CloudLabBox
Try the free demo

MikroTik MTCSE lab 3 of 10

RAW table and flood mitigation: SYN, UDP, ICMP and spoofed traffic

An attacker on the ISP segment hammers Fernvale Harbourside's published web server with bursts of TCP SYNs, pings and spoofed packets. Stop them in the RAW table, before connection tracking spends memory on them: per-source SYN and ICMP rate limits that put offenders on a block list, drops for spoofed and broadcast-directed traffic, SYN cookies and strict reverse-path filtering, while a normal visitor keeps loading the site.

Run this lab

It needs Lite: its 4 nodes are set to 4 vCPU and 1,280 MB in total. That fits the free demo too.

In your workspace: Shared, then MikroTik MTCSE RouterOS v7 guided labs, then 03 - RAW table and flood mitigation - SYN UDP ICMP and spoofed traffic

Try it free for 30 minutesRun it on Lite from £3 a day

The free demo needs no card and no email. Every lab plan includes every guided lab.

Level
Advanced
Time
About 70 minutes
Nodes need
4 vCPU, 1,280 MB
Smallest plan
Lite

The scenario

Fernvale Harbourside's router, GW, already has the stateful firewall from lab 2 and publishes the web server WEB on 203.0.113.2 port 80. Now someone on the ISP segment, ATT, is attacking it: bursts of new TCP connections (a SYN flood in miniature), ping bursts, probes of the router's UDP services, pings to the LAN's broadcast address, and packets with a forged private source address. WESTLINK is the ISP's router and also plays a normal visitor who must keep reaching the site.

DeviceAddressRole
GWWAN 203.0.113.2/29 · LAN 192.168.40.1/24 · DMZ 172.16.40.1/24Fernvale's router
WEB172.16.40.10/24web server, published as 203.0.113.2:80
WESTLINK203.0.113.1/29the ISP and a normal visitor
ATT (Linux)203.0.113.6/29, and a forged 10.66.66.66the attacker

What you’ll practise

  • Explain why RAW runs before connection tracking and what that costs and saves
  • Rate-limit SYNs and echo requests per source with dst-limit, and block offenders dynamically
  • Stop smurf amplification and spoofed private sources at the edge
  • Turn on SYN cookies and strict reverse-path filtering
  • Prove each rule with counters while a legitimate client keeps working

The tasks

  1. Prepare the attacker
  2. Why the RAW table
  3. A per-source SYN limit with dynamic blocking
  4. ICMP and UDP
  5. Smurf and spoofing
  6. Attack, and watch the counters

The Lab Tasks pane has the scenario, these tasks, the checks to run, hints and the full solution.

Topology and devices

The network as it opens in EVE-NG, drawn from the lab’s own canvas, and the image each node runs.

Topology of RAW table and flood mitigation - SYN UDP ICMP and spoofed traffic4 nodes and 1 network, 4 links. Every link is listed as text below the diagram.GWWESTLINKATTWEBWANether1ether1eth0ether3ether1
4 nodes and 1 network, with the interface names each link uses. On a narrow screen, scroll the diagram sideways.
Every link, as text
  • GW ether1 to WAN (network)
  • WESTLINK ether1 to WAN (network)
  • ATT eth0 to WAN (network)
  • GW ether3 to WEB ether1
Nodes in RAW table and flood mitigation: SYN, UDP, ICMP and spoofed traffic, with the image each runs and the vCPU and RAM it’s set to
NodeDeviceImage in Add NodeSet to
GWMikroTik RouterOSmikrotik-7.14.21 vCPU, 256 MB
WESTLINKMikroTik RouterOSmikrotik-7.14.21 vCPU, 256 MB
ATTAlpine Linuxclbalpinebase-alpine-base-3-20-31 vCPU, 512 MB
WEBMikroTik RouterOSmikrotik-7.14.21 vCPU, 256 MB

How to open this lab

  1. Sign in to your workspace at lab.cloudlabbox.com.

  2. In File Manager, open Shared, then the folder MikroTik MTCSE RouterOS v7 guided labs.

  3. Open 03 - RAW table and flood mitigation - SYN UDP ICMP and spoofed traffic and start its nodes, then open Lab Tasks for the scenario and the steps.

The lab is read-only. You can start the nodes and configure the devices, but changes to the topology can’t be saved. To change it, rebuild it in your own folder.

More MikroTik MTCSE labs

All MikroTik MTCSE labs

CloudLabBox is independent of MikroTik. The lab follows exam topics and isn’t vendor training material; vendor names identify the exams and the images in the workspace.