Lab 01-02 · Internet access through the class AP¶
MTCNA
Module 1 · Introduction. Official course slides 35–49: Internet access LAB (laptop → router → class AP), private and public address space, masquerade, connectivity check and troubleshooting.
When you get home and your phone joins the WiFi, it just... works. Instagram loads, WhatsApp delivers. Behind that "just works" your home router did three jobs nobody told you about: it asked your Internet provider for an address, it handed one to your phone, and it disguised your phone's traffic as its own.
Today you are the router installer. You get a router whose Internet port is wired wrong, and you will make your laptop reach www.mikrotik.com through it, one job at a time.
What you will learn
- Tell the WAN port from the LAN ports and take a port out of a bridge
- Get the router's Internet address automatically with a DHCP client
- Explain private vs public addresses and why your laptop's address cannot travel on the Internet
- Add a masquerade (source NAT) rule on the right interface
- Check connectivity step by step: router first, laptop second
- Know the backup plan: connecting the router to the class AP by WiFi station mode
The building, the concierge and the street¶
One analogy for this whole lab: an apartment building.
- The LAN (Local Area Network) is the inside of the building. Every flat has a number:
192.168.88.10,192.168.88.11... These are private addresses: flat numbers only mean something inside this building. Thousands of buildings in the world have a "flat 10". - The router is the concierge at the door. It has one foot inside (the LAN address
192.168.88.1) and one foot on the street. - The WAN (Wide Area Network) is the street: the port that leads out, towards the Internet. In the classroom, the street is the class AP, the trainer's router.
Private and public addresses¶
Private address: an IPv4 address reserved for use inside a network. Routers on the Internet refuse to carry packets addressed to it.
The three private ranges (defined in RFC 1918, 1996) are:
| Range | Example |
|---|---|
| 10.0.0.0 – 10.255.255.255 (10.0.0.0/8) | the class network, 10.0.0.0/24 |
| 172.16.0.0 – 172.31.255.255 (172.16.0.0/12) | |
| 192.168.0.0 – 192.168.255.255 (192.168.0.0/16) | your LAN, 192.168.88.0/24 |
Everything else is (roughly) public: unique in the whole world, like a full street address.
Masquerade: the concierge signs the letters¶
Your laptop (192.168.88.254) sends a letter to www.mikrotik.com. If the letter leaves the building with "from: flat 254" on it, the answer can never come back: nobody on the street knows which building's flat 254.
So the concierge does a trick called NAT (Network Address Translation). In its masquerade form: every letter that goes out through the WAN port gets its sender address replaced by the router's own WAN address. The router writes down who sent what, and when the answer arrives it delivers it to the right flat. Your whole house shares one outside address this way.
flowchart LR
PC["<b>Laptop</b><br>from 192.168.88.254"] -- "LAN" --> R["<b>Your router</b><br>(the concierge)<br>masquerade"]
R -- "WAN<br>from 10.0.0.200" --> AP["<b>Class AP</b>"]
AP -- "masquerade again" --> I["<b>Internet</b><br>www.mikrotik.com"]Double NAT
Notice that the class AP masquerades again towards the Internet. Your laptop is behind two concierges. This is very common: your home router does it, and many providers do it once more (CGNAT). It works, but each layer hides you a bit more.
The scenario¶
In the real classroom your hAP plugs its ether1 into the class AP with a LAN cable. In the virtual lab the cable is already plugged in, into ether2.
Port names in the virtual lab
On a real hAP the Internet port is ether1; in the virtual lab ether1 is reserved for the lab itself, so the Internet port is ether2 and the LAN ports start at ether3. Never touch ether1.
flowchart LR
PC1["<b>pc1</b><br>your laptop<br>DHCP: 192.168.88.x"] -- "eth1 — ether3" --- R1
subgraph R1["<b>r1</b> · your router"]
BR["bridge1<br>192.168.88.1/24<br>DHCP server, DNS"]
W["ether2 (WAN)<br>DHCP client → 10.0.0.x"]
end
W -- "ether2 — ether2<br>(the LAN cable)" --- CAP["<b>class-ap</b><br>10.0.0.1<br>DHCP, DNS, NAT"]
CAP -- "ether3 — eth1" --- NET["<b>internet</b><br>198.51.100.10<br>www.mikrotik.com"]| Node | Role | Address |
|---|---|---|
pc1 |
your laptop | gets 192.168.88.x by DHCP from r1 |
r1 |
your router | LAN bridge1 192.168.88.1/24, WAN ether2 (DHCP client) |
class-ap |
the trainer's router, the class gateway | 10.0.0.1/24 (DHCP 10.0.0.100–200, DNS), 198.51.100.1 |
internet |
"the Internet": answers ping, serves a web page | 198.51.100.10 (www.mikrotik.com points here) |
The lab is offline: class-ap has a DNS entry that sends www.mikrotik.com to the internet node, so the course's "ping www.mikrotik.com" works without real Internet.
Start the lab¶
Download the lab files and unzip them: 01-02-internet-access.zip. Open a terminal inside the 01-02-internet-access folder.
Wait about one minute for both routers to boot. Then:
ssh admin@clab-mtcna-01-02-r1 # your router (password: admin)
docker exec -it clab-mtcna-01-02-pc1 bash # your laptop
pc1 starts with no IP address on purpose: you will ask for one at the right moment.
Step 1 · Look at what you have¶
Why: an installer looks before touching. Your router came with a configuration where every port is a LAN port, all inside one bridge.
A bridge is a software switch: all its ports behave as one network, like several doors into the same room.
In WinBox: Bridge → Ports. On r1:
Expected: ether2 and ether3 are both ports of bridge1; the only useful address is 192.168.88.1/24 on bridge1.
A DHCP client on ether1 is already there
/ip dhcp-client print shows client1 on ether1 with status searching.... That belongs to the virtual lab's management port: leave it alone.
Check yourself
If ether2 (the cable to the class AP) is inside the same bridge as your laptop, which "room" is the class network in: inside your building or on the street? Why is that a problem?
Done when: you can say which ports are in bridge1.
Step 2 · Take the WAN port out of the bridge¶
Why: the street door cannot be part of the living room. While ether2 is inside the bridge, your LAN and the class network are one big room: two DHCP servers (yours and the class AP's) answer the same laptops, and the router has no "outside" to translate to. The course PDF does the same with the WiFi interface (slides 40–41).
In WinBox: Bridge → Ports, select ether2, click Remove (−). On r1:
Expected: only ether3 is left in bridge1.
Careful in the real classroom
On a real router, if you are connected to it through the port you remove, you cut your own connection. Use safe mode (Ctrl+X) or WinBox by MAC (lab 01-01).
Check yourself
After this step, how many separate networks (rooms) does your router touch, not counting ether1?
Done when: ether2 is no longer listed in /interface bridge port print.
Step 3 · Ask the class AP for an address (DHCP client)¶
Why: your router needs an address on the street. Instead of typing one, it asks for it.
DHCP (Dynamic Host Configuration Protocol) hands out IP settings automatically. A DHCP server gives them; a DHCP client asks for them. Your phone is a DHCP client every time it joins a WiFi.
In WinBox: IP → DHCP Client, +, Interface ether2, OK. On r1:
Expected after a few seconds:
# NAME INTERFACE USE-PEER-DNS ADD STATUS ADDRESS
0 client1 ether1 yes yes searching...
1 client2 ether2 yes yes bound 10.0.0.200/24
bound means the class AP accepted. The DHCP client also installed a default route (where to send everything that is not local) and the class AP's DNS server:
Look for 0.0.0.0/0 via 10.0.0.1 and dynamic-servers: 10.0.0.1.
Check yourself
Which three things did the router learn from the class AP's DHCP server? Where do you see each one?
Done when: the DHCP client on ether2 says bound with a 10.0.0.x address.
Step 4 · Test from the router first¶
Why: troubleshoot from the inside out. If the router itself cannot reach the Internet, nothing behind it will.
In WinBox: Tools → Ping. On r1:
Expected: received=3 both times. The second one also proves that DNS works: the router turned the name into 198.51.100.10.
Check yourself
If the first ping works but the second says could not resolve dns name, which step's "gift" is missing?
Done when: the router pings www.mikrotik.com.
Step 5 · Connect the laptop and watch it fail¶
Why: you have to see the problem masquerade solves.
On pc1, ask your router for an address:
Expected: bound to 192.168.88.254 (or another 192.168.88.x), and nameserver 192.168.88.1: your router's DHCP server gave the laptop its address and told it to use the router as DNS.
Now:
Expected: the name resolves (PING www.mikrotik.com (198.51.100.10)) but 100% packet loss. The letter leaves with "from: flat 192.168.88.254", and the class AP has no idea where that building is, so the answer never comes back.
Check yourself
The name was resolved, yet the ping failed. Who answered the DNS question, and why could that answer come back when the ping cannot?
Done when: you have seen the ping fail.
Step 6 · Add masquerade on the WAN port¶
Why: this is the concierge signing the letters. The rule says: "every packet that leaves through ether2, give it ether2's address as the sender".
In WinBox: IP → Firewall → NAT, +. Tab General: Chain srcnat, Out. Interface ether2. Tab Action: Action masquerade. OK. On r1:
The classic trap: the wrong interface
out-interface must be the WAN (ether2 here, ether1 on a real hAP, the WiFi interface in the backup plan). Masquerade on bridge1 would rewrite traffic going into your LAN instead, and the Internet would still not work.
Done when: the rule is listed with out-interface=ether2.
Step 7 · Check connectivity from the laptop¶
On pc1:
Expected: 0% packet loss, the page <h1>Welcome to the Internet</h1>, and a traceroute through 192.168.88.1 (your router), then 10.0.0.1 (class AP), then the destination.
If the very first ping still fails, wait a few seconds and try again: the router remembers the "flows" it already saw without NAT (connection tracking) until they time out.
Look at the rule counters on r1:
The PACKETS column grows every time the laptop talks to the Internet: the concierge at work.
Check yourself
In the traceroute, which hop is your router and which is the class AP? Which of those two does the masquerade you just wrote?
Done when: pc1 pings and opens www.mikrotik.com.
Backup: no cable available?
In class the router reaches the class AP by cable. If the classroom LAN is down, the trainer will ask you to connect by WiFi in station mode instead: the router's WiFi interface stops being an access point and becomes a client of the class AP, like your phone. The steps are the same four jobs, on the WiFi interface instead of ether1:
- Remove the WiFi interface from the bridge (Bridge → Ports).
- Set it to mode=station, SSID
ClassAP, with the class passphrase (WiFi → WiFi on the hAP ax², or Wireless → Interfaces + Security Profiles on older models). The Scan tool lists the APs around you. - DHCP client on the WiFi interface.
- Masquerade with out-interface = the WiFi interface.
The ready-made configuration for a real hAP ax² (and the hAP ac² version in comments) is in final/r1-wifi-backup.rsc. It cannot run in the virtual lab: CHR has no radio.
Check your work¶
All lines PASS, last line Lab 01-02 SOLVED.
If something goes wrong¶
These are the five problems on the course's troubleshooting slide (slide 49), plus the classic traps.
| Symptom | Likely cause | Fix |
|---|---|---|
DHCP client stays searching... |
DHCP client added to the wrong interface, or ether2 still inside the bridge | /ip dhcp-client print: interface must be ether2; remove ether2 from the bridge |
| Router cannot ping beyond the AP | no default route | check /ip route print shows 0.0.0.0/0 via 10.0.0.1 (add-default-route=yes) |
| Router cannot resolve names | no DNS server | /ip dns print must show dynamic-servers: 10.0.0.1 (use-peer-dns=yes) |
| Laptop cannot ping beyond the router | no masquerade, or masquerade on the wrong interface | /ip firewall nat print: out-interface=ether2 |
| Laptop cannot resolve names | router does not accept DNS questions from the LAN | /ip dns set allow-remote-requests=yes; laptop's /etc/resolv.conf must say 192.168.88.1 |
| Masquerade rule does not work | the rule is disabled or below another rule, or old flows | /ip firewall nat print stats: is the counter growing? wait and retry |
Laptop got a 10.0.0.x address |
you ran dhclient while ether2 was still in the bridge: the class AP answered |
do step 2, then dhclient -r eth1; dhclient -v eth1 |
Clean up¶
Key takeaways¶
- The WAN port faces the street (the class AP / the Internet); the LAN ports form a bridge. A WAN port must never be inside the LAN bridge.
- A DHCP client on the WAN gets three gifts: an address, a default route and a DNS server.
- Private addresses (10/8, 172.16/12, 192.168/16) only work inside a network; packets from them cannot come back from the Internet without help.
- Masquerade (source NAT) replaces the sender address with the router's WAN address; it goes on the out-interface = WAN.
- Troubleshoot inside out: router pings an IP, router resolves a name, laptop gets an address, laptop pings, laptop resolves.
- In class the router connects to the class AP by cable; WiFi station mode is only the backup plan.
Quick check¶
1. Why must the WAN port be taken out of the LAN bridge?
- Inside the bridge it joins the LAN, so the router has no separate outside network
- Bridge ports are not allowed to have a DHCP client added on them
- A bridge port runs slower than a stand-alone ethernet port
- The bridge would block every packet addressed to the class AP
A bridge joins its ports into one network. With the WAN port inside, your LAN and the class network become one room: two DHCP servers answer, and there is no "outside" interface to route and masquerade through.
2. Which three settings does the router get from a DHCP client on the WAN?
- An IP address, a default route and a DNS server
- A MAC address, a password and a firewall rule
- A bridge, a DHCP server and a NAT rule
- A username, an identity and a routing table
The DHCP client asks the class AP and installs an IP address (10.0.0.x), a default route via 10.0.0.1 and the DNS server 10.0.0.1.
3. Which of these addresses is private?
- 172.20.5.9
- 172.32.5.9
- 192.169.1.1
- 11.0.0.1
The private ranges are 10.0.0.0/8, 172.16.0.0–172.31.255.255 and 192.168.0.0/16. 172.20.5.9 is inside 172.16–172.31; 172.32 and 192.169 are just outside.
4. Your laptop resolves www.mikrotik.com but cannot ping it. The router pings it fine. What is most likely missing?
- The masquerade rule on the WAN interface
- The DHCP client on the WAN interface
- The DNS server on the router
- The default route on the router
The router itself has address, route and DNS (it pings fine), and the laptop resolves names. What fails is the return trip of packets from a private address: that is the job of masquerade (src-nat) on the WAN.
5. On which interface do you put the masquerade rule?
- The out-interface towards the Internet (the WAN)
- The LAN bridge where the laptops are
- Every interface of the router, to be safe
- The management port ether1
Masquerade rewrites the sender of packets that leave through the chosen out-interface. It must be the WAN (ether2 in the lab, ether1 on a real hAP, the WiFi interface in the backup plan).
6. In the real classroom, how does your hAP normally reach the class AP?
- By an Ethernet cable plugged into ether1
- By WiFi in station mode on the 2.4 GHz radio
- By a serial console cable to the trainer's PC
- By MAC WinBox from the trainer's laptop
The normal path is a LAN cable into the hAP's ether1 (ether2 in the virtual lab). WiFi station mode is only the backup when the cabled LAN is not available.
7. A classmate's laptop got the address 10.0.0.150 instead of 192.168.88.x. Which two statements explain it?
- Their WAN port was still inside the LAN bridge
- The class AP's DHCP server answered the laptop instead of their router
- Their router's DHCP server hands out 10.0.0.x addresses
- Masquerade changed the laptop's own address to 10.0.0.150
With the WAN port still in the bridge, the laptop is in the same "room" as the class AP, and the class AP's DHCP server (10.0.0.100–200) answered first. Masquerade never changes a computer's own address: it only rewrites packets on their way out.
Your router now has Internet. Next lab: what RouterOS is made of (packages), how to update it, and how to choose a release channel.