Unable to access new RB5009UPr+S+IN router

Thank you all for the help!
I have access to the device now! :grinning_face_with_smiling_eyes:

The magic touch was:

I needed to get the switch, but when I did this, WinBox immediately detects the router constantly and stable. And logging in just work as expected. From a Windows machine by the way with firewall enabled as normal :).

I don’t fully understand though. The cables I also tried when connecting the Mikrotik router directly to my laptop. But interposing the switch makes it suddenly work?

Why? How can this make such a difference? Maybe I learn something.

The exact reason is not very clear, but essentially I believe it is a timing issue of some kind, the switch (even the dumbest one) has a sort of queue or cache that "levels out" the connection in some ways.

The actual issue is likely in your laptop, I don't think related to any settings you have on the OS on it, rather the network adapter on the motherboard, some chips (for whatever reason) don't like to talk to Mikrotik.

firewall, AV ???

I did some tests and it is what I was afraid off. For now I just use my RB5009UPr+S+IN router as switch (I don’t use port 1 (WAN)). So I only use the bridged ports.

When my modem is connected to the Mikrotik router and my ‘dumb‘ switch is also and my laptop is connected to the ‘dumb‘ switch. All works as expected and I can access the internet.

When I remove the ‘dumb‘ switch and connect my laptop directly to the Mikrotik, I’m unable to access it, but I’m also unable to access the internet while my modem is connected to the Mikrotik.

This indeed seems to mean that my laptop is incompatible with the Mikrotik.

I do a lot of networking with many devices at many locations. However, I have never ever encountered a networking device to be incompatible with my laptop like this. I wonder, if I buy more Mikrotiks, what incompatibilities I encounter with the variety of equipment and manufacturers I want to connect to it.

Is there some setting in the Mikrotik I can change to make it more compatible? Or is there some clear reason why this happens so I can maybe solve it on my Laptop?

(For sure it is not related to firewall/anti-virus or something on my laptop :slightly_smiling_face:, then it would also not work with a ‘dumb’ switch in between.)
The issue seems to be on the physical layer or data-link layer. Regarding the physical layer, the cables seems to be fine when interposing the ‘dumb‘ switch.

Can it be crossed/straight cable issues? And that my ‘dumb‘ switch auto detects the configuration but I need to enable such auto-detect on the Mikrotik router?

I still hope to receive some help, as I’m not fully there yet :).

Edit:
My MSI laptop does not work with the Microtik. It’s ethernet adapter is: Intel(R) Ethernet Controller I225-V
I have an old Dell Laptop with an adapter: Realtek PCIe GBE Family Controller which works without issues when using the same cables/ports/network-layout.

So that mu (unfortunately) rule out the crossed/straight cable issues?

Without seeing the config, all is just opinion.

It is the default config but indeed, good to post.

I’m new to RouterOS but I logged in via SSH, ran /export hide-sensitive file=myconfig
which gave me the following file:

# 2025-09-12 10:12:09 by RouterOS 7.19.6
# software id = 623E-EWYJ
#
# model = RB5009UPr+S+
# serial number = HKH0ASHZRXB
/interface bridge
add admin-mac=04:F4:1C:F1:69:04 auto-mac=no comment=defconf name=bridge
/interface list
add comment=defconf name=WAN
add comment=defconf name=LAN
/ip pool
add name=default-dhcp ranges=192.168.88.10-192.168.88.254
/disk settings
set auto-media-interface=bridge auto-media-sharing=yes auto-smb-sharing=yes
/interface bridge port
add bridge=bridge comment=defconf interface=ether2
add bridge=bridge comment=defconf interface=ether3
add bridge=bridge comment=defconf interface=ether4
add bridge=bridge comment=defconf interface=ether5
add bridge=bridge comment=defconf interface=ether6
add bridge=bridge comment=defconf interface=ether7
add bridge=bridge comment=defconf interface=ether8
add bridge=bridge comment=defconf interface=sfp-sfpplus1
/ip neighbor discovery-settings
set discover-interface-list=LAN
/interface list member
add comment=defconf interface=bridge list=LAN
add comment=defconf interface=ether1 list=WAN
/ip address
add address=192.168.88.1/24 comment=defconf interface=bridge network=\
    192.168.88.0
/ip dhcp-client
# Interface not active
add comment=defconf interface=ether1
/ip dhcp-server
add address-pool=default-dhcp disabled=yes interface=bridge name=defconf
/ip dhcp-server network
add address=192.168.88.0/24 comment=defconf dns-server=192.168.88.1 gateway=\
    192.168.88.1
/ip dns
set allow-remote-requests=yes
/ip dns static
add address=192.168.88.1 comment=defconf name=router.lan type=A
/ip firewall filter
add action=accept chain=input comment=\
    "defconf: accept established,related,untracked" connection-state=\
    established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=\
    invalid
add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp
add action=accept chain=input comment=\
    "defconf: accept to local loopback (for CAPsMAN)" dst-address=127.0.0.1
add action=drop chain=input comment="defconf: drop all not coming from LAN" \
    in-interface-list=!LAN
add action=accept chain=forward comment="defconf: accept in ipsec policy" \
    ipsec-policy=in,ipsec
add action=accept chain=forward comment="defconf: accept out ipsec policy" \
    ipsec-policy=out,ipsec
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" \
    connection-state=established,related hw-offload=yes
add action=accept chain=forward comment=\
    "defconf: accept established,related, untracked" connection-state=\
    established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" \
    connection-state=invalid
add action=drop chain=forward comment=\
    "defconf: drop all from WAN not DSTNATed" connection-nat-state=!dstnat \
    connection-state=new in-interface-list=WAN
/ip firewall nat
add action=masquerade chain=srcnat comment="defconf: masquerade" \
    ipsec-policy=out,none out-interface-list=WAN
/ipv6 firewall address-list
add address=::/128 comment="defconf: unspecified address" list=bad_ipv6
add address=::1/128 comment="defconf: lo" list=bad_ipv6
add address=fec0::/10 comment="defconf: site-local" list=bad_ipv6
add address=::ffff:0.0.0.0/96 comment="defconf: ipv4-mapped" list=bad_ipv6
add address=::/96 comment="defconf: ipv4 compat" list=bad_ipv6
add address=100::/64 comment="defconf: discard only " list=bad_ipv6
add address=2001:db8::/32 comment="defconf: documentation" list=bad_ipv6
add address=2001:10::/28 comment="defconf: ORCHID" list=bad_ipv6
add address=3ffe::/16 comment="defconf: 6bone" list=bad_ipv6
/ipv6 firewall filter
add action=accept chain=input comment=\
    "defconf: accept established,related,untracked" connection-state=\
    established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=\
    invalid
add action=accept chain=input comment="defconf: accept ICMPv6" protocol=\
    icmpv6
add action=accept chain=input comment="defconf: accept UDP traceroute" \
    dst-port=33434-33534 protocol=udp
add action=accept chain=input comment=\
    "defconf: accept DHCPv6-Client prefix delegation." dst-port=546 protocol=\
    udp src-address=fe80::/10
add action=accept chain=input comment="defconf: accept IKE" dst-port=500,4500 \
    protocol=udp
add action=accept chain=input comment="defconf: accept ipsec AH" protocol=\
    ipsec-ah
add action=accept chain=input comment="defconf: accept ipsec ESP" protocol=\
    ipsec-esp
add action=accept chain=input comment=\
    "defconf: accept all that matches ipsec policy" ipsec-policy=in,ipsec
add action=drop chain=input comment=\
    "defconf: drop everything else not coming from LAN" in-interface-list=\
    !LAN
add action=fasttrack-connection chain=forward comment="defconf: fasttrack6" \
    connection-state=established,related
add action=accept chain=forward comment=\
    "defconf: accept established,related,untracked" connection-state=\
    established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" \
    connection-state=invalid
add action=drop chain=forward comment=\
    "defconf: drop packets with bad src ipv6" src-address-list=bad_ipv6
add action=drop chain=forward comment=\
    "defconf: drop packets with bad dst ipv6" dst-address-list=bad_ipv6
add action=drop chain=forward comment="defconf: rfc4890 drop hop-limit=1" \
    hop-limit=equal:1 protocol=icmpv6
add action=accept chain=forward comment="defconf: accept ICMPv6" protocol=\
    icmpv6
add action=accept chain=forward comment="defconf: accept HIP" protocol=139
add action=accept chain=forward comment="defconf: accept IKE" dst-port=\
    500,4500 protocol=udp
add action=accept chain=forward comment="defconf: accept ipsec AH" protocol=\
    ipsec-ah
add action=accept chain=forward comment="defconf: accept ipsec ESP" protocol=\
    ipsec-esp
add action=accept chain=forward comment=\
    "defconf: accept all that matches ipsec policy" ipsec-policy=in,ipsec
add action=drop chain=forward comment=\
    "defconf: drop everything else not coming from LAN" in-interface-list=\
    !LAN
/tool mac-server
set allowed-interface-list=LAN
/tool mac-server mac-winbox
set allowed-interface-list=LAN

Roger, its not setup properly as a switch ………. Assuming the modem/router is providing a private subnet of 192.168.88.0/24 then you simply need to give the bridge an IP address. I added an offbridge secure access on ether8 that works even with bridge config errors. Its not clear what ether1 is??, but assuming its the connection to the modem/router in which case it should be on the bridge as well!!

# model = RB5009UPr+S+
# serial number = Should be removed
/interface bridge
add admin-mac=04:F4:1C:F1:69:04 auto-mac=no comment=defconf name=bridge
/interface ethernet
set [ find default-name=ether8 ] name=OffBridge8
/interface list
add comment=defconf name=MGMT
/disk settings
set auto-media-interface=bridge auto-media-sharing=yes auto-smb-sharing=yes
/interface bridge port
add bridge=bridge comment=defconf interface=ether1
add bridge=bridge comment=defconf interface=ether2
add bridge=bridge comment=defconf interface=ether3
add bridge=bridge comment=defconf interface=ether4
add bridge=bridge comment=defconf interface=ether5
add bridge=bridge comment=defconf interface=ether6
add bridge=bridge comment=defconf interface=ether7
add bridge=bridge comment=defconf interface=sfp-sfpplus1
/ip neighbor discovery-settings
set discover-interface-list=MGMT
/interface list member
add comment=defconf interface=bridge list=MGMT
add comment=defconf interface=OffBridge8 list=MGMT
/ip address
add address=192.168.88.X/24 interface=bridge network=192.168.88.0
add address=192.168.77.1/30 interface=OffBridge8 network=192.168.77.0
/ip dns 
set server=192.168.88.1
/ipv6 settings
set disable-ipv6=yes 
/ipv6 firewall filter
add action=drop chain=input 
add action=drop chain=forward
/ip route
add address=0.0.0.0/0 gateway=192.168.88.1 routing-table=main
/tool mac-server
set allowed-interface-list=NONE
/tool mac-server mac-winbox
set allowed-interface-list=MGMT

++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

I thought that the issue was only with Winbox/netinstall.

If you don't have connection at all (without the interposed switch) it could be what you are suspecting (something in the cabling, but everything - including the Mikrotik and any laptop built in the last (say) 15 years is automatic MDI/MDI-X).

The fact that your other (old) laptop works fine should confirm that the auto-sensing is fine, at least on Mikrotik side.

Your configuration is pretty much standard AFAICS the only "strange" (to me, likely normal) is the "/disk settings".

You can try (not that it will necessarily give any useful results) the Mikrotik "cable testing" feature, see here:

A possibility is that one of the RJ45 plugs on the cable you are using fits "loosely" on the socket (either of the laptop or on the RB5009) while it fits ok in the switch, but then your other laptop should have the same behaviour, and if the issue is the socket of your laptop, it shouldn't work when you use the switch in between.

It could be an issue with auto-negotiation between 100 Mb and 1 Gb?

From the testing you did, my guess is that the Intell I225-V and the RB5009 don't work well together at the PHY level.

Possible work arounds: external switch as you found. Or use of a USB to Gb wired ethernet adaptor on your MSI laptop.

does the Intel i225-V 2.5 GbE ethernet controller still have issues?

Me also, until I discovered no data flows through a direct link at all. Although it does for a short wile as my system gets a IP from the DHCP server on the Mikrotik router. This last bit mislead my by thinking the link was ok, but apparently only for a few seconds before 'Energy Efficient Ethernet' (EEE) is negotiated.

Well, thank you.
Apparently I have a (very) crappy ethernet chipset in my laptop ' Intel Ethernet Controller I225-V rev 1 '. I never encountered any issue before but this series seem to have general problems.

I played around a bit and found that when I disable Energy Efficient Ethernet (EEE) in my ethernet adapter driver settings it start working! I can communicate over and through the Mikrotik when having a direct link to it! It's fantastic!

For anybody encountering the same, on my Windows machine I can disable the setting here:

Open Run dialog (Win + R) => ncpa.cpl => right click your adapter => Properties => Configure => Advanced => Energy Efficient Ethernet => Set Value to 'Off'

Now my laptop's power consumption is about 1 W higher, which I probably won't notice but still.

Off course, another workaround is to place another switch in between as we already discovered.

EDIT:
As mentioned below, what also works is upgrading to RouterOS 7.22.1 which disables Energy Efficient Ethernet (EEE) on the router side so no need to disable it on the laptop.

If you update your RB5009 to the latest stable 7.22.1 version then EEE should be disabled on the RB5009 side too, and maybe disabling it on the laptop is not needed anymore.

Okay this eee thingy is really stupid.
We have managed to get MT to turn this off, and yet this PC had it ON by default.
So what is it…………. on by default and a standard, or should be off by default. no clarity at all……….

So it was EEE, after all?

Good :slightly_smiling_face: (which means bad :roll_eyes:)

There is a lot of confusion about it, it is documented to have been forcibly disabled on all devices since 7.22.1 but it seems like not all devices actually comply, the RB5009 should (but the 4011 is reported as having it somehow enabled, depending on which lan card/chip is on the "other" side, see around here):
V7.22.1 [stable] is released! - #24 by whatever

The RB5009 should have it disabled (since 7.22.1) so, next time you update the RouterOS to 7.22.1 or later you should check again.

P.S. Oops sorry guys, you posted while I was writing my post

Thanks again!

I tested and can confirm:

  1. I updated to RouterOS 7.22.1 (latest stable version at time of writing).
  2. I reenabled Energy Efficient Ethernet (EEE) on my laptop again.
  3. And it still works! I can communicate with/over the router when directly connected to it. This was for sure not possible before.

I'm glad you found a solution. EEE implementations have been known to mess things up, but according to what I know, the Intel chipset you reference is one of the better ones. Do I have a reason to suspect otherwise?

Oh no, it's one of the worst network adapter chipsets, plagued with a lot of problems (EEE and packet loss) that are caused by the hardware flaws, even after several revisions. You need to find and flash NVM Firmware for it to resolve some of the bugs. It's somewhat ok from rev3, IIRC, but still has many issues.

It has such a bad reputation that Intel had to release the I226 as a bug-fix version :smiley:

JFYI (only one tale of horror about updating it):
https://neurrone.com/posts/avoid-intel-i225-v/

Well, I was mistaken. Both you and @CGGXANNX: thanks!