CloudLabBox
Try the free demo

MikroTik MTCSE lab 2 of 10

Stateful firewall: packet flow, chains, connection tracking and ICMP

Fernvale Harbourside's router routes and NATs but filters nothing, so a host on the ISP's segment can reach the private staff LAN directly. Build a stateful firewall the way RouterOS's own default configuration does: an input chain that protects the router, a forward chain that protects the LAN and DMZ while keeping the published web server reachable, a custom chain for ICMP that keeps path MTU discovery working, and FastTrack for established traffic.

Run this lab

It needs Lite: its 4 nodes are set to 4 vCPU and 1,024 MB in total. That fits the free demo too.

In your workspace: Shared, then MikroTik MTCSE RouterOS v7 guided labs, then 02 - Stateful firewall - packet flow chains connection tracking and ICMP

Try it free for 30 minutesRun it on Lite from £3 a day

The free demo needs no card and no email. Every lab plan includes every guided lab.

Level
Intermediate
Time
About 70 minutes
Nodes need
4 vCPU, 1,024 MB
Smallest plan
Lite

The scenario

Harbourside's router, GW, now has hardened services (lab 1 did that on its sister router), but no firewall at all. It routes between the ISP, the staff LAN and a DMZ with Fernvale's public web server, and it publishes that server on its WAN address with a dst-nat rule. The ISP's router, WESTLINK, stands for anything on the ISP segment: it has routes to the private LAN and DMZ through GW, exactly as a hostile neighbour could add. Build GW a stateful firewall.

DeviceInterfaceAddress
GWether1 (WAN) · ether2 (LAN) · ether3 (DMZ)203.0.113.2/29 · 192.168.40.1/24 · 172.16.40.1/24
WESTLINKether1 · internet203.0.113.1/29 · 198.18.0.1/24
PCether1192.168.40.10/24
WEB (WebFig stands in for a web site)ether1172.16.40.10/24, published as 203.0.113.2 port 80

The policy: the LAN may go anywhere; the DMZ may reach the Internet but not the LAN; the Internet may reach only the published web server; only the LAN may manage GW; ping to GW is allowed but rate-limited.

What you’ll practise

  • Place the input, forward and output chains in the packet flow
  • Use connection states to accept return traffic and drop invalid packets
  • Protect the router with the input chain and the networks with the forward chain
  • Filter ICMP in a custom chain without breaking path MTU discovery or traceroute
  • Allow published services with connection-nat-state=dstnat and rate-limit with limit

The tasks

  1. See the problem
  2. Protect the router: the input chain
  3. ICMP: filter it, don't block it
  4. Protect the networks: the forward chain
  5. Read the connection table

The Lab Tasks pane has the scenario, these tasks, the checks to run, hints and the full solution.

Topology and devices

The network as it opens in EVE-NG, drawn from the lab’s own canvas, and the image each node runs.

Topology of Stateful firewall - packet flow chains connection tracking and ICMP4 nodes, 3 links. Every link is listed as text below the diagram.GWWESTLINKPCWEBether1ether1ether2ether1ether3ether1
4 nodes, with the interface names each link uses. On a narrow screen, scroll the diagram sideways.
Every link, as text
  • GW ether1 to WESTLINK ether1
  • GW ether2 to PC ether1
  • GW ether3 to WEB ether1
Nodes in Stateful firewall: packet flow, chains, connection tracking and ICMP, with the image each runs and the vCPU and RAM it’s set to
NodeDeviceImage in Add NodeSet to
GWMikroTik RouterOSmikrotik-7.14.21 vCPU, 256 MB
WESTLINKMikroTik RouterOSmikrotik-7.14.21 vCPU, 256 MB
PCMikroTik RouterOSmikrotik-7.14.21 vCPU, 256 MB
WEBMikroTik RouterOSmikrotik-7.14.21 vCPU, 256 MB

How to open this lab

  1. Sign in to your workspace at lab.cloudlabbox.com.

  2. In File Manager, open Shared, then the folder MikroTik MTCSE RouterOS v7 guided labs.

  3. Open 02 - Stateful firewall - packet flow chains connection tracking and ICMP and start its nodes, then open Lab Tasks for the scenario and the steps.

The lab is read-only. You can start the nodes and configure the devices, but changes to the topology can’t be saved. To change it, rebuild it in your own folder.

More MikroTik MTCSE labs

All MikroTik MTCSE labs

Related labs in other courses

CloudLabBox is independent of MikroTik. The lab follows exam topics and isn’t vendor training material; vendor names identify the exams and the images in the workspace.