CHAPv2) is active.

In modern realities, it is best not to use compression for maximum performance.

On the client side, the settings are similar, the default profile with encryption is used, as well as the "Allow Fast Path" option.

Routing to remote network provided by a static route in combination with NAT masquerade, the default route is not used.

Both devices have a fasttrack connection configured in the Firewall for established and related connections.

At the output, we have a classic combination of 2 networks based on L2TP / MPPE

Depending on the direction of traffic and configuration, CCR loads 1 core, or distributes calculations between all 9 cores. For example, when sending data from CCR, 1 core is used, while when receiving data for decryption, all cores are loaded evenly.

Packet exchange of 1400 bytes, TCP mode

The first throughput test is done for 1400 byte packets.

The average performance of a 1-thread test is 112 Mbps for receiving and 128 Mbps for sending.

With an increase in the number of sessions to 10, the speed changes to 111 and 170 Mbit, as you can see, there is an increase in performance for sending with an increase in the number of sessions.

There is no special increase for Download, regardless of the size of the packages. Interestingly, in all these cases, the IPQ-4018 utilization averaged up to 25%. Only 1 core is loaded, only occasionally the system performs unloading on other cores - in multi-threaded modes.

A further test is carried out for Upload and we increase the number of sessions to 20 and 100, as a result, the speed increases to 201 and 235 Mbps, respectively.

For additional monitoring during the tests, the Tools - Profile tool was periodically used, with which we tracked the distribution of resources and their load.

Actually, it clearly shows that with an increase in the number of simultaneous connections, RouterOS, albeit with a bias, distributes part of the calculations to the rest of the cores. Along with the increase in performance, the load on the CPU rises to 35-45%.

The last test in this block is carried out for FDX (Full Duplex) with 10 opposite connections in each direction, for a total of 10 + 10 sessions.

As a result, the overall throughput amounted to 185 Mbit.

The resulting performance diagram for 1400-byte packets looks like this:

Home router, which is a compact device that is ideal for your apartment, home or office. The device uses the proprietary operating system RouterOS with all the functionality: bandwidth control, firewall, user access control and much more.

There is support for the WPS function, activated from the button. It allows you to connect to wireless network without input complex password as well as switch to cAP mode and connect to the centrally managed CAPsMAN with a single click. By using proprietary utility MikroTik CAPsMAN you can manage all your access points from one place. At the same time, unlike other software controllers that require a separate computer to run, CAPsMAN works right on the device with operating system RouterOS, for example on a network router.

The router is equipped powerful processor 650 MHz, 32 MB RAM, 2.4 GHz dual-trunk wireless module, four ports Fast Ethernet and RouterOS Level 4 license.

Specifications

Transmitter specification

Contents of delivery

The results of measuring the performance of the processor

From time to time we tell you about different routers. As a rule, these are TP-LINK or ASUS devices - market leaders. But people glorifying MikroTik appear in the comments with enviable regularity. At the same time, they are praised for a reason, but for their functionality and stability. Today, using the MikroTik hAP lite (RB941-2nD-TC) as an example, we will try to check whether this is actually the case.

MikroTik hAP lite is one of the most affordable routers from the manufacturer. It comes in a very simple box of recycled, unpainted cardboard. It contains a schematic diagram of the device, as well as basic information on initial setup(IP-address of the router, login "admin", url-address of instructions for updating the firmware).

Inside is the router itself, the power supply and a miniature brochure.

Design

RB941-2nD-TC looks very simple and cute in its own way. The body is made of glossy plastic, it consists of only two parts, white and blue, and is very light, you might even think that the frame itself was in the hands without the "filling".

Within the manufacturer's line, this is a design with delights, the device is also intended for home use, although in comparison with all mass routers I would like to call hAP lite a "box".

The manufacturer has provided only vertical installation, this is clearly hinted at by the shape of the case. There are large air vents on the front and bottom sides.

All elements and connectors are at the back. These are four network ports with activity indicators, two status diodes, one multifunctional key (used for WPS connection, reset settings, switch to proprietary CAP mode, and also to restore firmware over the network), as well as a microUSB port. The latter is used not to connect drives or printers, but for power.

The box contains a 5V and 0.7A power supply, which means that the RB941-2nD-TC can work from almost any source - from charging your smartphone, PC or power bank. Such versatility can come in handy, for example, in the event of a power outage - if the provider's equipment is equipped with a UPS, then the router will be able to work for several hours from a small power bank (the declared power consumption level is up to 3 W) and at this time you will have the Internet.

Software, functionality

The router is based on the Qualcomm Atheros QCA9533 processor operating at 650 MHz. The amount of RAM is 32 MB, permanent memory is 16 MB. All network ports are 100 Mbps.

Two antennas with a gain of 1.5 dBi are hidden inside the case; they provide connection speeds of up to 300 Mbps according to the 802.11 b / g / n standard. Transmitter power - up to 158 mW (22 dBm).

The router runs Router OS with a Level 4 license - this feature rather affects the corporate functions of the device that are of little interest to the home user. You can use the WebFig web interface, Winbox utility, console and remote access... Consider (superficially) the first option.

The usual "admin panel" is available at 192.168.88.1. At first glance, the interface is similar to that offered by the devices of conditionally competing brands - on the left there is a list of items, on the right there are parameters. The interface is only available in English.

For the initial setup, you need to use the first Quick Set tab. It allows you to select the type of connection to the provider, the operating mode of the device, conduct a basic Wi-Fi setup(set password and network name, select frequency and country). There is also a simple map of the wireless client network.

All other points are intended for fine and thoughtful configuration of the router. I would like to note that if you can understand the "admin panel" of some TP-LINK or ASUS on the basis of general knowledge, names of specific items, and so on, then such a "number" will not work here. Easy-to-understand guest settings Wi-Fi networks or parental control not in WebFig, although similar and much broader functionality is present. To figure out what's what, it's worth looking intoofficial documentation or use one ofstep by step instructions .

Despite the complexity of the configuration, the system allows you to do a lot of interesting things, for example, configure a simultaneous connection to two providers, limit the access speed for clients connected to a specific network port, the router can operate in bridge or repeater mode, VPN connections are supported, and much, much other. The only thing is that you will need fundamental knowledge of how networks work and an understanding of the logic for configuring the desired functions.

Testing and operation

Since the router only has 100 megabit network ports, I used home connection to the Internet at a speed of 100 Mbps. Both with a cable connection and over Wi-Fi, the access speed was consistent with the declared one.

For several days of use, I had no complaints about the stability of the router, it normally "holds" the home load when, for example, you download torrents on one computer, watch Full HD videos online and surf on your smartphone in parallel. Despite the built-in antennas, the router can create normal coverage in a one- or small two-room apartment. I liked the quick response to changing the settings, the built-in functions for updating the firmware without the need to select the firmware file separately, the ability to overclock the processor.

More detailed results of the speed characteristics of the router are given by the manufacturer himself:

Site score

Pros: Simple design, incredible functionality (if you're fumbling), microUSB power, price

Minuses: Complexity of customization for ordinary users

Output: MikroTik hAP lite RB941-2nD-TC is an excellent router that you need to present to your girlfriend - if you reinstall Windows once a month, then MikroTik will be able to administer it almost every day. Seriously speaking, from the point of view of hardware, hAP ​​lite is similar to other routers for 600 hryvnia, but the main thing here is software that will allow you to configure it as finely as even flagship consumer routers do not allow. This device is for those who not only understand how each byte of information "goes", but also wants to have over them full control... If you (suddenly) like to understand for a long time how something works, and then enjoy and be proud of the work done - hAP lite is also suitable, because it is a wonderful construction toy (or tool) for inquisitive minds and crazy pens, as well as those who want become a system administrator. Well, if you are a simple user for whom a router is a utilitarian box that distributes the Internet and requires a reboot once a month, it is better to continue rebooting the existing router.