CloudLabBox
Try the free demo

MikroTik MTCNA lab 10 of 19

Firewall: protect the customers, address lists and FastTrack

Protect the networks behind the router: prove that NAT is not a firewall, build the forward chain the way RouterOS's default configuration does, keep guests away from staff, block sites with an address list, and see what FastTrack does.

Run this lab

It needs Lite: its 5 nodes are set to 5 vCPU and 3,072 MB in total. That fits the free demo too.

In your workspace: Shared, then MikroTik MTCNA RouterOS v7 guided labs, then 10 - Firewall - protect the customers address lists and FastTrack

Try it free for 30 minutesRun it on Lite from £3 a day

The free demo needs no card and no email. Every lab plan includes every guided lab.

Level
Intermediate
Time
About 55 minutes
Nodes need
5 vCPU, 3,072 MB
Smallest plan
Lite

The scenario

A guest house runs staff PCs and free guest Wi-Fi from one MikroTik. Its input chain (from lab 9) is in place, so the router itself is safe, but there are no forward rules. Fernvale's security team has put a route on the provider side pointing at the staff LAN, to show what an attacker on the provider network could do. The owners also want guests kept away from the staff PCs, and two websites blocked for staff.

DeviceInterfaceAddress
GWether1 (WAN) · ether2 (Staff) · ether3 (Guest)203.0.113.2/30 · 192.168.10.1/24 · 192.168.20.1/24
ISPether1 · ether2 · sites loopback203.0.113.1/30 · 198.51.100.1/24 · 192.0.2.10, .66, .77
Remoteeth0198.51.100.10/24 (attacker's host)
Staff-PC · Guest-PCeth0192.168.10.10 · 192.168.20.10

What you’ll practise

  • Show that masquerade alone doesn't stop inbound connections
  • Build a forward chain: FastTrack, accept established, drop invalid, drop new connections from WAN that aren't DST-NATed
  • Isolate one LAN from another with interface matchers
  • Block destinations with a static and a timed address-list entry, and choose between drop and reject
  • Explain FastTrack, its counters and what it bypasses

The tasks

  1. Prepare Remote
  2. Prove that NAT is not a firewall
  3. Build the forward chain
  4. Keep guests away from staff
  5. Block sites with an address list
  6. Watch FastTrack work

The Lab Tasks pane has the scenario, these tasks, the checks to run, hints and the full solution.

Topology and devices

The network as it opens in EVE-NG, drawn from the lab’s own canvas, and the image each node runs.

Topology of Firewall - protect the customers address lists and FastTrack5 nodes, 4 links. Every link is listed as text below the diagram.ISPGWRemoteStaff-PCGuest-PCether2eth0ether1ether1ether2eth0ether3eth0
5 nodes, with the interface names each link uses. On a narrow screen, scroll the diagram sideways.
Every link, as text
  • ISP ether1 to GW ether1
  • ISP ether2 to Remote eth0
  • GW ether2 to Staff-PC eth0
  • GW ether3 to Guest-PC eth0
Nodes in Firewall: protect the customers, address lists and FastTrack, with the image each runs and the vCPU and RAM it’s set to
NodeDeviceImage in Add NodeSet to
ISPMikroTik RouterOSmikrotik-7.14.21 vCPU, 256 MB
GWMikroTik RouterOSmikrotik-7.14.21 vCPU, 256 MB
RemoteAlpine Linuxclbalpinebase-alpine-base-3-20-31 vCPU, 512 MB
Staff-PCVPCS hostBuilt in to EVE-NGCounted as 1 vCPU, 1,024 MB
Guest-PCVPCS hostBuilt in to EVE-NGCounted as 1 vCPU, 1,024 MB

How to open this lab

  1. Sign in to your workspace at lab.cloudlabbox.com.

  2. In File Manager, open Shared, then the folder MikroTik MTCNA RouterOS v7 guided labs.

  3. Open 10 - Firewall - protect the customers address lists and FastTrack and start its nodes, then open Lab Tasks for the scenario and the steps.

The lab is read-only. You can start the nodes and configure the devices, but changes to the topology can’t be saved. To change it, rebuild it in your own folder.

More MikroTik MTCNA labs

All MikroTik MTCNA labs

Related labs in other courses

CloudLabBox is independent of MikroTik. The lab follows exam topics and isn’t vendor training material; vendor names identify the exams and the images in the workspace.