MTCNA: Module 1

Introduction
MTCNA: Module 1
 About Your Trainer
• Dritan VRESHTA
– CEO of [Link]
– Been in the IT field since 2006
– Been an IT facilitator since 2012
 Introduce Yourself
• Your name and company
• Your prior knowledge about networking
• Your prior knowledge about RouterOS
• What do you expect from this course?
 Schedule for the week
• Training day: 09:00 – 17:00
• 30 minute breaks: 10:30 and 15:00
• 1 hour lunch: 12:30
• Certification exam last day: 1 hour
• Rewrite (if qualified): 1 hour
 Housekeeping
• Emergency Exits
• Bathrooms
• Food and drinks while in class
• Mobile phones
• Questions and behaviour
 About This Course

• Provide both theoretical knowledge and practical

experience in configuring, managing and
troubleshooting MikroTik RouterBoards at a basic
level.
 Course Outcomes

The student will:

• Be able to configure, manage and do basic troubleshooting of
a MikroTik RouterOS device
• Be able to provide basic services to clients
• Have a solid foundation and valuable tools to manage a
network
MikroTik Certifications
 MTCNA Modules
• Introduction
• DHCP
• Bridging
• Routing
• Wireless
 MTCNA Modules
• Firewall
• QoS
• VPN
• Tools
• Practical Labs in each module
 Downloadable Resources
• [Link]/download
Introduction MikroTik

Introduction MikroTik
 About MikroTik
• Router software and hardware manufacturer
• Products used by ISPs, companies and individuals

• Mission: To make Internet technologies faster, more

powerful and affordable to a wider range of users.
 About MikroTik
• 1996: Established
• 1997: RouterOS software for x86 (PC)
• 2002: First RouterBOARD device
• 2006: First MikroTik User Meeting (MUM)
• Prague, Czech Republic
• 2015: Biggest MUM: Indonesia, 2500+
 About MikroTik
• Located in Latvia
• 160+ employees
• [Link]
• [Link]
 What is RouterOS?
• MikroTik RouterOS is the operating system of MikroTik RouterBOARD hardware.
• It can also be installed on a PC and will turn it into a router with all the necessary
features - routing, firewall, bandwidth management, wireless access point,
backhaul link, hotspot gateway, VPN server and more.
• RouterOS is a stand-alone operating system based on the Linux v2.6 kernel, and our
goal here at MikroTik is to provide all these features with a quick and simple
installation and an easy to use interface.
• You can try RouterOS today, go to [Link] and download the installation
CD image. The free trial provides all of the features with no limitations. In the
following pages you will find examples of some of the most important RouterOS
features.
 RouterOS Features
• Full 802.11 a/b/g/n/ac support
• Firewall/bandwidth shaping
• Point-to-Point tunnelling (PPTP, PPPoE, SSTP,
OpenVPN)
• DHCP/Proxy/HotSpot
• And many more… see: [Link]
 What is a RouterBOARD
• RouterOS supports multi-core and multi-CPU computers
(SMP).

• You can run it on the latest and greatest Intel motherboards

and use the newest multicore CPUs. RouterOS supports
installation on IDE, SATA and USB storage devices, this includes
HDDs, CF and SD cards, SDD disks and more.
 What is a RouterBOARD
• You need at least 64MB of space to install RouterOS, which
will format your partition and become the default operating
system of the device it’s in.

• Of course RouterOS has a multitude of supported network

interfaces, including the latest 10 Gigabit ethernet cards,
802.11a/b/g/n wireless cards and 3G modems.
 What is a RouterBOARD
• Integrated solutions - ready to use
• Boards only - for assembling own system
• Enclosures - for custom RouterBOARD builds
• Interfaces - for expanding functionality
• Accessories
 RouterOS License
• All RouterBOARDs are shipped with a license
• Different license levels (features)
• RouterOS updates for life
• x86 license can be purchased
• from [Link] or distributors
 RouterOS License
• On RouterBOARDs the license is included for free.
• There are no upgrades for license levels - if different license
level is needed, have to buy full license and install it on the
router.
• Better to chose the right RouterBOARD with the required
license level in the first place.
• The included license cannot be transferred to another router.
 RouterOS License Levels

Level Type Typical Use

0 Trial Mode 24h trial
1 Free Demo

3 CPE Wireless client (station), volume only

4 AP Wireless AP: WISP, HOME, Office

5 ISP Supports more tunnels than L4

6 Controller Unlimited RouterOS features

 RouterOS License Levels
Level number 0 FREE 1 DEMO 3 WISP CPE 4 (WISP) 5 ISP 6 Controller
Upgradable To - No upgrades ROS v6.x ROS v6.x ROS v7.x ROS v7.x
Wireless AP 24h limit - - Yes Yes Yes

Wireless Client and Bridge 24h limit - Yes Yes Yes Yes

RIP, OSPF, BGP protocols 24h limit - Yes Yes Yes Yes

EoIP tunnels 24h limit 1 unlid unlimited unlimited unlimited

PPPoE tunnels 24h limit 1 200 200 500 unlimited
PPTP tunnels 24h limit 1 200 200 500 unlimited
L2TP tunnels 24h limit 1 200 200 500 unlimited
VPN tunnels 24h limit 1 200 200 unlimited unlimited
VLAN interfaces 24h limit 1 unlimited unlimited Unlimited unlimited

HotSpot active users 24h limit 1 1 200 500 unlimited

Queues 24h limit 1 unlimited unlimited Unlimited unlimited

User manager active sessions 24h limit 1 10 20 50 unlimited

First Time Accessing the Router

The Hardware setup

First Time Access
Physical Setup
 Software
• If you connect via Serial cable:
– Baud rate = 115200
• Make sure your laptop firewall/s are disabled.
• Please note that VPN interfaces may cause issues.
 Accessing Your MikroTik
• GUI
– Winbox (requires Ethernet cabled connection)
• CLI
– Telnet, MAC telnet, SSH, Serial cable
• Webfig
– RB IP required for browser access
• FTP
– RB IP required for browser access
• Customised API
 WinBox & MAC-WinBox
• Uses either MAC address or IP ([Link]).
• Check for discovered neighbours on the LAN segment.
– MNDP - MikroTik Neighbor Discovery Protocol.
– Uses UDP protocol port 5678
• Select the router you want and login with credentials.
– Admin
– Blank password
Advanced Settings
 Webfig
• The router can also be configured from the browser.
– [Link]
– Username and password.
• Operation is the same as Winbox.
 Setting Up Using Quickset
• Fast and convenient way to configure the router.
• All configuration options are in one place.
• Settings are changed when you select the mode.
– Use it from factory defaults.
– Use it once only.
Quickset
 Default Configuration
• Various RouterBOARDs have differing default
configurations. Check the MikroTik Wiki for a tabular list.
• Note: To see configuration script that will be applied
after system reset use following command (however, see
warning below) /system default-configuration print
• Warning: /system default-configuration print Always
shows factory default configuration even if it is
overridden by a different netinstall script.
 Default Configuration
• CAP (Controlled Access Point)
• When CAP default configuration is loaded, 'ether1' is
considered a management port with DHCP client configured.
• All other Ethernet interfaces are bridged and ‘WLAN1' is set to
be managed by CAPsMAN
 Class Network
Student LAN (Laptop to MikroTik)
Laptop IP : 192.168.x.254/24
MikroTik Ether/WLAN port : 10.0.0.x/24
Trainer Gateway MikroTik
SSID:VTI_Mik
Band:5GHz
Gateway:[Link]/24
DNS: [Link]
 5GHz
SSID: Trainer will provide WWW
GW IP: [Link]
DNS: [Link]

WAN IP: Received via DHCP WAN IP: Received via DHCP

LAN LAN LAN

192.168.x.0/24 192.168.x.0/24 192.168.x.0/24
 Command Line Interface
• This is used for configuring the RouterBOARD using text based
commands.
• You can access the CLI by connecting to the RB using telnet or ssh.
• You can also access the CLI by
clicking “New Terminal” from the
Winbox utility.
 Safe Mode
• It is sometimes possible to change router configuration in a way that will make the
router inaccessible (except from local console). Usually this is done by accident, but
there is no way to undo last change when connection to router is already cut. Safe
mode can be used to minimize such risk.
• Safe mode is entered by pressing [CTRL]+[X]. To save changes and quit safe mode,
press [CTRL]+[X] again. To exit without saving the made changes, hit [CTRL]+[D]
• Now, if telnet connection (or winbox terminal) is cut, then after a while (TCP timeout
is 9 minutes) all changes that were made while in safe mode will be undone. Exiting
session by [Ctrl]+[D] also undoes all safe mode changes, while /quit does not.
 CLI Concepts
• Hierarchy – Commands are split into groups and organised using hierarchical menu levels.
• The name of a menu level reflects the configuration information accessible in the that relevant
section.
• Item Names and Numbers – Specific item names are assigned to items within some lists allowing
you to use item names rather than item numbers. For example, in the interface or user levels. As
these names are properties of the items, they do not change on their own and thus may be
preferred when writing console scripts.
• Item numbers are assigned by the print command and are not constant. They will remain the same
for the duration of a session or until the print command is issued again. This means they can be
used after add and remove operations.
• Abbreviations can be used as long as they are not ambiguous.
 CLI Concepts

• Navigation of the CLI is made easier by [?]

functionality. This allows you to see all commands at
the current menu level.
 CLI Concepts

• To see all available command options, press [tab] [tab].

• The Up and Down arrow keys allow you to cycle through
previous commands.
 CLI Concepts

• Pressing [tab] once will complete a command you have

started typing, provided there is enough information for
the command to be unambiguous. [tab] [tab] will give you
possible commands if this is the case.
 Moving Through the Levels

• You can always return to the root level using [/]

• To go back one level, use [..]

 Moving Through the Levels

• To enter the next level, type its name and [Enter]

• You can also go the desired level by trying the entire

level name and pressing [Enter]
 Useful Commands

• Print – displays a list of information. Either print a

level by typing [print] in that level or by specifying
what you want displayed.
 CLI - Monitor

• Monitor – Shows the status of items.

 CLI - Print
• More on [print] - shows all information that's accessible from particular command level. Thus, /system clock print shows
system date and time, /ip route print shows all routes etc. If there's a list of items in current level and they are not read-
only, i.e. you can change/remove them (example of read-only item list is /system history, which shows history of executed
actions), then print command also assigns numbers that are used by all commands that operate with items in this list.
– Common Parameters
• from - show only specified items, in the same order in which they are given.
• where - show only items that match specified criteria. The syntax of where property is similar to
the find command.
• brief - forces the print command to use tabular output form
• detail - forces the print command to use property=value output form
• count-only - shows the number of items
• file - prints the contents of the specific submenu into a file on the router.
• interval - updates the output from the print command for every interval seconds.
• oid - prints the OID value for properties that are accessible from SNMP
• without-paging - prints the output without stopping after each screen is full.
 CLI – Print (Cont.)
• There are some commands that are common to nearly all menu levels, namely: print, set, remove, add, find, get, export, enable,
disable, comment, move. These commands have similar behaviour throughout different menu levels.
• add - this command usually has all the same arguments as set, except the item number argument. It adds a new item with the
values you have specified, usually at the end of the item list, in places where the order of items is relevant. There are some
required properties that you have to supply, such as the interface for a new address, while other properties are set to defaults
unless you explicitly specify them.
– Common Parameters
• copy-from - Copies an existing item. It takes default values of new item's properties from another item. If you do not
want to make exact copy, you can specify new values for some properties. When copying items that have names, you
will usually have to give a new name to a copy
• place-before - places a new item before an existing item with specified position. Thus, you do not need to use the
move command after adding an item to the list
• disabled - controls disabled/enabled state of the newly added item(-s)
• comment - holds the description of a newly created item
– Return Values
• add command returns internal number of item it has added
 CLI – Print (Cont.)
• edit - this command is associated with the set command. It can be used to edit values of properties that contain large amount of
text, such as scripts, but it works with all editable properties. Depending on the capabilities of the terminal, either a full screen
editor, or a single line editor is launched to edit the value of the specified property.
• find - The find command has the same arguments as set, plus the flag arguments like disabled or active that take
values yes or no depending on the value of respective flag. To see all flags and their names, look at the top of print command's
output. The find command returns internal numbers of all items that have the same values of arguments as specified.
• move - changes the order of items in list.
– Parameters
• first argument specifies the item(-s) being moved.
• second argument specifies the item before which to place all items being moved (they are placed at the end of the
list if the second argument is omitted).
• remove - removes specified item(-s) from a list.
• set - allows you to change values of general parameters or item parameters. The set command has arguments with names
corresponding to values you can change. Use ? or double [Tab] to see list of all arguments. If there is a list of items in this
command level, then set has one action argument that accepts the number of item (or list of numbers) you wish to set up. This
command does not return anything.
 CLI - History

• History keeps up to 200 lines of the most recent actions and is useful for navigation
purposes – Jumping forwards and backwards in history can save time remembering
and executing commands previously done.
• You can also print the system history which gives a list of the last configuration
changes made to the RB. The configuration changes are held until the next shutdown.
• Previously invoked commands can be undone while in ‘safe mode’, but not past the
start of safe mode.
 Basic Router Setup

• Logging on
• User management
• IP addressing
• Wireless basics
• DHCP
• DNS
• Firewall masquerade
• Routes
 Accessing the Router

• Hard factory default the RB.

• Assuming you have all connected your RB to your laptop and turned off the laptop
firewall/s…
• Using Winbox, connect to the RB MAC and use default logins to access your MikroTik.
– admin | no password
 Router Identity

• The router identity can be found on the top bar of Winbox.

• To change this, go to “system” “identity” and change the name.
 User Management

• Remember! There is no password recovery!

• Secure your router:
– Give your admin account a password.
– Add a user (your name) with full rights (select the group - full) and give it a password.
– Disable the admin account
Adding Users
 User Groups

• Default groups: Full, Read, Change

• You can modify the default groups.
• By default the Read group can reboot the Mikrotik.
 Custom Groups

• Additional users with specific access needs can be created.

• The specific access needs are best catered for by creating
custom groups.
• When adding new users, give them appropriate permissions
using the custom groups option.
Customising Groups
 Explanation of Group Permissions

Permission/Policy Policy Explanation

local User can log on locally via console

telnet User can log on remotely via telnet

ssh User can log on remotely via secure shell

ftp User can log on remotely via ftp and send and retrieve files from the router

reboot User can reboot the router

read User can retrieve the configuration

write User can retrieve and change the configuration

policy Manage user policies, add and remove user

test User can run ping, traceroute, bandwidth test

web user can log on remotely via http

ppp User can log on using ppp connections to the router (PPP, PPTP, PPPoE)
 Lost Password?
• TOUGH!
• Either hard reset or re-install software using
Netinstall.
• Full instructions can be found at:
– [Link]
 Default IP & DHCP
• Default IP address on all boards is [Link]/24.
– Boards without specific configuration have IP address set on
ether1.
– Other boards have IP address set on the LAN interface.
• All boards that have the WAN port configured, will have a
DHCP client set on the WAN port.
• Typically on all CPEs, the DHCP server is set on the LAN port
giving out addresses in a range from [Link]-
[Link]
IP Addressing
 Wireless Configuration
• Wireless configuration depends on market segment
for which board is designed. It can be configured as
an AP or a station on 2GHz and 5GHz frequencies.
– Default 2GHz frequency is 2412
– Default 5GHz frequency is 5300.
– SSID is "MikroTik-" + last 3 bytes in hex from wireless
MAC address.
Wireless Basics: Activate
Wireless Basics: Scan and Connect
Wireless Basics: Check Settings
DHCP: Client
DHCP: Server
 NTP
• System -> SNTP Client
• Used to maintain correct
time.
• Important for accurate
logging and graphing data.
 Default DNS

• Every board allows remote DNS requests and has

a static DNS name of 'router' pre-configured
DNS
 Private and Public Space
• Masquerade is used for Public network access,
where private addresses are present
• Private networks include:
• [Link]-[Link],
• [Link]-[Link],
• [Link]-[Link]
 Default Firewall, NAT & MAC Server
• All boards with a configured WAN port also have protection
configured on that port.
• Any traffic leaving the WAN port is masqueraded.
• In forward chain there are also three rules added for boards with a
masquerade rule: [updated since security breaches (6.42)]
– accept established
– accept related
– drop invalid
• This is to prevent packets with a local network IP from being leaked
onto the WAN port.
Firewall Masquerade
Routes
 Set up the Class Network
• Configure your MikroTik to connect to the class
gateway MikroTik via wireless. (You are the station.)
• Connect your MikroTik to your partner.
• Test your connections by pinging each other and the
gw router.
• Do you have internet breakout?
 Updating RouterOS
• MikroTik keeps adding new functionality and
improving performance and stability by releasing
updates. This means that keeping your RouterOS up
to date is to your advantage.
• When using a RouterBOARD device, it is always
suggested to upgrade its RouterBOOT bootloader
after RouterOS is upgraded. To do this, issue the
command "/system routerboard upgrade"
 RouterOS Releases
• There are three types of RouterOS release:
– Release Candidate – These are “nightly build” types,
containing beta and test features.
– Bugfix Only – These contain fixes only, no new releases.
(Long-term release tree)
– Current – These contain new features as well as fixes
 Package types
• Acquiring packages
• Packages can be downloaded from MikroTik download page or mirrors
listed on that page. Either of provided download methods can be used.
• RouterOS packages
• For a simple home router, only the system package is needed for basic
operation. Other packages are optional. The DHCP package might be the
next most important, if your ISP provides IP addresses using this method.
PPP is needed if you require PPPoE or PPTP for connectivity. Other
packages are not required for a home router, and are completely optional.
Install them only if you are sure of their purpose.
 Package types
• RouterOS software packages can be:
– enabled or disabled to achieve necessary set of RouterOS
functions
– installed and uninstalled to free up disk space
– upgraded to the latest version or downgraded
• System -> Packages in Winbox to manage packages.
• For changes to take effect the router has to be rebooted.
– System -> Reboot
 Package types
Package Features
advanced-tools (mipsle, mipsbe, ppc, x86) advanced ping tools. netwatch, ip-scan, sms tool, wake-on-LAN

calea (mipsle, mipsbe, ppc, x86) data gathering tool for specific use due to "Communications Assistance for Law
Enforcement Act" in USA

dhcp (mipsle, mipsbe, ppc, x86) Dynamic Host Control Protocol client and server

gps (mipsle, mipsbe, ppc, x86) Global Positioning System devices support

hotspot (mipsle, mipsbe, ppc, x86) HotSpot captive portal server for user management

ipv6 (mipsle, mipsbe, ppc, x86) IPv6 addressing support

mpls (mipsle, mipsbe, ppc, x86) Multi Protocol Labels Switching support

multicast (mipsle, mipsbe, ppc, x86) Protocol Independent Multicast -

Sparse Mode; Internet Group Managing Protocol - Proxy
 Package types
arlan (x86) legacy Aironet Arlan support

isdn (x86) ISDN modem support

lcd (x86) LCD panel support for serial/parallel port devices. Not needed for RouterBOARD LCD panels.

radiolan (x86) RadioLan cards support

synchronous (x86) FarSync support

xen ( discontinued x86) XEN Virtualization

kvm (x86) KVM Virtualization

routeros-mipsle (mipsle) combined package for mipsle (RB100, RB500) (includes system, hotspot, wireless, ppp,
security, mpls, advanced-tools, dhcp, routerboard, ipv6, routing)

routeros-mipsbe (mipsbe) combined package for mipsbe (RB400) (includes system, hotspot, wireless, ppp, security,
mpls, advanced-tools, dhcp, routerboard, ipv6, routing)

routeros-powerpc (ppc) combined package for powerpc (RB300, RB600, RB1000) (includes system, hotspot, wireless,
ppp, security, mpls, advanced-tools, dhcp, routerboard, ipv6, routing)

routeros-x86 (x86) combined package for x86 (Intel/AMD PC, RB230) (includes system, hotspot, wireless, ppp,
security, mpls, advanced-tools, dhcp, routerboard, ipv6, routing)
 Package types
ntp (mipsle, mipsbe, ppc, x86) Network protocol server, also includes simplistic client. NTP client is also built into the system
package and functions well without this package installed.

openflow (mipsle, mipsbe, ppc, x86) Enables OpenFlow support

ppp (mipsle, mipsbe, ppc, x86) MlPPP client, PPP, PPTP, L2TP, PPPoE, ISDN PPP clients and servers

routerboard (mipsle, mipsbe, ppc, x86) accessing and managing RouterBOOT. RouterBOARD specific imformation.

routing (mipsle, mipsbe, ppc, x86) dynamic routing protocols like RIP, BGP, OSPF and routing utilities like BFD, filters for routes.

security (mipsle, mipsbe, ppc, x86) IPSEC, SSH, Secure WinBox

system (mipsle, mipsbe, ppc, x86) basic router features like static routing, ip addresses, sNTP, telnet, API, queues, firewall, web
proxy, DNS cache, TFTP, IP pool, SNMP, packet sniffer, e-mail send tool, graphing, bandwidth-test,
torch, EoIP, IPIP, bridging, VLAN, VRRP etc.). Also, for RouterBOARD platform - MetaROUTER |
Virtualization

ups (mipsle, mipsbe, ppc, x86) APC ups management interface

user-manager (mipsle, mipsbe, ppc, x86) MikroTik User Manager server for controlling Hotspot and other service users.
 Package Management

• RouterOS functions are enabled/disabled by packages

 Methods of Upgrading
• Automatic Upgrade
• This feature is available in command line, Winbox GUI, Webfig GUI and
QuickSet. It will not however upgrade to a more recent major version.
• The Upgrade button in QuickSet
• The Upgrade button in the Packages menu:
• Manual Upgrade:
• You can also manually upgrade by visiting [Link] and going
to the download page. Download the combined package for the device
you have RouterOS installed on. Drag and drop the files to the “Files”
menu. Make sure you drop the file into the “root”.
• Once the upload finishes, reboot the device to complete the process. The
New version number will be seen in the Winbox Title and in the Packages
menu.
 Change logs
• [Link]

– Check the changelogs after new firmware releases.

• [Link]

– Read the Forum to see how releases affect MikroTik users

worldwide.
 Firmware Upgrade
• After the RouterOS upgrade, if needed, is the firmware
(bootloader) upgrade.
– Open Winbox and go to "System/Routerboard" menu
– New window "Routerboard" will pop up, where you can see
current and latest available firmware.
– Click on "Update" button
– RouterOS will ask for upgrade confirmation, click on "yes".
• Note: After a firmware upgrade, the old version is used until
you reboot the router.
 Configuration Backup
• Two types of backups
• Backup (.backup) file - used for restoring
configuration on the same router
• Export (.rsc) file - used for moving configuration to
another router
 System Backup and Restore
• CLI and GUI backups are possible.
• CLI
– The “backup save” command is used to backup the entire router configuration.
– Located in /file
– Can be downloaded via ftp
• Important! The backup file contains sensitive information, do not store
your backup files inside the router's Files directory, instead, download
them, and keep them in a secure location.
 System Backup and Restore
• GUI

• Click on “Files” in Winbox to access this window.

• None of these files are required for router operation.
• You may also backup and restore the router from here.
• Backups may also be uploaded here.
• Easily done using drag and drop.
 System Backup and Restore
• Selecting Files and clicking Backup will create a current backup
identified with the routers Identity and current date and time.
• You can optionally specify a custom name and a password required
to restore the backup.
• To restore a router simply copy the backup file onto the target
router, select and click Restore.
• The restoration procedure assumes the configuration is restored on
the same router, where the backup file was originally created, so it
will create partially broken configuration if the hardware has been
changed. Remember to check that things like interface names are
the same.
 System Backup and Restore
• The backup file is non-editable.
• The entire router config is saved, including
usernames and passwords.
• The contents of /files are not included in the backup.
• The Dude and User-manager DB has its own backup
utility.
 System Backup and Restore
• It is possible to encrypt the backup files with RC4.
• Command Description
• load name=[filename] - Load configuration backup
from a file.
• save name=[filename] - Save configuration backup
to a file (when no name is provided, default name
will be used, and previous file will be overwritten).
 System Backup and Restore
• dont-encrypt - tells the system to not use any
encryption and make the file readable in text editors
(DANGEROUS).
• password - when not specified, current user
password will be required when restoring the file,
when specified - this password will be needed.
 System Backup and Restore
• Notice that it is pointless to set a password if you
use "dont-encrypt=yes" as a parameter. Password
only works in conjunction with encrypted files.

• A web tutorial can be found here: [Link]

[Link]/tutorials/mikrotik-backup/
 Export File (.rsc)
• “/export file=[[Link]]”
– Creates a text script backup of all the CLI commands needed to restore
your configuration to the same state it was in when you used the
command
– Certain things such as user details (passwords) are not backed up (group
policies information is).
– Warning: If the device has a folder named "flash", then the [Link]
file must be stored in that folder to work with the "run-after-reset"
command. Everything outside this folder is stored in RAM, the contents
of which are deleted on reboot or power cycle.
– Use a text editor such as Notepad++ to edit the file.
 RouterOS Services
• Different ways to connect to the RouterOS.
• API - Application Programming Interface.
• FTP - for uploading/downloading files to/from the
RouterOS.
• IP->Services
 RouterOS Services

• SSH - secure command line interface

• Telnet - insecure command line interface
• WinBox - GUI access
• WWW - access from the web browser
 RouterOS Services

• Note that it is not possible to add new services, only existing service modifications
are allowed.
• Firewall Service Ports – Don’t confuse them with each other
– /ip firewall service-ports
• Hosts behind a NAT-enabled router do not have true end-to-end connectivity.
Therefore some Internet protocols might not work in scenarios with NAT.
• RouterOS includes a number of NAT helpers, that enable NAT traversal for various
protocols.
• Note: If connection tracking is not enabled then firewall service ports will be shown
as inactive
 Resetting

• CLI
– /system reset-configuration
• GUI
– System -> Reset Configuration
 Resetting
• The command clears all configuration of the router and sets it to the default,
including the login name and password ('admin' and no password), IP addresses
and other configuration is erased, interfaces will become disabled. After the reset
command, the router will reboot.
– keep-users: keeps router users and passwords
– no-defaults: doesn't load any default configurations, just clears everything
– skip-backup: automatic backup is not created before reset, when yes is
specified
– run-after-reset: specify export file name to run after reset
 Resetting
• Warning: If the router has been installed using netinstall and had a script
specified as the initial configuration, the reset command executes this
script after purging the configuration. To stop it doing so, you will have to
reinstall the router.
 Resetting
• RouterBOOT reset button has three functions:
• Hold this button during boot time until LED light starts flashing, release the
button to reset RouterOS configuration (total 5 seconds)
– Keep holding for 5 more seconds, LED turns solid, release now to turn on CAPs mode
(total 10 seconds)
– Or Keep holding the button for 5 more seconds until LED turns off, then release it to
make the RouterBOARD look for Netinstall servers (total 15 seconds)
 Resetting

• RouterBOOT can be upgraded from RouterOS by:

– Upgrade to the latest version of RouterOS (newest firmware is included)
– Run command /system routerboard upgrade
– Reboot your router to apply the upgrade
 NetInstall

• Used for installing and reinstalling RouterOS

– Can be used to re-install router to default in the case of lost password
– Used when the OS becomes corrupted for some reason
– If no OS is available the Routerboard device will automatically try to find a Netinstall server (bios
must be latest version)
• Runs on Windows computers
• Direct network connection to router is required or over switched LAN
• Available at [Link]
NetInstall
Sources of Additional Information

• [Link]
• [Link]
• [Link]
• Distributor and consultant support
• support@[Link]
• Google is your friend
Lab Time
Basic Setup

Basic Setup
Basic MikroTik Setup
 In The Beginning – Quickset?
• Factory default the router (no default config)
• Connect router to Laptop (Disable Windows firewall)
• Use quickset to configure the RouterBOARD
• Put it in Router Mode
• Set the Wireless SSID as droid
• Your Ethernet should be set to 192.168.x.254/24
• Your WLAN should be set to DHCP client (automatic)
• Add a NAT rule
• Add a DHCP server with a manual range on your Ethernet port
• Set the system identity to Class x
 Quickset
• Check the following and answer why not:
• Did the wireless interface activate?
• Did it scan and pick up the SSID of the gateway?
• Was there an option to add the security profile for the wireless?
• Did the DHCP client get an IP from the gateway router?
• Did the DHCP server on the LAN interface hand out an IP to your laptop?
 Quickset
• Tips:
• In IP addresses, check the interface and subnet.
• In Wireless configuration, check AP/station mode.
• In DHCP client/server, check your interface.
Class Network

Class Network
Setting Up
Class Network Diagram
 Class Network Details
• Student LAN (Laptop to MikroTik)
• Router IP – 192.168.x.1/24
• MikroTik WLAN port – 10.0.0.x/24

• Trainer Gateway MikroTik

• SSID:VTI_Mik
• Band:5GHz
• Gateway:[Link]/24
• DNS: [Link]
 In The Beginning – Manual Setup
• Factory default the router
• Connect router to Laptop (Disable Windows firewall)
• Assign IP addresses as per the network diagram to your laptop (your RB will be your
gateway and DNS)
• Connect to the RouterBoard using Winbox (on MAC address)
• Assign IP address to the Ethernet port you have connected on the RB
– IP -> Address
– New address – specify IP, subnet and interface. (Network is automatically calculated based
on subnet mask)
– Click OK
• Log out of Winbox and reconnect using the IP address.
• Use ipconfig and ping on your laptop to test.
 User management
• Add a user with full permissions
– Login with user
• Create custom group with policies that allow testing
only (winbox, test, read)
– Create new user with read only permissions
– Create new user for testing purposes only
– Login with user and test to see if you can reboot
 RouterOS Services
• After a CAPs reset:
– Open RouterOS web interface -[Link]
– In WinBox disable www service
– Refresh browser page
 Basic Wireless Setup
• Enable the Wireless interface (Wlan2)
• In the Wireless tab:
– Set the mode to Station
– Set the band to 5GHz
– On the RHS click scan to search for the class AP
– Connect to the class AP (VTI_Mik)
– Leave all other settings default for now.
– Check to see if you are connected in the Wireless Registration tab.
 System Identity
• In System-> Identity change the name of your RB (Make
it x_YOURNAME)
• In Wireless use Advanced mode to change the name
of your Radio to x_YOURNAME_Wlan2
• Check in IP->Neighbours to see if you can see your
neighbours.
• (If not, make sure the discovery on your interface is
enabled)
 DHCP Client
• Add a DHCP client to Wlan2. Apply.
• All options should be selected. If not, do so.
• Go to DHCP Client->Status.
• Do you have an IP address, DNS
• Do you have a default route? (check in IP->Routes)
Gateway specified matches the one in DHCP Client Status?
• Can you ping google?
 DNS
• Check that you have a Dynamic entry received from the DHCP
Client (look in IP->DNS)
• The Dynamic entry will take precedence over any manual
entry you make.
• Add a manual DNS server. (make it the training gateway)
• Remember “Allow Remote Requests” makes it a DNS caching-
only server.
• Can you ping Google?
 Firewall Masquerade
• Go to IP-> Firewall
– Click on NAT
– Click on Add
– In the “General” tab select srcnat as the chain
– Your Wlan interface should be selected as your out-interface
– Click on the “Action” tab
– Select “Masquerade” as your action
– OK
– Test for internet access from your laptop
– If yes, great. You did it all correctly
– If No, troubleshoot! (ping external IP/hostname, traceroute, check interface IPs, isolate the
issue, fix the issue)
 Backups
• Create a .backup file
• Copy it to your laptop
• Delete the .backup file from the router
• Reset router configuration
• Copy .backup file back to the router
• Restore router configuration
 Backups
• Create a backup using ‘export’ command
• Copy it to your laptop
• Delete the export file from the router
• Reset router configuration
• Copy export file back to the router
• Restore router configuration
 Package Management
• Disable the wireless package
• Reboot the router
• Observe the interface list
• Enable the wireless package
• Reboot the router