CloudLabBox
Try the free demo

MikroTik MTCSE lab 1 of 10

Securing the router: users, services, MAC server and neighbour discovery

Fernvale's new Harbourside edge router went live with RouterOS defaults, and a quick audit found it offering Telnet, FTP and the web interface to everyone and announcing its model and version to the ISP. Lock it down: named accounts with least privilege, only the services the NOC needs, on a non-default port and only from the management network, and no MAC access or neighbour discovery outside it.

Run this lab

It needs Lite: its 4 nodes are set to 4 vCPU and 1,280 MB in total. That fits the free demo too.

In your workspace: Shared, then MikroTik MTCSE RouterOS v7 guided labs, then 01 - Securing the router - users services MAC server and neighbour discovery

Try it free for 30 minutesRun it on Lite from £3 a day

The free demo needs no card and no email. Every lab plan includes every guided lab.

Level
Intermediate
Time
About 60 minutes
Nodes need
4 vCPU, 1,280 MB
Smallest plan
Lite

The scenario

Fernvale's new Harbourside office router, EDGE, went live yesterday with RouterOS defaults plus addressing and NAT. A quick audit found that it answers Telnet, FTP and the web interface on every interface, the Internet side included, that its DNS cache answers anyone, and that the ISP's router can read EDGE's name, model and exact RouterOS version from neighbour discovery. Everyone logs in as admin.

Harden EDGE so that only the NOC's management network (10.10.10.0/24, ether3) can manage it, with named accounts, encrypted services only, and nothing on the WAN or staff LAN that an attacker can use.

DeviceInterfaceAddress
EDGEether1 (WAN) · ether2 (staff LAN) · ether3 (management)203.0.113.2/29 · 192.168.40.1/24 · 10.10.10.1/24
WESTLINK (the ISP)ether1203.0.113.1/29
STAFF (a RouterOS router playing a staff PC)ether1192.168.40.20/24
NOC (Linux)eth010.10.10.10/24

EDGE already has interface lists WAN, LAN and MGMT with one interface each.

What you’ll practise

  • Name the common threats to a router and the layers of RouterOS hardening
  • Create least-privilege groups and users and restrict where they may log in from
  • Disable unused services, restrict the rest by address and move SSH off its default port
  • Limit MAC-Telnet, MAC-WinBox, MAC ping and neighbour discovery to the management interface
  • Verify the result from inside and outside

The tasks

  1. Address the NOC PC
  2. Audit what EDGE exposes
  3. Named accounts with least privilege
  4. Only the services you need, only from the NOC
  5. Switch off what nobody uses
  6. MAC access and neighbour discovery only on the management network

The Lab Tasks pane has the scenario, these tasks, the checks to run, hints and the full solution.

Topology and devices

The network as it opens in EVE-NG, drawn from the lab’s own canvas, and the image each node runs.

Topology of Securing the router - users services MAC server and neighbour discovery4 nodes, 3 links. Every link is listed as text below the diagram.EDGEWESTLINKSTAFFNOCether1ether1ether2ether1ether3eth0
4 nodes, with the interface names each link uses. On a narrow screen, scroll the diagram sideways.
Every link, as text
  • EDGE ether1 to WESTLINK ether1
  • EDGE ether2 to STAFF ether1
  • EDGE ether3 to NOC eth0
Nodes in Securing the router: users, services, MAC server and neighbour discovery, with the image each runs and the vCPU and RAM it’s set to
NodeDeviceImage in Add NodeSet to
EDGEMikroTik RouterOSmikrotik-7.14.21 vCPU, 256 MB
WESTLINKMikroTik RouterOSmikrotik-7.14.21 vCPU, 256 MB
STAFFMikroTik RouterOSmikrotik-7.14.21 vCPU, 256 MB
NOCAlpine Linuxclbalpinebase-alpine-base-3-20-31 vCPU, 512 MB

How to open this lab

  1. Sign in to your workspace at lab.cloudlabbox.com.

  2. In File Manager, open Shared, then the folder MikroTik MTCSE RouterOS v7 guided labs.

  3. Open 01 - Securing the router - users services MAC server and neighbour discovery and start its nodes, then open Lab Tasks for the scenario and the steps.

The lab is read-only. You can start the nodes and configure the devices, but changes to the topology can’t be saved. To change it, rebuild it in your own folder.

More MikroTik MTCSE labs

All MikroTik MTCSE labs

Related labs in other courses

CloudLabBox is independent of MikroTik. The lab follows exam topics and isn’t vendor training material; vendor names identify the exams and the images in the workspace.