I wanted to learn working with Mikrotik devices and RouterOS, so I bought an RB5009UPr+S+IN.
So far, I have no easy start.
I powered on the device and connected it with a direct cable to my Windows host (laptop).
When using port 1 of my router, I get no IP address. When using port 2 on my router, my Windows host gets 192.168.88.254 assigned by the DHCP server in the router. The default gateway is 192.168.88.1.
So I figured I have to use port 2 and my cable is fine as DHCP is working.
This is where the good luck stops.
What I did:
I disabled my Firewall.
My ping requests to 192.168.88.1 get no response.
WinBox (v4.0.1) cannot find the device reliably. But hitting Live/Pauzed button a couple of time makes it being detected sometimes. When I hit refresh it disappears again.
Connecting via WinBox using the MAC or IP (or IPv6) does not work.
Accessing 192.168.88.1 via http or https in a browser gives timeout / unreachable error.
Perhaps, my config is corrupted somehow. I tried to reset the device to factory default but this seems not to work (as by the documentation, but my devices does not seem to have the hidden user LED behind the reset button).
The reset procedures I tried:
Remove power.
Hold reset button while applying power.
Keep pressing reset button for 60 sec.
Release reset button, wait 60 sec.
There is some response in the leds going on/off/dimm but no change in behavior.
I also tried:
Remove power.
Apply power, immediately press reset button.
Wait a few secs until the lights go on.
Release reset button and wait 60 sec.
Also no change.
I’m stuck and don’t know how to proceed.
Perhaps my device is faulty? But before drawing this conclusions I consult this forum.
I hope you can be of help. Like what the proper RESET procedure is. Or how to enter `Netinstall` mode (not yet attempted).
What are you trying to achieve here, just talk to the router?
Port 1 is often a WAN port, designed to connect to an ISP so you cant talk to it.
Use the other Ethernet ports which are normally assigned by default to the LAN.
My replies are very delayed as I they need to be approved. My appologies.
By “disabled firewall“ I mean that I disabled the firewall on my Windows host system (my laptop) so this cannot interfere with any connection attempt or the operation of WinBox.
I wish I could enable/disable the firewall in the Mikrotik router but as I cannot access it, I cannot do such things (yet hopefully) :).
I figured about the port 1 being a WAN-port, so I ‘always‘ try using port 2 but I also tried the others.
In the rare event WinBox detects my router (in the Neighbors section).
I double click the MAC address.
Then, I clearly see increased activity on the router’s port because the green led starts flashing.
But after a few secs, WinBox just tells me: ERR: Could not connect, MacConnection syn timeout.
When I manually type the IP address (192.168.88.1) after confirming my NIC got this IP as gateway from the DHCP in the router, I get this error from WinBox: ERR: Connection timed out
Only 2 times (I believe using MAC) I saw WinBox going from Connecting to Authenticating.
But then it gives this error: ERR: Too many resends. The other part is not acknowledging data receivements. Timeout.
I cannot reproduce both events: WinBox detecting the router or going to the Authenticating step. But detecting happens much more often then a connection attempt going toAuthenticating.
BTW I use the password on the sticker. But I don’t think it get so far as needing the password unfortunately.
I’m trying to achieve access to the router so I can configure it.
In which I'm not succeeding. I can’t even ping it although I get an IP from it with as gateway: 192.168.88.1
Also access via MAC is failing.
To be honest, try accessing it using a linux system. Because with that, you make sure there is not any crappy windows security system in between preventing access to it.
Then, use Winbox to access the router through ether2 port and make sure you use th MAC Adress.
If that does not work, reset the router.
And in the end, if that does not work, reimage the router using netinstall. Quite easy process under Linux as you don’t have to work around all Windows and security software.
No fan of Windows I see, that is fine and reasonable :).
I will try from Linux but I’m 99% sure it is not any Windows security related stuff on my host.
But still, thanks for the tip, I will try!
Already anticipating: about the next steps:
How do I reset the router?
The documentation has a procedure using ‘user leds behind the reset button’ that my router does not have. So as it is not working, and I don’t get any feedback from this led, it is hard to know if I do it correctly.
Also, how do I put it in netinstall mode?
As I lack the same feedback :).
Yes sir, just a cable in between, no other hardware.
Wow! I will try it.
I did and it made no difference.
I’m not from the marketing department and I like the interface of v3.x better .
But I read somewhere that older WinBox versions may not work correctly on newer Mikrotik devices.
I don’t know, I have never been able to access it.
O wait, I do know from a screenshot in the rare occasion WinBox detected the router.
It is version: 7.19.6 (stable) 2025-09-12 09:02:42
7.19.6 Is a "good" version, so It isn't a version issue (and surely Winbox v3 works fine with It).
Try on you PC also disabling DHCP and manually settings 192.168.88.2 netmask ,255.255.255.0 gateway 192.168.88.1.
Another thing to try Is interposing a "dumb" switch between the PC and the router.
Finally, before thinking of netinstall, try with another PC, while netinstall may need on both Windows and Linux some firewall settings disabled, any PC should be able to connect (via Webfig or Winbox) with normal settings.
The reset procedure (using the backup bootloader, i.e. pressing the reset button before applying power) needs the button being kept pressed for roughly 5 seconds (these may vary a little from device to device), but as soon as you see led activity, you should release It.
If you keep It some 5 more seconds or so Ieds lights become fixed It should go in caps mode.
If you still keep It pressed It should go in netinstall mode (leds off).
Also, I would remove all cables other than power and the one you are connecting to the RB5009. It almost seems there may be an ip conflct. Does your network have any other devices in the 192.168.88.0/24 network?
Some relevant posts that corroborate what jaclas said:
For netinstall, make sure you use the designated LAN interface. If you physically connect your device to the WAN interface, you won’t be able to connect (default configuration prevents that).
The reset button gives you to options (as stated by @Buckeye ).
Make sure you have a direct physical connection between ether2 and your computer and configure the network interface with an IP-Address of the 192.168.88.x range. The x=1 will be the router, so pick any other → I tend to pick 3.
Under Linux, start netinstall on my laptop with:
sudo ./netinstall-cli -r -a 192.168.88.3 -i eth0 routeros-7.19.4-arm.npk wireless-7.19.4-arm.npk
eth0 is the device designation of my network interface - don’t know what the equivalent network interface names would be under Windows.
Once you have started netinstall and it found the interface, hold the reset button of your router and power it up. Wait until the led’s turn off (~20 seconds) then release.
You should see on your netinstall-cli that he is doing something.
Which means your Linux has an insecure firewall configuration. Because in a typical secure Linux FW setup (allow established/related/icmp, drop other inbound), using WinBox 4 to connect to RouterOS with MAC address is not possible, until you poke holes in the firewall.
My system is connected directly to the RB5009 by cable. My Linux laptop is installed the pessimistic way: nothing is exposed, no inbound services are running, so there’s no real need for a local firewall. Unlike Windows, which too often follows the optimistic model: enable everything, then try to plug the leaks afterward.
This is also a point-to-point connection, so each end has to see the MAC address of the other. Kind of how it works.
As for firewalling, I already have it where it belongs: at the border gateways, not inside the house.
Microsoft marketing has done a great job convincing people that every device needs a firewall and layers of antivirus. But if a device exposes no services, there’s nothing to reach. And antivirus often digs so deep into the system that it becomes part of the attack surface itself. Putting extra security software on top of a weak design is like putting a better lock on a tent.
Hmm. could be. I always test the ports until it works. And tend to put it on eth2 as that’s where I can connect to the device after the installation. Could also be I do it after the netinstall
There is some understandable confusion about ports. Netinstall only works on a specific port for each model, on the rb5009 this is ether1.
What causes some of the confusion is that the default configuration assumes a given WAN port, and the firewall doesn't allow management connections from this port. This chosen port is often the same (so, again for the rb5009, ether1).
This means that the only port where netinstall works is also the only port from which a Winbox (SSH, Webfig) attempt does not.
I guess you never bring your laptop out of the house, to hotels, coffeeshops, conferences? And all devices in your house are each in their own isolated VLAN or you otherwise install no apps on your phones? And you laptop only runs web browsers?
@tangent
Has made a detailed article explaining why the most complex way to run netinstall (in a VM) is also the simplest one as it by-passes two common issues:
.
as it by-passes two common issues: