Lab 01-01 · Getting in: MAC WinBox, WebFig and skins¶

Imagine you change the router's IP address by mistake and press Enter. The web page freezes. Your SSH window freezes. The router is still on, its lights are still blinking... but you have locked yourself out. Do you have to reset it and lose everything?

No. MikroTik routers have a back door for exactly this moment: you can talk to them using only their MAC address, with no IP at all. Network technicians use it every week. Today you will lock yourself out on purpose and get back in through that back door.

The pieces: RouterOS and its management tools¶

RouterOS is the operating system of every MikroTik router. It is based on the Linux kernel. The same system runs on MikroTik hardware (RouterBOARD) and as a virtual machine called CHR (Cloud Hosted Router).

In this lab every router is a CHR running RouterOS 7.23.8 (a long-term version). It behaves exactly like the hAP router you have on your desk in class, minus the WiFi and the blinking lights.

To configure a router you need a way "in". RouterOS gives you several management tools:

On a brand-new MikroTik home router the LAN address is 192.168.88.1 and the user is admin. Older models had an empty password; many recent models ship with a unique password printed on the sticker instead.

IP address vs MAC address¶

Here is the analogy we will use for the whole lab: your class.

• An IP address is like your postal address. A letter can reach you from anywhere in the world, as long as the address is right. Change it, and letters sent to the old one never arrive.
• A MAC address is like the name tag on your jacket. It is printed on the network card at the factory (6 bytes, written like AA:C1:AB:D5:F1:16). It only works inside the same room: someone standing next to you can read it and call you, but nobody in another city can.

So: a router with a broken IP can still be called by name tag, as long as you are in the same room (the same cable, switch or WiFi, called the same layer 2 network). That is what MAC WinBox and MAC-Telnet do.

flowchart LR
    A["<b>Your laptop</b><br>WinBox"] -- "by IP: 192.168.88.1<br>(postal address)" --> R["<b>Router</b>"]
    A -- "by MAC: AA:C1:AB:...<br>(name tag, same room only)" --> R

The scenario¶

In the classroom you would use WinBox on your laptop. In this virtual lab we have no graphical WinBox, so a second MikroTik, r2, plays the part of "WinBox on your laptop": it sits on the same cable as your router and has no IP address at all. Anything r2 does to r1, it does by MAC address only.

flowchart LR
    PC1["<b>pc1</b><br>your laptop (browser)<br>192.168.88.10"] -- "eth1 — ether3" --- R1
    subgraph R1["<b>r1</b> · your router"]
        BR["bridge1<br>192.168.88.1/24"]
    end
    R1 -- "ether4 — ether3" --- R2["<b>r2</b><br>'WinBox by MAC'<br>no IP address"]

Start the lab¶

Download the lab files and unzip them: 01-01-mac-winbox-and-skins.zip. Open a terminal inside the 01-01-mac-winbox-and-skins folder.

sudo containerlab deploy -t topology.clab.yml

Wait about one minute: each router has to boot. Then open three terminals:

ssh admin@clab-mtcna-01-01-r1          # your router   (password: admin)
ssh admin@clab-mtcna-01-01-r2          # the "MAC WinBox" router (password: admin)
docker exec -it clab-mtcna-01-01-pc1 bash   # your laptop

Three CLI tricks before you start¶

The CLI is hierarchical, like folders: /ip address print means "go into the ip folder, then address, then run print". WinBox menus have the same tree: IP → Addresses is /ip address.

Step 1 · Open WebFig from the laptop¶

Why: before breaking anything, prove that the normal path (by IP) works.

In a browser this is just http://192.168.88.1. On pc1 we have no screen, so we ask for the page with curl:

curl -s http://192.168.88.1/ | grep -i title

Expected output: <title>RouterOS</title>. That HTML page is WebFig.

ping -c 3 192.168.88.1

Expected: 3 received, 0% packet loss.

Done when: pc1 gets the WebFig page and pings 192.168.88.1.

Step 2 · Find your router by neighbour discovery¶

Why: before you can call a router by its name tag, you need to read the name tag. WinBox does this in its Neighbors tab; on RouterOS it is IP → Neighbors.

On r2:

/ip neighbor print

Expected output (your MAC address will be different):

Columns: INTERFACE, ADDRESS, MAC-ADDRESS, IDENTITY
#  INTERFACE  ADDRESS       MAC-ADDRESS        IDENTITY
0  ether3     192.168.88.1  AA:C1:AB:D5:F1:16  r1

r2 has no IP address, yet it knows r1's name (identity), its IP and its MAC. Write down the MAC: you need it in the next steps.

Done when: you have r1's MAC address written down.

Step 3 · Log in by MAC address (MAC-Telnet)¶

Why: this is the back door. MAC-Telnet is a terminal session that travels in plain Ethernet frames addressed to a MAC, with no IP inside. MAC WinBox is the same trick with the graphical app.

In WinBox you would click the MAC Address in the Neighbors tab instead of the IP and press Connect. Look at the WinBox title bar: it shows admin@AA:C1:AB:... (r1) instead of admin@192.168.88.1 (r1). On r2, type (use your MAC):

/tool mac-telnet AA:C1:AB:D5:F1:16

Log in as admin / admin. The prompt changes from [admin@r2] > to [admin@r1] >: you are now inside r1. The prompt plays the role of WinBox's title bar: it always tells you which router you are talking to. Run:

/system identity print

Expected: name: r1. Leave this session open.

You can also "ping by name tag". In a new r2 window:

/ping AA:C1:AB:D5:F1:16 interface=ether3 count=3

Expected: sent=3 received=3 packet-loss=0%. This is a MAC ping: RouterOS answers it through its MAC server (Tools → MAC Server in WinBox, /tool mac-server), the same service that accepts MAC-Telnet and MAC WinBox.

Done when: your r2 window shows the [admin@r1] > prompt.

Step 4 · Lock yourself out (on purpose, with safe mode)¶

Why: now we cut the IP path and prove the MAC path survives. This is the optional part of the official LAB (slides 23–24).

First, meet safe mode. Press Ctrl+X in the r1 SSH window: the prompt gets a <SAFE> mark. While safe mode is on, if your session dies (for example because you just cut yourself off), RouterOS automatically undoes every change you made since you pressed Ctrl+X. Press Ctrl+X again to keep the changes. Use it whenever you touch addresses, the firewall or bridges on a remote router.

In WinBox: IP → Addresses, select 192.168.88.1/24, click the Disable (red cross) button. In the r1 SSH window:

/ip address disable [find address="192.168.88.1/24"]
/ip address print

Expected: the LAN line now has an X flag (disabled).

Now try the IP path from pc1:

curl -m 4 http://192.168.88.1/
ping -c 2 192.168.88.1

Expected: curl: (28) Connection timed out and 100% packet loss. WebFig is gone, and WinBox by IP would fail too.

And the MAC path from r2:

/ping AA:C1:AB:D5:F1:16 interface=ether3 count=3

Expected: still received=3. The name tag still works because it never needed the postal address.

Done when: pc1 cannot reach 192.168.88.1 but r2 still MAC-pings r1.

Step 5 · Get back in through the back door¶

Why: this is the rescue. Imagine the SSH window to r1 does not exist: the only way in is by MAC.

In the r2 window that is still logged into r1 by MAC-Telnet (prompt [admin@r1] >). If it timed out, open it again with /tool mac-telnet <MAC>:

/ip address enable [find address="192.168.88.1/24"]
/ip address print

In WinBox (connected by MAC): IP → Addresses, select the line, Enable (blue tick). The X disappears. Type /quit to leave the MAC-Telnet session.

Back on pc1:

curl -s http://192.168.88.1/ | grep -i title

Expected: <title>RouterOS</title> again.

Done when: WebFig answers again on pc1.

Step 6 · Give a group a simpler interface: skins¶

Why: a router has hundreds of menus. A skin is a "simplified view" of WebFig and WinBox: it can hide menus, rename fields or make them read-only, so that, for example, the shop owner only sees the WiFi password field. Skins are not a security tool (a user can still type commands in a terminal); permissions are what really protect the router. You will meet users and permissions properly in lab 01-05.

A skin is a small JSON text file stored in the router's skins folder. It is normally drawn with the Design Skin button in WebFig (only users with the policy and sensitive permissions see that button). A skin applies to a user group: every user of the group gets it when they log in to WebFig or WinBox.

In class, in WebFig: Design Skin → hide some menus → Save as students. Then System → Users → Groups, add group students.

In the virtual lab, create an empty skin file (an empty skin hides nothing, but it shows the whole mechanism) and the group on r1:

/file add name=skins/students.json contents="{}"

Wait two seconds (RouterOS needs a moment to notice the new skin), then:

/user group add name=students policy=read,winbox,web skin=students
/user group print where name=students

Expected: a group with policy=read,winbox,web,!local,!telnet,... and skin=students. This is the command from the course slide: /user group set <group> skin=<skin>, done at creation time.

Done when: /user group print shows the group students with skin=students.

Check your work¶

From the lab folder on your PC:

CLAB_EXEC="docker exec" ./check.sh

Every line must say PASS and the last line Lab 01-01 SOLVED.

If something goes wrong¶

Clean up¶

sudo containerlab destroy -t topology.clab.yml --cleanup

Key takeaways¶

• RouterOS can be managed with WinBox, WebFig, SSH, Telnet and a serial console; WinBox is the only GUI that also works by MAC.
• An IP address works across networks (postal address); a MAC address only works inside the same layer 2 network (name tag in the same room).
• Neighbour discovery (MNDP, LLDP, CDP) lets you see nearby MikroTik devices, their identity, IP and MAC, even without an IP of your own.
• MAC WinBox and MAC-Telnet rescue a router whose IP configuration is broken, as long as you are on the same cable or switch.
• Safe mode (Ctrl+X) undoes your changes automatically if you lose the connection.
• A skin simplifies WebFig/WinBox for a user group; it is about comfort, not security.

Quick check¶

You can now always get into a router, even a broken one. Next lab: connect that router to the Internet through the class AP.