Lab 02-01 · DHCP server: the router's reception desk¶

This morning you walked into school, opened your laptop or phone, and the Wi-Fi just worked. You did not type an address, a mask or a gateway. Nobody from IT came to configure you. Somebody handed your device everything it needed in less than a second. Who?

That somebody is a DHCP server, and on a small network it usually lives inside the router. Every MikroTik home router ships with one already running. In this lab you will delete it on purpose, move your network to a new address range, and rebuild the server from scratch with RouterOS's DHCP Setup wizard. Then your laptop asks again, and the router answers with the new settings.

The analogy: a hotel reception desk¶

Keep this picture in mind for the whole lab. Your LAN is a hotel, and the DHCP server is the reception desk.

What is DHCP?¶

DHCP (Dynamic Host Configuration Protocol) is the protocol a device uses to ask the network for its IP settings automatically: address, subnet mask, default gateway and DNS server.

It is defined in RFC 2131 (1997). Before DHCP, somebody had to type those four values by hand on every single computer, and two people choosing the same address broke both of them.

Three facts from the course slides that matter in this lab:

• It only works inside one broadcast domain. A brand-new device has no address, so it cannot send a normal "letter" to the server. It shouts to everybody on its segment instead (a broadcast). Routers do not forward broadcasts, so the server must be on the same LAN (or a relay must pass the message on).
• Use DHCP only on networks you trust. Any device can pretend to be a DHCP server. A fake one could hand out a fake gateway and see all your traffic.
• RouterOS is both. It can be a DHCP client (asking for an address, like on its Internet port) and a DHCP server (giving addresses out, like on its LAN).

DORA: four messages, one address¶

sequenceDiagram
    participant PC as pc1 (no address yet)
    participant R as r1 (DHCP server)
    PC->>R: DISCOVER (broadcast) "Is there a DHCP server here?"
    R->>PC: OFFER "You can have 192.168.199.254"
    PC->>R: REQUEST "Yes please, I take 192.168.199.254"
    R->>PC: ACK "It is yours for 30 minutes"

Discover, Offer, Request, Ack: the guest asks, reception offers a room, the guest accepts, reception hands over the key. You will see these four words printed by the PC in Step 6.

The router is also a DHCP client and a DNS server¶

The course reminds you of two things your router already does on its WAN (Internet) side:

• A DHCP client on the Internet port (IP → DHCP Client) asks the provider for an address. Here the "provider" is the classroom router class-ap, which gives r1 an address in 10.0.0.0/24.
• The router keeps a list of DNS servers (IP → DNS), learned from that DHCP client, and with Allow Remote Requests it answers DNS questions from the LAN too. It also has static DNS entries: the factory one called router.lan points at the router itself, so you can type http://router.lan instead of an IP.

The four pieces of a RouterOS DHCP server¶

Also needed, but not part of the server: the router's own IP address on that interface. The server only serves a network the router itself belongs to.

The scenario¶

flowchart LR
    INET["<b>internet</b><br>198.51.100.10<br>web server"]
    CAP["<b>class-ap</b><br>class gateway<br>10.0.0.1 · 198.51.100.1"]
    subgraph R1["r1 · your router"]
        WAN["ether2 (WAN)<br>DHCP client: 10.0.0.x"]
        BR["<b>bridge1</b> (LAN)<br>before: 192.168.88.1/24<br>after: 192.168.199.1/24"]
        E3["ether3<br>bridge port"]
    end
    PC1["<b>pc1</b><br>your laptop<br>dhclient eth1"]
    INET ---|"198.51.100.0/24"| CAP
    CAP ---|"10.0.0.0/24"| WAN
    E3 --- BR
    E3 ---|"eth1"| PC1

The course asks you to use your student number XY for the new subnet, 192.168.XY.0/24. This guide uses the course's own example, XY = 199, so the new LAN is 192.168.199.0/24 and the router is 192.168.199.1. The automatic check expects 199.

Start the lab¶

Download the lab files and unzip them: 02-01-dhcp-server.zip. Open a terminal inside the 02-01-dhcp-server folder.

sudo containerlab deploy -t topology.clab.yml

Give RouterOS about two minutes to boot. Then open the router and the PC in two terminals:

ssh admin@clab-mtcna-02-01-r1            # password: admin
docker exec -it clab-mtcna-02-01-pc1 bash

At any moment you can run ./check.sh (with CLAB_EXEC="docker exec" on your PC) to see which parts are already solved.

Step 1 · Meet the factory DHCP server¶

Before you destroy something, look at it. First let the laptop ask for an address the normal way.

On pc1:

dhclient -v eth1
ip -br address show eth1

You should see the DORA words and an address like 192.168.88.254/24. RouterOS hands out addresses from the top of the pool down, so the first guest gets .254.

On r1 (WinBox: IP → DHCP Server, tabs DHCP, Networks, Leases; and IP → Pool):

/ip dhcp-server print
/ip dhcp-server network print
/ip pool print
/ip dhcp-server lease print

Expected: a server called defconf on bridge1 using pool default-dhcp (192.168.88.10-192.168.88.254), a network 192.168.88.0/24 with gateway and DNS 192.168.88.1, and a lease for 02:00:00:00:01:01 (pc1) with a D flag (dynamic: created on the fly).

Done when you can point at the server, the pool, the network and pc1's lease.

Step 2 · Remove the old server, network, pool and address¶

The course does it in this order: server → network → pool → address. Removing the "users" first and the things they depend on last avoids leaving a server pointing at a pool that no longer exists.

WinBox: IP → DHCP Server → DHCP (select defconf, −), then the Networks tab (select 192.168.88.0/24, −), then IP → Pool (default-dhcp, −), then IP → Addresses (192.168.88.1/24, −).

/ip dhcp-server remove [find name=defconf]
/ip dhcp-server network remove [find address="192.168.88.0/24"]
/ip pool remove [find name=default-dhcp]
/ip address remove [find address="192.168.88.1/24"]

Check with /ip address print and /ip dhcp-server print: no 192.168.88.1, no server.

Done when the router has no LAN address and no DHCP server.

Step 3 · Give the bridge its new address¶

The DHCP server can only serve a network the router belongs to, so first the router needs an address in 192.168.199.0/24. It goes on bridge1, the virtual switch that joins the LAN ports.

WinBox: IP → Addresses → +, Address 192.168.199.1/24, Interface bridge1.

/ip address add address=192.168.199.1/24 interface=bridge1
/ip address print

Done when /ip address print shows 192.168.199.1/24 on bridge1.

Step 4 · Rebuild the server with the DHCP Setup wizard¶

Instead of creating the server, the pool and the network one by one, RouterOS has a wizard that asks you six questions and creates all three for you.

WinBox: IP → DHCP Server → DHCP Setup. In the terminal the same wizard is:

/ip dhcp-server setup

Answer the questions like this (press Enter to accept a proposed value):

The wizard proposes good values because it reads them from the address you put on bridge1 in Step 3. That is why the course says the address must exist before you run it.

Now look at what it built:

/ip dhcp-server print
/ip dhcp-server network print
/ip pool print

Expected: a server dhcp1 on bridge1 with pool dhcp_pool1 (192.168.199.2-192.168.199.254), and a network 192.168.199.0/24 with gateway 192.168.199.1. Compare with slide p120: the wizard created a new pool and a new server.

Done when dhcp1 exists on bridge1 and is not disabled.

Step 5 · Fix the router's own name¶

The factory static DNS entry router.lan still points at the old address 192.168.88.1. Nobody will ever answer there. Point it at the new one.

WinBox: IP → DNS → Static, double-click router.lan, Address 192.168.199.1.

/ip dns static set [find name=router.lan] address=192.168.199.1
/ip dns static print

Done when router.lan points at 192.168.199.1.

Step 6 · Renew the laptop and test the Internet¶

pc1 still believes it lives at 192.168.88.254: it has a lease and nobody told it things changed. The course says: renew the IP address of your laptop. Release the old lease, then ask again.

On pc1:

dhclient -r eth1          # release: give the old key back
dhclient -v eth1          # ask again: watch DISCOVER, OFFER, REQUEST, ACK
ip -br address show eth1
ip route
cat /etc/resolv.conf

Expected: an address in 192.168.199.0/24 (probably .254), default via 192.168.199.1, and name servers 192.168.199.1 and 10.0.0.1. Now test the Internet, first by number and then by name:

ping -c 3 198.51.100.10
curl http://www.mikrotik.com/
dig +short router.lan

curl should print Welcome to the Internet, and router.lan should resolve to 192.168.199.1.

On r1, open the guest book (WinBox IP → DHCP Server → Leases):

/ip dhcp-server lease print

Done when pc1 has a 192.168.199.x address and curl shows the welcome page. Run ./check.sh: it must say Lab 02-01 solved.

If something goes wrong¶

Clean up¶

sudo containerlab destroy -t topology.clab.yml --cleanup

Key takeaways¶

• DHCP hands out address, mask, gateway and DNS automatically, through four messages: DORA.
• A RouterOS DHCP server is made of a server, an address pool, a DHCP network and the leases it creates.
• Addresses and DHCP servers go on the bridge, never on a bridge port.
• The DHCP Setup wizard builds the pool, the server and the network from the address already on the interface.
• After the server changes, clients keep their old lease until they renew it.
• On real hardware, removing the address you are connected through disconnects you: MAC-WinBox gets you back in.

Quick check¶

Next, in Lab 02-02, you will stop treating every guest the same: your laptop gets a reserved room that never changes, and strangers get no room at all.