MTCNA - Student Guide Prepare for the MikroTik MTCNA certification exam with step-by-step LABS on RouterOS v7MikroTik MTCNA - Student Guide Prepare for the MikroTik MTCNA certification exam with step-by-step LABS on RouterOS v7 Maher HaddadAll contents copyright C 2022 by Maher Haddad. All rights revered. No part of this document or related files may be reproduced or transmitted in any form, by any means (electronic, photocopying, recording, or otherwise) without the prior written permission of the published. Limit of Liability and Disclaimer of Warranty: the published has used its best efforts in preparing this book, and the information provided herein is provided “ad is”. Maher Haddad makes no representation or warranties with respect to the accuracy or completeness of the contents of this book and specifically disclaims any implied warranties or merchantability or fitness for any particular purpose and shall in no event be liable for any loess of profit or any other commercial damage, including but not limited to special, incidental, consequential, or other damages. Trademarks: This book identified product names and services known to be trademarks, registered trademarks, or service marks of their respective holders. They are used throughout this book in an editorial fashion only. In addition, terms suspected of being trademarks, registered trademarks, or service marks have been appropriately capitalized, although Maher Haddad cannot attest to the accuracy of this information. Use of a term in this book should not be regarded as affecting the validity of any trademark, registered trademark, or service mark, Maher Haddad is not associated with any product or vendor mentioned in this book.DEDICATION i This book is dedicated to my wife Claudine and my 2 kids Mel ne » Melanj and Emile, who supported me in this mission. Also, I dedicate the book to my parents, who both passed away, as being the main re : eason for my successful career in the Information Technology field,WHAT STUDENTS SAY ABOUT MAHER’S WAY OF TEACHING? ———=—T__ oO tok Very good course. Successfully presented in great detail, including labs. Instructors teaching is easy to understand, Gained a very good understanding of MikroTik routers. Thank you very much. tok Ik Thank you Maher - Your courses are a life saver for me. | am writing my MTCNA exam in one months time and feel very confident after going through your classes. Kk hk Its really cool that you don't just teach stuff to pass the exam, but things that can be helpful in production, which is more important tok tok Great course.! like the labs as they are real life scenarios which help you in managing your Mikrotik really good at your work place. Kak There were times when | thought, | know this already. And then all of a sudden, you explain it as if it's the fist time Im learning about it. You explain the LABS easy for anyone to understand. ™m learning way more than what | paid for! Thank you Maher!CONTE ACKNOWLEDGMENTS ovsssssessssse 1 What is MikroTik and what are its products? History of MikroTik What is the RouterOS? Routerboard..... Integrated Solutions. First Time Access to the MikroTik Router... Quick Set .. LAB: Quick Set Webfig. LAB - Webfi Winbox LAB - Winbox.. 2 RouterOS command line in LAB - SSH vs Telnet RouterOS CLI Principles. LAB: Basic Command Li terface (CLI) ,Upgrading the RouterOS... LAB: Upgrade the RouterOS Online LAB: Manual RouterOS upgrade .... LAB: Upgrade the RouterBoot.... 5 Router identity, login, services, backup, Netinstall & license levels .. Router Identity .. LAB: Router Identity .. Managing RouterOS Login - Users and Groups... LAB: RouterOS Users and Groups... Managing RouterOS Services... LAB: Managing RouterOS Services. Backup and Restore .... LAB: Binary Backup and Restore... LAB: Configuration Backup and Restore... Resetting the MikroTik RouterOS... LAB: Resetting the MikroTik RouterOS. Reinstalling a RouterOS device LAB: Reinstalling a RouterOS device (Netinstall).. RouterOS License Levels.. 6 DHCP & ARP Dynamic Host Configuration Protocol (DCHP).. LAB: DHCP Server & DHCP Client... Address Resolution Protocol (ARP) .. LAB: ARP. 7 RouterOS Bridge What is the bridge on RouterOS? ... LAB; Bridge. Wireless Station Bridge: LAB 8 Routing.....Routing Fundamental Static Routing Protocol Dynamic Routing Protocols..... LAB: Static, default ECMP and floating routes... 9 Wireless .... What is Wireless? ... Wireless Frequencies & Channels... LAB: Wireless Setup on MikroTik LAB: Wireless Station, Default authenticate and Access list .. 10 Firewall... MikroTik Firewall Functions... MikroTik Firewall Chains..... Firewall Basics ... Firewall Action... LAB: Firewall Connection States..... LAB: Protecting your customers (Forward) LAB: Basic Address List 287 LAB: Destination NAT / Redirect. 293 FastTrack..... 298 LAB: FastTrack... 299 RouterOS QOS Queueing Basics ... LAB: Simple Queue LAB: One Simple queue for the whole network (PCO)... 12 VPN Tunnels. Virtual Private Network (VPN)... Point to Point Tunneling Protocol (PPTP) LAB: PPTP (Quick Set)... Point to Point Protocol over Ethernet (PPPoE)...LAB: PPPOE .. 13 Miscellaneous .. Ping Tool... Traceroute Tool... Profiler Tool... Interface Traffic Monitor... Torch Tool. Graphs...ACKNOWLEDGMENTS MikroTik MTCNA is a very demanding certificate nowadays. Recently, MikroTik has changed the certificate exams to be based on MikroTik RouterOS v7 after being on RouterOS v6 for the last 6 years, For this reason, I have decided to write this book to be based on RouterOS v7 and to be like a student companion in your journey with learning MTCNA. As being a MikroTik Certified Trainer, | have been teaching MTCNA for some period now and I know what is needed for students to understand the materiel very well and be prepared for the MTCNA exam. This book will be based on theory and LABS. So, in every topic I will explain the theory behind it then directly apply it on a LAB to show you step by step how you can configure it on MikroTik products. To be able to follow the LABS, you require to have 2 MikroTik routers with wireless capabilities. It is ideal to have TCP/IP and Networking knowledge to be able to follow this book. Finally, I hope that you will enjoy reading this book and if you have any question or justification, you can just drop me an email to [email protected] Also, you can have a look to my online courses published on my platform here: https://mynetworktraining.com Maher Haddad MyNetworkTraining.com ~ Maher Haddad 11 What is MikroTik and what are its Toductsy In this 1* chapter, I have to start doing an introduction about MikroTix, The fy question that will come to your mind will be: What is MikroTik? In a simple sentence, MikroTik is a software and hardware manufacture, : means that they have their own Operating System, which is called Routeros, oy they have their own hardware which is called a Routerboard. The Routerog (thelag version is version 7 used in this book) is always installed on the RouterBoards tobe the main Operating System of all MikroTik products. The market that MikroTik targets varies in size. It can start from Home, they companies, organizations, hotels, hospitals until We go to big ISPs and WISPs, So, as you will see, the products they create are very stable and they-can be ‘used from small users and it can 80 to big networks such as an ISPs, That means that the goal of MikroTik is to make the Internet technology faster, Powerful and affordable to wider range of users. MikroTik company is based in Latvia which is a Europ. with Estonia, Lithuania, Belarus and Russia, Thad the chance to visit Latvia once when | Was following the “Train the Traine” Session at MikroTik office to become a MikroTik Certified Trainer. The taiing happened at MikroTik ‘raining facility in Latvia, | was there for couple of days ad have enjoyed my stay there, MyNetworkTraining com — Maher Haddad uylithuania: Lo im, a." MikroTik is fully operated in Latvia, that means that they do not have any other offices for them outside Latvia. Of course, they do have a lot of distributors in most of the countries, but as per MikroTik itself, the only offices they have are in Latvia {at least up to now). History of MikroTik MikroTik is not a very old company, but their products are widely used in all the world, Here below a table showing you when MikroTik has started: + 1995: Established + 1997: RouterOS software for x86 (PC) +2002: RouterBOARD is born + 2006: First MUM. So, the company has been established in year 1995. Then the first RouterOS they created was in year 1997 (so 2 years later). That RouterOS was only used on an x86 MyNetworkTraining.com — Maher Haddad 3_, PC hardware in that time. That means if you had a PC, you could run the 0 on itand make itas a route. That was the only option available in that nc In year 2002, MikroTik has created its own Routerboard (we will Speak gi ding Routerboard in this chapter) the In year 2006, MikroTik has organized the first MUM. MUM means “MilroTicy, Meeting”. This type of event happens once every couple of months (Prior Covig. i period) where many MikroTik employees come to a country and organize an even to speak about their latest technologies and give a chance for MikroTik const and trainers to show about some of technologies they use in their Produetion networks. This will be in a form of presentation that MikroTik;s Consultants/trainers can show to the participants. Because of Covid, the MUM has been ceased but surely after the pandemics ove, new MUMs will happen in different countries. T highly advise you to participate in MUMs when it happens in your region, You can spend couple of days seeing presentation of new technologies and meeting MikroTik employees. Also the entrance is for free @ What is the RouterOS? RouterOS is a stand-alone operating system based on the Linux kernel. As I bat already mentioned, the RouterOS is the operating system of the MikroTi Routerboards. As being based on Linux kernel, then if you have any Linux experience you Wil that configuring MikroTik Routers/switches isn’t difficult for you. In addition of having the RouterOS on Routerboards, it can also be ist dedicated PC/server. Also, MikroTik provide a Cloud Hosted ae st RouterOS image that you can install it in a Virtual Machine such 2 VirtualBox, ect... ‘MyNetworkTraining.com — Maher HaddadThe main function of the MikroTik RouterOS is to make your MikroTik Routerboard as: e adedicated router © abandwidth shaper © a (transparent) packet filter © any 802.11 a,b, g, nand ac wireless device e And much more You will see later in this course that in the same MikroTik Routerboard, you can make it as a router using the most advanced routing protocols such as RIP, OSPF, BGP, MPLS. You can also make it a bandwidth shaper using the most advanced QOS queuing types such as PCQ, SFQ, RFQ, FIFO. You can make it as a Firewall device using the firewalling feature that is available in the RouterOS. You can make it a Wireless device and use the most advanced Wireless technology on it. You can make it as a switch and use VLAN, STP, RSTP, MSTP. And the list can continue....... Routerboard MikroTik provided you the possibility to build up your own router. All you need to do is to buy the Routerboard from a MikroTik distributor and add the component sthat you want on that Routerboard. So, you have to think on the computer world like have a motherboard and you put all components you want on that motherboard. A picture of a Routerboard is here below: MyNetworkTraining.com — Maher HaddadRB911G-2HPnD SO0Mhz CPU, 32MB RAM, 2xGigabit Ethernet, onboard 2.4¢hy wireless, RouterOS L3 Those Routerboards are created by MikroTik and Tange from small home Touters tg carrier-class access concentrators. Those Routerboards come usually with the RouterOS installed on them. If you want to see the list of available RouterBoards offered by MikroTik, you can g0 to MikroTik website on the following link: https://mikrotik.com/products/group/routerboard Integrated Solutions These types of products are provided complete by MikroTik with cases and power adapters. They are ready to be used in a production network and are preconfigured with the most basic functionality, that means that the RouterOS is already installed on them. All you need to do is to plug it in and connect to the Internet or a corporate network. MyNetworkTraining.com — Maher HaddadHere below 2 examples of 2 different MikroTik routers: This is all what we need to know in the 1* chapter. In the upcoming chapter, we have to make the 1° connection to the MikroTik router. See you in the upcoming one. MyNetworkTraining.com — Maher Haddadoo” 2 First Time Access to the MikroTik Route, Now that we have the basic idea about MikroTik, it is time now to start Betty 1 access to the MikroTik router. I will show you that you can connect whe MikroTik router via different ways, and all willbe covered inthis chap” The RouterOS that will be used throughout all this course is the newest One wg is RouterOS v7. Quick Set The first way to connect to the MikroTik router is via the browser using “Quick Set”. Once you have the MikroTik router out of the box, it comes with a defauy configuration. This default configuration can be like “plug and play” sohition fy people who are not familiar in configuring the Mikrotik router. All you need to dy is to put the internet cable on the port Etherl of the router, and the LAN cable on any of the other ports, then you have internet. Let’s do the 1* LAB to show you how we can connect to the MikroTik router. LAB: Quick Set 192.168.88.0/24 RI Above is my LAB scenario. I have connected my PC via a cable to Eher? int _ it Of the router. Why Ether2? Because if you connect it to Ether! you wil 92% - ‘] ies access to the router as Ether! is for the WAN connectivity (MikroTik appli filter rules on Ether in their default configuration). 8 MyNetworkTraining.com — Maher Haddad eeOn my PC, I have to set an IP from the range of 192.168.88.0/24, so, I will choose 192.168.88.2/24. I have chosen this range of IP, because MikroTik have an IP of the LAN side of the router of 192.168.88.1/24 set on its default configuration, so we should have the same range on the PC to be able to reach to the router. Let’s start 1* putting the IP on the PC. {® Network Connections + BD « Network and Intemet > Network Connections Organize »____Disable this network device _ ————— Rename Ethernet 3 Properties me ¢ e eo hty Contre i Internet Protocol Version 4 (TCP/IPv4) Properties x |, me: 2 You can get P settings assigned automaticaly if your netwark supports this capability, Othernise, you need to ack your network administrator oi, | for the appropriate IP settings. ae q Cr ‘CObtain an IP address automaticaly a | ©se the folowing IP address: 0) address: ey Subnet mask: me 0 OY | | | | | Thave put the IP address, subnet mask and the gateway (which is the IP of the LAN ‘MyNetworkTraining.com - Maher Haddad 9oy side of the MikroTik router). Also, I have added the DNS so later y ca m internet and visit websites. 8 ty & Let's make a ping now from my PC to the MikroTik router to see iff cay each ty its IP 192.168.88.1: Pee rue Cee cere rah Yo)’ t Moy ae bd «1: bytes=32 time Tideros ST 10 fault Here we go. The 1* thing it would ask you to put a password (bY de 10 a MyNetworkTraining.com ~ Maher Haddaddoesn’t have a password). This is something new that MikroTik has added on RouterOS v7 that the router should have a password. I will put a simple new password now of “123456” and press on “Change Now” then see what I will have. ar 0B & sama rnniinan st Omar ent @cerynens Oden Olare Now we are on the “Quick Set” interface. You can see that the router is already configured. The internet part is configured to receive an IP automatically from the ISP via DHCP, the LAN part is configured and also the Wireless is configured. I will connect the internet cable to the router on Ether! interface and see if my PC can go to the internet. ‘MyNetworkTraining.com ~ Maher Haddad |Fy le.com PE aaa rg ees j e.com [142.2 Seats pecan eee se bare, aul aay ae ret eb eee her ha a ale at 0.179.174: bytes= Le or inne hes eee reer. AL) ies bY Here we go. My PC can go to the internet and Goo, gle.com server is pingable So, you can see, we didn’t really do anything Major with the Configuration, All had to do is to put the cables and magically it is we orking. The Teason MikroTik have a default confi Why is becay ‘iguration set on the router, Now let’s check what other things we can have from the “Quick set” Home AP Dual Intemet "Static ©putomatc Od Home Mesh ae PTP Bridge AP es -168.23.254 PTP Bridge cpe | Release | '5255.255.0 29) Wisp ap 2.168.234 Local NetworkOn the “Quick Set” you will have different profiles that you can use. In the picture you see the different profiles that you can choose based on what you want the router to have as a function. When selecting any of these profiles, a default configuration will be loaded on the router. For example, if you have using the MikroTik devices on outdoor Point-to-Point link, you can select the profile “PTP Bridge AP” then the default configuration made by MikroTik for this profile will be loaded on your router. You got the idea? I will leave it now on the “Home AP Dual” profile, but I will go to my PC and remove the IP that I have set manually to see if I will get an IP automatically from the router and if I will be able to go to the internet. Let’s do this experiment. MyNetworkTraining.com— Maher Haddad| Internet Protocol Version 4 (TCP/IPv4) Properties General Alternate Configuration You can get IP settings assigned automatically if Your network sunports this capability. Otherwise, you need to ask your network administ,, for the appropriate IP settings. bins ©) Use the following IP address: IP address: : Subnet mask: Default gateway: OvUse the following DNS server addresses: Preferred DNS server: Alternate DNS server: . { Validate settings upon exit . ‘cally 0" I will check on my PC command prompt if I have received an IP automatically the router. ‘MyNetworkTraining.com — Maher Haddad zarstiety Cus tire eae ey eas Cue east ST eat Link-local IPv6 Address Here it is. The router has given my PC an IP of 192.168.88.254/24 I will try now to ping to google.com server from my PC to see if I can go to the internet: Pinging google.com : Ja: LAs a 1 Cea es Raed eee Be tr Reply from 172.217. aan age MU Per eee Reply from 172.217.168. i 15 SuPer ists tae Lm esas (EPL “Packets: Sent = 4, Received Ce eon et eC Re su oe Une ee een Minimum = Sms, Maximum = 6ms, Average = 5ms IC: \Use Indeed, I am able to go to the internet. Hoeraaaayyyyy! That’s all what I needed to show you in this 1 LAB. Now we have to work on another topic to access the MikroTik router which is the “Webfig” MyNetworkTraining.com ~ Maher Haddad 15Webfig s loaded on the “Oui tion that i We have seen from the “Quick Set” that the configura t to make oe if we wan MikroTik router is the “Home AP Dual” profile. But what if W° the default . 1c changes on this configuration. Or possibly we want to wipe all : ible? configuration and do a new configuration from scratch. Is this possible? Well yes, that’s possible using different way. For now, I will show you how to do that via “Webfig”. “Webfig” means that you configure the MikroTik router via the web. You will have access to almost everything you want to do on the router via the web. Think of putting a new IP, configuring a DHCP server, making NAT. Or maybe doing some advanced routing configuration, firewalling, queuing, etc.... All those things can be done via “Webfig”. Let’s do a LAB to show you what you can do via “Webfig” LAB - Webfig 192.168.88,0/24 To access the router via “Webfig” we should also go to the browser and th ut the! router IP on the URL then click on “Webfig” top right of the page: , MyNetworkTraining.com— Maher HaddadSeth mnt a) . wateannnctigrouc . Once done, you will be redirect to a new page totally different than what you have on the “Quick set” i tye thfcot IB) Rte toe 1500 1580.7 Kope 1617 tips DR Gates eter 15001598 32 8 toe wo) (Rs betters Bhemet 1500 1598 95.3 Kips 12.0 kbps ee ee ee ee ote ] 8 Gated chemet 1500 1508 ope ote ol Sb ethers ‘ethernet 1500 1508 Obps bps B) |S Walent——Wrelen (burn ARG 15001600 Ope tee Hh [oth wera _[vreten theres aro 1500__[iso_[otwe ce You can see on the left side you have all Tabs that you can use them to do the configuration on the router. You can see Wireless, Interfaces, WireGuard, PPP, Bridge, Switch, Mesh and so on. By the way, that’s what makes the MikroTik router better than any other brands in my opinion, because you can do almost everything from different technologies on the same device. Back to “Webfig”, we already have a default configuration from “Quick set” loaded MyNetworkTraining.com — Maher Haddad 17os” on the router so let’s check this configuration. I am interested to seg “DH es enabled on Ether! s0itakes an TP from the ISP router (do not worry abou “ Wi are seeing now, we wll go through al of them an explain them in this 0k), ‘You see that Ether! interface has DHCP client enabled on it and have received an IP of 192.168.23.254/24 from the ISP router. Tam interested to see how I have received an IP to my PC from the router. For this, we need to check the DHCP server configuration on the router. Let’s do that. ss2.t6e.ea0/2 192.168.0081 192.160.00.1 se You can see that the router has DHCP server enabled and give IP from the 18 _ ‘MyNetworkTraining.com ~ Maher Haddad192.168.88.0/24. We have seen some of the configuration that is loaded by default. Of course, we can adjust it now and change what we want, but I always like to reset the router without any default configuration, then I can build up the configuration from scratch. That means the router will have zero configuration on it. Let me show you how to do that. MyNetworkTraining.com — Maher Haddad