CloudLabBox
Try the free demo

MikroTik MTCNA lab 9 of 19

Firewall: protect the router

Close an Internet-facing router: see what an outsider can reach, then build the input chain rule by rule with connection tracking, an address list for administrators, logging and counters, and prove the result from outside and inside.

Run this lab

It needs Lite: its 5 nodes are set to 5 vCPU and 2,560 MB in total. That fits the free demo too.

In your workspace: Shared, then MikroTik MTCNA RouterOS v7 guided labs, then 09 - Firewall - protect the router

Try it free for 30 minutesRun it on Lite from £3 a day

The free demo needs no card and no email. Every lab plan includes every guided lab.

Level
Intermediate
Time
About 55 minutes
Nodes need
5 vCPU, 2,560 MB
Smallest plan
Lite

The scenario

A design studio's router went online last week with no firewall at all. Fernvale's security scan found SSH, WinBox and FTP answering from the Internet, and an open DNS resolver on its public address, which criminals use to amplify attacks. Close the router itself: only the studio's admin PC may manage it, the LAN may use it for DNS, everyone may ping it, and everything else to the router is dropped and logged.

DeviceInterfaceAddressRole
GWether1 (WAN)203.0.113.2/30Studio router
GWether2 (LAN)192.168.88.1/24
ISPether1 / ether2203.0.113.1/30 · 198.51.100.1/24Provider
Remoteeth0198.51.100.10/24, gateway .1Somebody on the Internet
Admin-PCeth0192.168.88.10/24, gateway .1Studio administrator
PC1eth0192.168.88.20/24, gateway .1Ordinary studio PC

What you’ll practise

  • Explain the input, forward and output chains and where packets to the router go
  • Use connection states: new, established, related, invalid, untracked
  • Build an ordered input chain that ends with a drop
  • Allow management only from an address list
  • Log dropped packets and read rule counters
  • Close an open DNS resolver

The tasks

  1. Prepare the two Linux hosts
  2. See what the Internet sees
  3. Understand connection tracking before you write rules
  4. Build the input chain
  5. Prove it from outside and inside
  6. Read the counters and the log

The Lab Tasks pane has the scenario, these tasks, the checks to run, hints and the full solution.

Topology and devices

The network as it opens in EVE-NG, drawn from the lab’s own canvas, and the image each node runs.

Topology of Firewall - protect the router5 nodes and 1 network, 5 links. Every link is listed as text below the diagram.ISPGWRemoteAdmin-PCPC1Office-LANeth0eth0ether2ether2eth0ether1ether1
5 nodes and 1 network, with the interface names each link uses. On a narrow screen, scroll the diagram sideways.
Every link, as text
  • ISP ether1 to GW ether1
  • ISP ether2 to Remote eth0
  • GW ether2 to Office-LAN (network)
  • Admin-PC eth0 to Office-LAN (network)
  • PC1 eth0 to Office-LAN (network)
Nodes in Firewall: protect the router, with the image each runs and the vCPU and RAM it’s set to
NodeDeviceImage in Add NodeSet to
ISPMikroTik RouterOSmikrotik-7.14.21 vCPU, 256 MB
GWMikroTik RouterOSmikrotik-7.14.21 vCPU, 256 MB
RemoteAlpine Linuxclbalpinebase-alpine-base-3-20-31 vCPU, 512 MB
Admin-PCAlpine Linuxclbalpinebase-alpine-base-3-20-31 vCPU, 512 MB
PC1VPCS hostBuilt in to EVE-NGCounted as 1 vCPU, 1,024 MB

How to open this lab

  1. Sign in to your workspace at lab.cloudlabbox.com.

  2. In File Manager, open Shared, then the folder MikroTik MTCNA RouterOS v7 guided labs.

  3. Open 09 - Firewall - protect the router and start its nodes, then open Lab Tasks for the scenario and the steps.

The lab is read-only. You can start the nodes and configure the devices, but changes to the topology can’t be saved. To change it, rebuild it in your own folder.

More MikroTik MTCNA labs

All MikroTik MTCNA labs

Related labs in other courses

CloudLabBox is independent of MikroTik. The lab follows exam topics and isn’t vendor training material; vendor names identify the exams and the images in the workspace.