Hello.
I have two fibre connections, one at 1000 and the other at 500, and I’d like to set up a failover. Can it deliver the maximum speed (940 Mbps) of the gigabit cable and perhaps set up a VPN for two devices, limiting the data to around 30 Mbps each? But the main focus is the failover with connection testing, and ideally some way for it to notify me when a link goes down and again when it comes back online. Also, would the Wi-Fi version be capable of delivering 1 Gbps via the port to an external Wi-Fi router and using a bit of the secondary link for the wireless network in the house? Many thanks in advance!
The confusing answer is going to be: it depends.
In practice, I don't think L009 is powerful enough for your goals.
It's a router, yes, but not a really good one when comparing it to others.
Also, CPU is rather limited (you mention VPN and rate limiting).
For the target audience it was initially released for (drop-in replacement for RB2011), it's a perfect device.
For what it is worth, I also have it at home and I use it as ... a simple managed switch.
RB5009 is a lot more powerful and more future proof.
If you really are looking at a wifi-version of a router, have a look at hAP AX3.
Check also this recent thread:
the "magic number" for the l009 is 323.6 Mbits, no way it can manage fully a 1 Gb connection, the same suggestions given there are valid for your case.
YMMV
When doing about 4-450mbps download on L009, with fasttrack, queueing, plenty fw rules, i see about 5-60% cpu use.
Basically, no.
It might be able to do it with a carefully crafted configuration where you don't have to turn off fasttrack. If the vpn is really restricted to 30 Mbps, that should pose no problem for any device.
As the others have said, the L009 is not an especially strong router in the Mikrotik lineup. The smallest (cheapest) one that can handle your load comfortably is the hAP ax3. The ax2 can barely/almost do this also. These also have built-in wifi.
However, if your budget allows, the rb5009 is the ideal device for this with plenty of headroom. Sadly, no wifi.
The hardware question is covered above, so here is the part you said matters most: failover with a real connection test plus notifications. This works the same on L009, hAP ax3 or RB5009 (RouterOS v7).
1. Failover with recursive routing
A plain check-gateway only notices when the ONT/modem is gone. Recursive routing pings a host on the internet through each line, so an outage at the ISP is detected too.
/ip route
add dst-address=1.0.0.1/32 gateway=<ISP1-gateway> scope=10 comment="probe WAN1"
add dst-address=9.9.9.9/32 gateway=<ISP2-gateway> scope=10 comment="probe WAN2"
add dst-address=0.0.0.0/0 gateway=1.0.0.1 target-scope=11 check-gateway=ping distance=1 comment="WAN1 main"
add dst-address=0.0.0.0/0 gateway=9.9.9.9 target-scope=11 check-gateway=ping distance=2 comment="WAN2 backup"
Use probe addresses you don't use as DNS servers, because traffic to them is pinned to one line. If your ISPs hand out the gateway via DHCP, set add-default-route=no on both DHCP clients and keep the gateway updated with a small DHCP client script.
2. Notification when a line goes down and comes back
Netwatch pings the same probe address. Put the actual message into a script, that avoids quoting trouble:
/system script
add name=wan1-down policy=read,write,test source="/tool fetch url=\"https://api.telegram.org/bot<TOKEN>/sendMessage?chat_id=<CHAT_ID>&text=WAN1%20down\" output=none"
add name=wan1-up policy=read,write,test source="/tool fetch url=\"https://api.telegram.org/bot<TOKEN>/sendMessage?chat_id=<CHAT_ID>&text=WAN1%20back%20up\" output=none"
/tool netwatch
add host=1.0.0.1 type=icmp interval=10s down-script="/system script run wan1-down" up-script="/system script run wan1-up"
Note the policy=read,write,test on the scripts: with the default policy, netwatch refuses to run them ("not enough permissions" in the log). Same again for WAN2 with 9.9.9.9. Test it once by unplugging WAN1: you should get both messages. When WAN1 is down, the message simply leaves via WAN2. E-mail works too with /tool e-mail send, if you prefer that over Telegram.
3. VPN for two devices at 30 Mbps each
WireGuard plus one simple queue per peer:
/queue simple
add name=vpn-dev1 target=10.10.10.2/32 max-limit=30M/30M
add name=vpn-dev2 target=10.10.10.3/32 max-limit=30M/30M
Fasttracked connections skip simple queues, so exclude the WireGuard subnet from your fasttrack rule. At 2 x 30 Mbps the CPU load is small on any of these devices.
4. Wi-Fi network via the second line
No mangle needed, a routing rule is enough and keeps fasttrack working:
/routing table add name=via-wan2 fib
/ip route add dst-address=0.0.0.0/0 gateway=9.9.9.9 target-scope=11 check-gateway=ping routing-table=via-wan2
/routing rule add src-address=192.168.20.0/24 action=lookup table=via-wan2
With action=lookup the Wi-Fi falls back to WAN1 if WAN2 fails. One catch: if your external Wi-Fi router does its own NAT, the MikroTik only sees one IP, so it is all or nothing. Run that router in access point mode with its own subnet or VLAN and you can steer it cleanly.
Hope that helps, happy to look at your config once you have it running.
For #1, just in case:
Simple recursive failover for bears of little brain
Thanks, good pointer. Your spreadsheet explains the scope/target-scope values properly, my example relies on RouterOS correcting them on its own. Worth reading before copying the lines.
Yep, once said that if it works, it works 
, making it formally correct will (should) prevent possible changes in the way RouterOS auto-corrects (or fails to auto-correct) the values in a future version.
Yeah, an Electronics Recycling depot in my area thinks L009UiGS is so good, they even decided to list at above the retail market price with no accessories. 
Went through exactly this decision a few weeks back with my own setup. I had a 500 Mbps line and was torn between saving money and future-proofing. Ended up with a second-hand hAP ax2 and for a simple home setup it's been fine, but reading this thread I'm glad I don't need full gigabit routing — that 323 Mbps number jaclaz mentioned would have bitten me hard. If the budget stretches, the RB5009 advice above is the one I'd take. The headroom is worth the extra.
When ever someone buys stuff at "thrift stores" or other resale sites like ebay, they better do their homework before buying.
I just saw this on ebay: I can't imagine why anyone in the USA would buy from this seller.
Maybe the "wireless" means they don't include any wires?
And this is being offered for US $441.00 plus $35 shipping from Shenzhen, China.
US $35.00 eBay SpeedPAK Standard. See detailsfor shipping
Located in: Shenzhen, China
Oddly, the seller has a 99.5% positive rating. Go figure.
Just in case, at least for Mikrotik devices, It Is possible to get an approximated idea of the age of the used device (shameless plug):
Mikrotik dates - A little exercise in futility