RouterOS License Levels Explained — Buy in Lebanon
RouterOS License Levels: What Every MikroTik Buyer in Lebanon Needs to Know
Every MikroTik router ships with a RouterOS license tied to its hardware. The license level — ranging from Level 3 to Level 6 — determines how many VPN tunnels, Hotspot users, and PPPoE sessions the device can handle. Buying a router with the wrong license level means hitting a hard limit that no amount of CPU or RAM can overcome. This guide breaks down every RouterOS license level with specific numbers, maps each level to the MikroTik products available at HI-GAIN in Lebanon, and explains when upgrading your license makes sense.
HI-GAIN, based in Dora, Beirut, has been Lebanon's MikroTik distributor since 1990. We stock routers across every license level and can advise which level matches your network requirements.
RouterOS License Level Overview
MikroTik RouterOS uses a simple tiered licensing model. The core features — routing, firewall, NAT, VLANs, DHCP, DNS — are identical across all levels. The differences are in scalability limits: how many tunnels, sessions, and wireless interfaces the router permits.
| Feature | Level 3 (CPE) | Level 4 (WISP AP) | Level 5 (WISP) | Level 6 (Controller) |
|---|---|---|---|---|
| Wireless AP Mode | No (station only) | Yes | Yes | Yes |
| Wireless Client/Bridge | Yes | Yes | Yes | Yes |
| RIP / OSPF / BGP | Yes | Yes | Yes | Yes |
| EoIP Tunnels | Unlimited | Unlimited | Unlimited | Unlimited |
| PPPoE Tunnels | 1 | 200 | 500 | Unlimited |
| PPTP Tunnels | 1 | 200 | 200 | Unlimited |
| L2TP Tunnels | 1 | 200 | 500 | Unlimited |
| OVPN Tunnels | 1 | 200 | 500 | Unlimited |
| VLAN Interfaces | Unlimited | Unlimited | Unlimited | Unlimited |
| Hotspot Active Users | 1 | 200 | 500 | Unlimited |
| User Manager Sessions | 1 | 20 | 50 | Unlimited |
| Queues | Unlimited | Unlimited | Unlimited | Unlimited |
| Web Proxy | No | Yes | Yes | Yes |
Notice that queue management is unlimited across all levels. Bandwidth shaping is never restricted by license. The critical limits for Lebanese ISPs and WISPs are PPPoE tunnels, Hotspot users, and User Manager sessions — these are the features that directly determine how many paying subscribers you can serve.
Level 3 — Wireless Client/CPE Only
Level 3 is restricted to wireless station (client) mode. The device cannot act as an access point. Tunnel and session limits are capped at 1 each, making L3 routers unsuitable as VPN servers, PPPoE servers, or Hotspot gateways.
L3 products at HI-GAIN: Level 3 is found on dedicated CPE devices like the MikroTik LHG XL 5 ac and the LHG 5. These are designed as subscriber-side radios that connect to a tower AP — they do not need AP capability or high tunnel counts.
Who needs L3 in Lebanon: WISP subscribers receiving internet from a tower-mounted MikroTik AP. The CPE bridges or routes traffic from the wireless link to the subscriber's LAN. No VPN server, no Hotspot, no PPPoE server required.
Level 4 — The Standard Router/AP License
Level 4 is the most common RouterOS license. It unlocks wireless AP mode, 200 PPPoE tunnels, 200 Hotspot active users, and 20 User Manager sessions. Every major routing feature is available: OSPF, BGP, firewall, mangle, NAT, VPN server.
L4 products at HI-GAIN:
- hAP AX Lite — Entry-level WiFi 6 home router, 2.4 GHz only
- hAP AX2 — Dual-band WiFi 6 home/office router
- hEX (RB750Gr3) — Wired 5-port Gigabit router for basic routing
- hEX S (RB760iGS) — 5-port Gigabit with SFP and IPsec hardware acceleration
- cAP AX — Ceiling-mount WiFi 6 access point
- SXT SA5 ac — Outdoor 5 GHz 90° sector radio
Who needs L4 in Lebanon: Home users, small offices with under 30 devices, coffee shops running a Hotspot with fewer than 200 concurrent users, and small WISPs with under 200 PPPoE subscribers. L4 covers 90% of non-ISP use cases.
Level 5 — Mid-Range ISP/WISP License
Level 5 doubles or triples most L4 limits: 500 PPPoE tunnels, 500 L2TP/OVPN tunnels, 500 Hotspot users, and 50 User Manager sessions. This is the license for growing WISPs and medium-sized ISPs in Lebanon.
L5 products at HI-GAIN:
- RB5009UG+S+IN — 7x 1G + 1x 2.5G + SFP+ 10G, quad-core ARM, the most popular L5 router
- RB4011iGS+RM — 10x 1G + SFP+ 10G, rackmount, quad-core Cortex-A15
- RB4011iGS+5HacQ2HnD-IN — Same as above with dual-band WiFi
- OmniTIK 5 PoE ac — Outdoor 360° AP with 5x Gigabit PoE-out ports
Who needs L5 in Lebanon: WISPs managing 200-500 PPPoE subscribers, businesses running Hotspot billing for hotels or universities, and network operators needing more than 200 concurrent VPN tunnels. The RB4011 and RB5009 are the backbone of hundreds of small Lebanese ISP networks. Read the RB5009 buying guide or the RB4011 buying guide for hardware details.
Level 6 — Enterprise/ISP Unlimited
Level 6 removes all limits. Unlimited PPPoE, L2TP, PPTP, OVPN, Hotspot users, and User Manager sessions. It is MikroTik's top-tier license for ISPs, carrier networks, and large-scale deployments.
L6 products at HI-GAIN:
- hAP AX3 — WiFi 6 dual-band with 2.5G WAN, L6 despite being a home router (read our hAP AX3 detailed guide)
- CCR2004-16G-2S+ — 16x 1G + 2x SFP+ 10G, 4-core ARM64, dual PSU
- CCR2116-12G-4S+ — 12x 1G + 4x SFP+ 10G, 16-core ARM64, 16 GB RAM
- CCR2216-1G-12XS-2XQ — 12x 25G SFP28 + 2x 100G QSFP28, carrier-grade
Who needs L6 in Lebanon: ISPs with 500+ subscribers, hotel chains with Hotspot billing across multiple locations, carriers running BGP with full routing tables, and any deployment where you want zero concern about session limits. The hAP AX3 is the notable exception — it ships with L6 at a home-router price, making it the only sub-$150 MikroTik device with unlimited tunnels and sessions.
How to Upgrade Your RouterOS License
If your current router's license level is too restrictive, you have two options:
Option 1: Buy a License Key Upgrade
RouterOS licenses can be upgraded from Level 4 to Level 5, or from Level 4/5 to Level 6, by purchasing a license key from MikroTik's account portal (account.mikrotik.com). The license is tied to the device's Software-ID — a unique identifier bound to the router's storage media. You enter the purchased key into the router via Winbox, WebFig, or the terminal. The upgrade takes effect immediately without rebooting.
Option 2: Buy a Router That Ships with the Right Level
For most Lebanese buyers, this is the simpler path. If you need L5 features, buy an RB5009 or RB4011 instead of upgrading a hEX. If you need L6, buy a CCR2004 or hAP AX3. The cost of a license upgrade plus an underpowered router often exceeds the price of a properly specced router with the correct license included.
License Key Facts
- The license is bound to the router's storage media (NAND/SSD), not to the serial number or MAC address
- If you replace the storage, you lose the license and need to request a replacement from MikroTik support
- RouterOS v7 licenses include free software updates for the life of the product or a minimum of 5 years from date of purchase
- Downgrading a license is not possible — once upgraded, you cannot revert to a lower level
- Cloud Hosted Router (CHR) uses a separate licensing scheme, not Levels 3-6
License Level Impact on Lebanese WISP/ISP Operations
For Lebanese WISPs, the PPPoE limit is the critical factor. A WISP growing from 150 to 250 subscribers on an L4 router (200 PPPoE max) will hit a wall where new subscribers cannot connect. There is no warning — subscriber #201 simply gets rejected. Plan your license level based on your 12-month growth projection, not current subscriber count.
The Hotspot limit matters for hotels, cafes, and coworking spaces in Beirut, Jounieh, and other Lebanese cities. A 100-room hotel with 2 devices per guest at peak occupancy needs 200 concurrent Hotspot sessions — exactly the L4 limit. One extra device and the login page stops serving new users. L5 (500 users) or L6 (unlimited) provides the safety margin.
User Manager sessions affect RADIUS-based authentication deployments. L4's 20-session limit is sufficient for a small cafe but not for an ISP using User Manager for subscriber authentication. ISPs should use L5 (50 sessions) or L6 (unlimited) and optionally deploy a dedicated RADIUS server for large-scale operations.
Quick Reference: Which License Do I Need?
| Use Case | Minimum License | Recommended Product |
|---|---|---|
| Home router (under 20 devices) | Level 4 | hAP AX2 |
| Small office (under 50 devices) | Level 4 | hEX S + dedicated AP |
| Multi-branch VPN hub | Level 5 | RB4011iGS+RM |
| WISP with under 200 subscribers | Level 4 | hEX S |
| WISP with 200-500 subscribers | Level 5 | RB5009UG+S+IN |
| ISP with 500+ subscribers | Level 6 | CCR2004-16G-2S+ |
| Hotel/cafe Hotspot (200+ users) | Level 5 or 6 | hAP AX3 (L6) |
| Carrier BGP with full tables | Level 6 | CCR2116-12G-4S+ |
Where to Buy MikroTik Routers by License Level in Lebanon
HI-GAIN stocks MikroTik routers across all license levels at our Dora, Beirut warehouse. Whether you need an L4 hAP for a home setup or an L6 CCR2216 for a carrier network, we provide:
- Local warranty and technical support in Arabic, English, and French
- License upgrade keys available for purchase
- Network architecture consultation to select the right license level
- Same-day pickup from Beirut or delivery across Lebanon
Check real-time stock for all MikroTik products, browse the complete MikroTik catalog in Lebanon, or explore our MikroTik routers collection. For product-specific guides, see our MikroTik RouterBOARD overview.