Meet RouterOS¶

Practical 3.3 meet-routeros-annex.pdf · PDF

Pick up the router on your group's table. Remember the first week of Unit 1: is this a computer? Yes: it has a CPU, RAM, storage, input and output. Then it has an operating system. Which one? Not Windows, not Debian.

Until now a small Linux container played the router and the DHCP server. From today your group has a real one, the same family of box that runs offices and Internet providers. By January it will be the heart of your group's company network. On this page you learn to get into it, move around, change it safely, and put it back to factory settings.

What is in the box¶

RouterOS is the operating system of MikroTik routers. It is built on the Linux kernel; we use version 7.

MikroTik is a company from Latvia, founded in 1996. The same RouterOS runs on a small home router and on the big routers of an Internet provider. It also runs in a virtual machine, called the Cloud Hosted Router (CHR): each of you runs one in containerlab.

The default configuration¶

A new home or office MikroTik is not empty. Out of the box:

flowchart LR
    WALL(["Wall socket<br>school network / Internet"]) ---|"ether1 · WAN<br>DHCP client + firewall"| R["<b>MikroTik</b><br>RouterOS v7"]
    R ---|"bridge: ether2 … last<br>192.168.88.1/24<br>DHCP server + DNS"| PC["<b>Your group's PC</b><br>gets 192.168.88.x"]

This is the "four devices in one box" from Networks: router, switch, access point and DHCP/DNS server.

Three doors into the same rooms¶

The three doors open the same rooms. Every WinBox menu (IP → Addresses) is a path in the CLI (/ip address). A change made through one door shows in the others at once: it is one configuration, three ways of looking at it.

Getting in: the group's router¶

Practical 3.3 has two parts at once. In Part A, the group works on its real router: one driver at the keyboard, the other two check the sheet, and the driver changes at every step. In Part B, whoever is not driving works alone on their own CHR.

Cable the group's PC to ether2 (not ether1) and look at what it received:

ip -br addr ; ip route

The PC now has a 192.168.88.x/24 address and default via 192.168.88.1. Nobody typed them: the router's DHCP server did. While your PC is cabled to the router, it is off the school network.

Then try the three doors, in this order:

1. WebFig: open http://192.168.88.1, user admin, the password from the sticker. RouterOS asks you for a new password. Open Quick Set and look at the WAN half and the LAN half. Apply nothing.
2. WinBox: open Neighbors. You see one line with the router's MAC, its address, its identity (its name) and its version. Click the MAC address, then Connect. Look at Interfaces (a running port shows R), IP → Addresses and IP → DHCP Server → Leases, where you find your own PC.
3. CLI: ssh admin@192.168.88.1 from the cabled PC.

If Neighbors is empty, check you chose the right network card and that the PC is cabled to a LAN port, then press Refresh.

Moving in the CLI¶

The CLI is a tree of menus, like folders. A path starts with /; .. goes one level up.

On the group's router, the CLI part looks like this (G = your group number):

/system identity set name=gG-router         # with your group number
/ip address print
/ip dhcp-server lease print
/system resource print

The identity is the router's name. The prompt changes at once to [admin@gG-router] >. /ip address print shows 192.168.88.1/24 on the bridge, the lease list shows your PC, and /system resource print shows the version, uptime, CPU and memory.

Note that /system identity set name=… needs no item number, because there is only one identity. /ip address set does: use the number shown by print.

Your own router: a CHR in containerlab¶

Part B runs on your own PC, with the lab file ros.clab.yml: one CHR called r1, cabled to a Linux PC called pc1.

containerlab deploy -t ros.clab.yml          # the router needs 1-2 minutes to boot
ssh admin@clab-ros-r1                        # password: admin

You see the prompt [admin@r1] >. /interface print shows ether1 (containerlab's management cable) and ether2 (the lab cable to pc1). If ssh is refused in the first minutes, the router is still booting: docker logs -f clab-ros-r1 shows when it is ready.

Give it your group's router address, and give pc1 an address in the same network:

/system identity set name=gG-surname
/ip address add address=10.G.0.1/24 interface=ether2

docker exec -it clab-ros-pc1 bash            # second terminal
ip addr add 10.G.0.11/24 dev eth1
ping -c 2 10.G.0.1

The ping answers. For the first time in the unit, your group's router address 10.G.0.1 exists. If it does not answer: did you add the address to ether1 by mistake, or forget /24 on either side?

Users, Safe Mode and reset¶

Users and groups¶

One rule from system administration (you will meet it properly in Unit 5): give each person only the power they need, so nobody works as the shared admin. RouterOS has users in groups with rights:

Good practice, from the MikroTik manual: create your own user with a strong password, and disable or remove the default admin.

/user add name=marta group=full password=...
/user print

On your CHR, create the intern pau in the group read, log in as pau, and try:

/ip address print
/system identity set name=hacked

The first works; the second is refused for lack of permissions. The intern can look, but not touch.

Safe Mode¶

The classic accident: you change the address of the very port you are connected through, and you are locked out. The router may be in another building.

Safe Mode undoes everything you changed since you turned it on, if your session dies.

In the CLI press Ctrl+X (or F4): the prompt shows <SAFE>. Press Ctrl+X again to keep the changes. WinBox has the same as a button.

Save and reset¶

Before you reset, save what you did. /export file=name writes the configuration as a text file of commands; /export alone prints it. Passwords are never exported.

After the reset of the group's router, the PC gets a 192.168.88.x address again, the identity is the default one, your users are gone and admin has the sticker password. Leave it like that: the next sessions start from there.

Clean up the CHR with containerlab destroy -t ros.clab.yml --cleanup. Hand in practical-3.3-surname.md on Google Classroom: the /export of your CHR, the answers of the sheet, and three lines on which door you prefer and why.

Key takeaways¶

• A router is a computer; RouterOS (MikroTik, Latvia, 1996) is its operating system. The CHR is RouterOS in a virtual machine.
• Default configuration: ether1 = WAN (DHCP client, firewall); the other ports = LAN bridge at 192.168.88.1/24 with a DHCP server. Only ether1 goes to the wall.
• Three doors, one configuration: WebFig (browser), WinBox (also by MAC address, with no IP), CLI (SSH).
• CLI: menus with / and .., print, set, add, Tab, F1. /export prints the configuration as commands.
• Users in groups full, write, read; never work as the shared admin.
• Safe Mode (Ctrl+X) undoes changes if you lose the session; reset restores only the configuration.

Quick check¶

Next: the router is ready and reset. Now each group makes and tests the cables of its own LAN, in Cabling a LAN.