CloudLabBox
Try the free demo

MikroTik MTCINE lab 3 of 12

Routing filters with prefix lists and communities

Fernvale's edge accepts and sends everything, and it shows: bogons from the upstream, a hijacked prefix leaked by a customer, and free transit for a peer. Write RouterOS 7 routing filters with prefix lists built from address lists, tag routes with communities by where they came from, and let the communities decide what leaves the AS.

Run this lab

It needs Lite: its 5 nodes are set to 5 vCPU and 1,280 MB in total. That fits the free demo too.

In your workspace: Shared, then MikroTik MTCINE RouterOS v7 guided labs, then 03 - Routing filters with prefix lists and communities

Try it free for 30 minutesRun it on Lite from £3 a day

The free demo needs no card and no email. Every lab plan includes every guided lab.

Level
Advanced
Time
About 90 minutes
Nodes need
5 vCPU, 1,280 MB
Smallest plan
Lite

The scenario

Fernvale's edge router FV-EDGE now has four BGP neighbours: Northgate (transit, AS 64510), Kestrel Broadband (a settlement-free peer at the local exchange, AS 64520), and two customers, Copperleaf (AS 65010) and Birchwood School (AS 64496, with its own block 198.19.20.0/24 and a second ISP). The sessions came up last week with no filters at all, and this morning three things went wrong:

  • Northgate sends a bogon (10.0.0.0/8) and a /25 that nobody should accept.
  • Birchwood re-announces 198.18.0.0/25, a more specific of an Internet prefix it learnt from its other ISP. Because a longer prefix always wins, Fernvale now sends half of that Internet destination to a school.
  • Copperleaf announces its internal lab network 10.99.0.0/16 by mistake.
  • Kestrel receives all of Northgate's routes from Fernvale, so Fernvale gives Kestrel free transit.

Fix it with a proper policy. Only FV-EDGE needs configuring.

NeighbourASLinkAllowed prefixes
NORTHGATE64510ether1 203.0.113.1/30anything except bogons and prefixes longer than /24
KESTREL64520ether2 192.0.2.1/30198.18.2.0/24 only
COPPERLEAF65010ether3 172.16.0.2/30198.51.100.192/26 only
BIRCHWOOD64496ether4 172.16.0.6/30198.19.20.0/24 only

What you’ll practise

  • Write RouterOS 7 routing filter rules with if/else, dst, dst-len and actions
  • Use firewall address lists as prefix lists for customers, peers and bogons
  • Tag routes with BGP communities on the way in and select routes by community on the way out
  • Prevent route leaks and accidental transit in a multihomed (non-stub) network

The tasks

  1. See the damage
  2. Build the prefix lists
  3. Filter and tag what comes in
  4. Let the communities decide what leaves
  5. Confirm customers still get everything

The Lab Tasks pane has the scenario, these tasks, the checks to run, hints and the full solution.

Topology and devices

The network as it opens in EVE-NG, drawn from the lab’s own canvas, and the image each node runs.

Topology of Routing filters with prefix lists and communities5 nodes, 4 links. Every link is listed as text below the diagram.NORTHGATEKESTRELFV-EDGECOPPERLEAFBIRCHWOODether1ether3ether1ether4ether1ether1ether1ether2
5 nodes, with the interface names each link uses. On a narrow screen, scroll the diagram sideways.
Every link, as text
  • NORTHGATE ether1 to FV-EDGE ether1
  • KESTREL ether1 to FV-EDGE ether2
  • COPPERLEAF ether1 to FV-EDGE ether3
  • BIRCHWOOD ether1 to FV-EDGE ether4
Nodes in Routing filters with prefix lists and communities, with the image each runs and the vCPU and RAM it’s set to
NodeDeviceImage in Add NodeSet to
NORTHGATEMikroTik RouterOSmikrotik-7.14.21 vCPU, 256 MB
KESTRELMikroTik RouterOSmikrotik-7.14.21 vCPU, 256 MB
FV-EDGEMikroTik RouterOSmikrotik-7.14.21 vCPU, 256 MB
COPPERLEAFMikroTik RouterOSmikrotik-7.14.21 vCPU, 256 MB
BIRCHWOODMikroTik RouterOSmikrotik-7.14.21 vCPU, 256 MB

How to open this lab

  1. Sign in to your workspace at lab.cloudlabbox.com.

  2. In File Manager, open Shared, then the folder MikroTik MTCINE RouterOS v7 guided labs.

  3. Open 03 - Routing filters with prefix lists and communities and start its nodes, then open Lab Tasks for the scenario and the steps.

The lab is read-only. You can start the nodes and configure the devices, but changes to the topology can’t be saved. To change it, rebuild it in your own folder.

More MikroTik MTCINE labs

All MikroTik MTCINE labs

Related labs in other courses

CloudLabBox is independent of MikroTik. The lab follows exam topics and isn’t vendor training material; vendor names identify the exams and the images in the workspace.