MikroTik hEX S

A compact fanless router with five Gigabit ports and an SFP slot, running full RouterOS v7 with hardware-accelerated encryption, aimed at budget-minded networking enthusiasts.

Despite its modest 880MHz dual-core CPU and 256MB of RAM, the hEX S runs the same RouterOS v7 VLAN stack as MikroTik's higher-end hardware, including full 802.1Q trunking and per-port VLAN tagging. That's enough to segment a small home lab into management, IoT, and guest VLANs and route/firewall between them, though the modest CPU means it will bottleneck well before its 5 Gigabit ports saturate under heavy VLAN-tagged, NAT'd, or VPN traffic simultaneously. The dedicated hardware crypto chip specifically accelerates IPsec, making it a reasonable choice as a low-power dedicated VPN/firewall appliance sitting behind a separate switch or access point that handles the VLAN-aware wireless side.

Against the MikroTik RB5009UG+S+IN, the hEX S is roughly a third of the price but far slower, with a dual-core 880MHz CPU and 256MB RAM versus the RB5009's quad-core 1.4GHz and 1GB RAM, and no multi-gig ports at all. Compared to the TP-Link ER605 (Omada, $50), both are budget VLAN-capable routers, but the hEX S runs full RouterOS with hardware-accelerated IPsec and a real CLI, while the ER605 relies on TP-Link's simpler Omada controller interface. Against a general-purpose enthusiast router like the GL.iNet GL-MT3000 Beryl AX, the hEX S has no WiFi at all but offers RouterOS's more serious routing and VLAN feature set for wired-first setups. Pairing it with a dedicated access point such as the Ubiquiti UniFi 6 Lite ($99) gives a similar all-in-one result to a mid-range mesh router at a comparable total cost, while keeping routing/VLANs and WiFi as separately upgradeable pieces.