MikroTik RB5009UPr+S+OUT IP66 Outdoor PoE Router

The MikroTik RB5009UPr+S+OUT is the outdoor evolution of the RB5009UG+S+IN — MikroTik's most capable affordable router platform — rebuilt in a sealed IP66 enclosure for permanent outdoor installation at tower sites, rooftop equipment shelves, outdoor distribution cabinets, and any deployment where the router lives outside the server room. Every capability that made the indoor RB5009 the reference platform for ISP edge routing and SMB infrastructure is preserved in the outdoor enclosure, with the addition of IP66 weatherproofing and a power architecture specifically engineered for outdoor multi-device deployments.

**The 9-source power redundancy — the defining capability**

No other MikroTik device in the current catalogue offers nine independent power input paths. Understanding the architecture explains why this matters:

- **2-pin terminal input (5.08mm, 24–57V):** A direct DC terminal block on the front of the enclosure — the primary high-current power feed for PoE-out operations. This is the power source that must be connected when the RB5009UPr+S+OUT is powering downstream devices via PoE-out. Without power on the 2-pin terminal, PoE-out to downstream devices is not available — the Ethernet PoE-in sources alone cannot supply downstream PoE-out. MikroTik explicitly states: "if you're using PoE-out to power other devices, you have to provide power via the 2-pin connector."

- **PoE-in on Ether1 through Ether7 (802.3af/at, 24–57V):** Each of the seven Gigabit Ethernet ports accepts 802.3af/at PoE-in independently. Any one of these seven ports can power the router's own operation (up to 21W self-consumption) from a PoE source. This means the router's own operation can be sustained by any one of seven different upstream PoE feeds — if six fail simultaneously, the seventh keeps the router running.

- **Total: 2-pin terminal + 7× PoE-in = 9 independent power paths for router self-operation.**

The router's power management logic automatically selects the highest-voltage available source when multiple power inputs are simultaneously active — passive priority selection without configuration, no relay or manual switching required. The practical implication for an outdoor tower deployment: a RB5009UPr+S+OUT installed at the top of a tower with its 2-pin terminal connected to the tower's primary DC power bus and three of its Ethernet ports connected to upstream PoE switches can survive the simultaneous failure of any combination of those sources as long as one remains live. MikroTik's characterisation — "unprecedented redundancy" — is accurate in the context of routers at this price point.

**PoE-out — 130W total, 25W per port, all 8 Ethernet ports**

All eight Ethernet ports on the RB5009UPr+S+OUT provide PoE-out simultaneously — seven Gigabit ports plus one 2.5G port. Key parameters:

- **Per-port PoE-out:** Up to 25W per port (802.3af/at or low-voltage passive PoE)

- **Total PoE-out budget:** 130W across all ports combined

- **Low-voltage PoE-out current limit:** 900 mA per port

- **High-voltage PoE-out current limit:** 440 mA per port

- **Single voltage PoE-out:** The PoE-out voltage is determined by the 2-pin terminal input voltage — no voltage conversion. If the 2-pin terminal is fed 24V, PoE-out on all ports is 24V passive. If fed 48V or 52V (standard 802.3af/at range), PoE-out is 802.3af/at compatible. Mixing voltages across ports is not supported — all PoE-out ports operate at the same voltage tier.

The 130W PoE-out budget is the practical capacity for most outdoor tower deployments — eight downstream devices at an average of 16W each. For a tower installation where the RB5009UPr+S+OUT powers MikroTik sector APs (mANTBox ax 15s at 21W max, wAP ax at 13W max), outdoor CPE units, LtAP routers, or outdoor cameras via PoE, the 130W budget covers 5–8 devices simultaneously. The note about the included PSU — rated at 96W total output — is important: the included power supply limits total PoE-out to 96W in practice. For deployments requiring the full 130W PoE-out budget, a separate higher-rated DC power supply must be used instead of the included PSU. State this clearly on the product page.

**ARM64 quad-core Marvell 88F7040 — the same CPU as the indoor RB5009**

The 88F7040 is Marvell's Armada 7040 SoC — a quad-core ARM Cortex-A72 at 350–1,400 MHz with hardware-accelerated cryptography (AES-NI), hardware IPsec offload, and ARM64 architecture. This is the same CPU used in the indoor RB5009UG+S+IN — the outdoor enclosure does not compromise the processing platform. The 88F7040 is the most powerful CPU in MikroTik's current affordable router range by a significant margin — the L009's IPQ-5018 is dual-core ARM32; the RB5009's 88F7040 is quad-core ARM64 running at up to 1,400 MHz with hardware crypto acceleration.

Practical performance implications for outdoor tower deployments:

- **PPPoE termination at scale:** MikroTik explicitly calls out PPPoE termination as a primary use case. For a Canadian WISP or ISP aggregating subscriber PPPoE sessions at a tower site, the RB5009UPr+S+OUT's quad-core ARM64 CPU handles hundreds of concurrent PPPoE sessions without CPU saturation.

- **MPLS Push/Pop/Swap and MPLS Forwarding:** MPLS label switching at the tower edge — for ISPs running MPLS backhaul topologies, the RB5009UPr+S+OUT can perform MPLS label operations at the access layer without a dedicated PE router.

- **VPLS/VXLAN Termination:** Layer 2 VPN termination over MPLS (VPLS) or IP (VXLAN) — relevant for multi-site ISP topologies where the tower router participates in a Layer 2 overlay network.

- **Hardware bridging:** The 88E6393 switch chip provides hardware-offloaded Layer 2 bridging and VLAN switching at line rate across all ports simultaneously — no CPU involvement for Layer 2 forwarding within the same bridge domain.

- **IPsec hardware encryption:** The 88F7040's hardware crypto engine accelerates IPsec encryption — the indoor RB5009UG+S+IN's documented IPsec throughput is approximately 1,040 Mbps at 1,400 byte packets. The outdoor variant shares the same CPU and is expected to deliver equivalent IPsec throughput, subject to thermal management differences in the IP66 enclosure. Confirm IPsec throughput from the RB5009UPr+S+OUT's own brochure test results.

**1 GB RAM and 1 GB NAND — a step change over the L009**

The RB5009UPr+S+OUT's 1 GB RAM is 2× the L009UiGS-RM's 512 MB and 4× the hAP ax lite's 256 MB — and the 1 GB NAND storage is 8× the L009's 128 MB NAND. The RAM headroom is meaningful for RouterOS v7 container deployments and for ISP-scale routing table sizes: a full IPv4 BGP routing table from a transit provider contains approximately 900,000–1,000,000 prefixes as of 2025, requiring substantial RAM for route storage and processing. The RB5009UPr+S+OUT's 1 GB RAM provides the headroom for full BGP table reception and processing — a capability the 512 MB L009 and 256 MB hAP devices cannot reliably sustain at full table size. For a tower site where the RB5009UPr+S+OUT maintains a BGP session with an upstream transit router, the 1 GB RAM is the operational requirement.

The 1 GB NAND storage provides capacity for RouterOS v7 container images, extended syslog storage, traffic flow archives, and large RouterOS scripting environments — significantly more local storage than any other device in this product batch.

**Marvell 88E6393 switch chip — upgraded from the L009's 88E6190**

The 88E6393 is a higher-tier Marvell Prestera switch ASIC than the 88E6190 in the L009 series — supporting higher port counts, more complex VLAN topologies, and a higher-bandwidth switch fabric-to-CPU connection. The 88E6393 provides the hardware switching and VLAN management for the RB5009UPr+S+OUT's 8× Ethernet ports plus the SFP+ port, with hardware-offloaded Layer 2 forwarding at line rate. Hardware bridging and VLAN-based traffic segregation between the 8 PoE-out downstream device ports are processed in the switch ASIC without CPU involvement — the ARM64 CPU is freed for routing, firewall, and management tasks.

**10G SFP+ port — the outdoor tower uplink**

The single SFP+ port provides a 10 Gbps fiber uplink — the connection from the tower aggregation point to the ISP's backhaul network. For a tower installation where the RB5009UPr+S+OUT aggregates traffic from 8 downstream PoE-out devices (sector APs, LtAP routers, CPE aggregation switches), the 10G SFP+ uplink provides backhaul capacity exceeding the combined throughput of all 8 downstream Gigabit ports. Compatible SFP+ transceivers include MikroTik's own S+85LC01D (10G multimode 850nm), S+31DLC10D (10G single-mode 1310nm), and standard 10G SFP+ DAC cables — confirm transceiver compatibility from the RB5009 series documentation.

**2.5G Ethernet port — the high-capacity downstream or uplink port**

The single 2.5G Ethernet port (with PoE-out) can serve as either a high-capacity downstream link to a 2.5G-capable downstream device — a CRS310-8G+2S+IN switch, a NetBox 5 ax, or a 2.5G NAS — or as a 2.5G wired uplink when the SFP+ port is occupied. At 2.5 Gbps, this port carries 2.5× the throughput of any individual Gigabit port, making it the natural aggregation point for a downstream device that aggregates multiple client connections.

**IP66 outdoor enclosure — the primary differentiation from the indoor RB5009**

IP66 is the most stringent dust and water ingress protection rating in MikroTik's outdoor product lineup shared with the LtAP series — complete dust-tight protection and powerful water jet resistance from any direction. The RB5009UPr+S+OUT's IP66 enclosure is specifically engineered for permanent outdoor installation at tower sites, rooftop equipment shelves, utility enclosures, and outdoor distribution boxes without additional weatherproof housing. The -40°C to +70°C operating range covers the full Canadian outdoor temperature spectrum. Passive cooling in the IP66 enclosure manages the 15W router self-consumption without a fan — no fan failure risk and no fan maintenance in a sealed outdoor enclosure. Under full PoE-out load at 150W max, the passive thermal management relies on the enclosure's surface area and ambient airflow at the tower or rooftop installation location.

The K-41 and K-85 fastening sets included in the package provide pole and wall mounting options — the hose clamps (×2) secure the enclosure to a round pole or mast. For a tower installation where the RB5009UPr+S+OUT is mounted on a steel tower leg or antenna mast alongside the sector APs it is powering via PoE-out, the included hardware provides a complete mounting solution without additional accessories.

**Deployment context — the outdoor tower power hub**

The RB5009UPr+S+OUT's combination of capabilities — 9-source power redundancy, 130W PoE-out across 8 ports, ARM64 quad-core routing at 1,400 MHz, 10G SFP+ fiber uplink, IP66, and -40°C to +70°C — defines a specific deployment role that no other MikroTik device at this price point fills: the outdoor tower power hub and aggregation router. The canonical deployment:

A cellular tower or lattice tower with 4–6 MikroTik sector APs (mANTBox ax 15s or similar) mounted at the top, each drawing 21W via PoE. The RB5009UPr+S+OUT is mounted at mid-tower or at the base of the tower head frame. Its 2-pin terminal is connected to the tower's primary DC power feed. Its PoE-out ports power all sector APs directly via Ethernet cables run down the tower — eliminating individual power supplies at each AP. Its 10G SFP+ connects via fiber to the tower's backhaul radio or fiber handoff. Its ARM64 CPU handles PPPoE session termination, VLAN segregation between sectors, firewall, and BGP or OSPF routing for the tower's IP addressing. Its 9-source PoE-in provides power redundancy — if the tower's primary DC feed fails, an upstream PoE switch can keep the router running for continued management access.

**Canadian market note:** Certifications are CE, EAC, and RoHS — no FCC or IC (ISED) published. The RB5009UPr+S+OUT is a wired router with no wireless transmitter. No ISED wireless device certification advisory applies. Confirm any applicable Canadian electrical safety certification (CSA, cUL) requirements with your distributor before listing. The absence of FCC/IC is not a compliance concern for a wired router in Canada.

**5-year software support guarantee:** RouterOS v7 updates free for life of product or minimum 5 years from date of purchase.

Key specifications:

- **Product code:** RB5009UPr+S+OUT

- **Architecture:** ARM 64-bit

- **CPU:** Marvell 88F7040 (Armada 7040), quad-core ARM64, 350–1,400 MHz (auto)

- **CPU threads:** 4

- **Switch chip:** Marvell 88E6393

- **RAM:** 1 GB

- **Storage:** 1 GB NAND

- **OS:** RouterOS v7, License 5

- **Gigabit Ethernet ports:** 7× (all with 802.3af/at PoE-in + PoE-out)

- **2.5G Ethernet ports:** 1× (with PoE-out)

- **SFP+ port:** 1× (10G)

- **USB:** 1× USB 3.0 Type-A, 1.5A, USB Power Reset

- **DC inputs:** 2 (2-pin terminal 24–57V + PoE-in on all 8 Ethernet ports)

- **2-pin terminal input:** 24–57V (5.08mm 1×2 pin)

- **PoE-in:** 802.3af/at, 24–57V (all 8 Ethernet ports)

- **PoE-out ports:** Ether1–Ether8 (all 8 ports)

- **PoE-out standard:** 802.3af/at or low-voltage passive (single voltage — set by 2-pin input)

- **PoE-out per port:** 25W max

- **PoE-out total budget:** 130W (included PSU rated 96W — external PSU required for full 130W)

- **PoE-out LV current limit:** 900 mA per port

- **PoE-out HV current limit:** 440 mA per port

- **Router self-consumption:** 21W max

- **Max power consumption (total):** 150W

- **Max power without attachments:** 15W

- **Cooling:** Passive

- **IP rating:** IP66

- **Operating temperature:** -40°C to +70°C

- **MTBF:** ~200,000 hours at 25°C

- **Monitors:** CPU temperature, PCB temperature, voltage, current

- **Certifications:** CE, EAC, RoHS — no FCC, no IC published

- **Included:** K-41 fastening set, K-85 fastening set, hose clamp ×2

- **Suggested price:** USD 319.00