Lab 02-02 · Static DHCP leases: a reserved table¶
MTCNA
Module 2 · DHCP of the MikroTik MTCNA course, official slides p121–125 (static DHCP leases, DHCP options, DHCP scripting and the LAB "Concesiones estáticas de DHCP" on p125).
Think of your favourite restaurant on a Saturday night. Walk-in customers get whatever table is free. But if you booked, the waiter checks your name and takes you to your table, the one by the window, every single time. Some restaurants go further: on busy nights they put a sign on the door saying "Reservations only". No booking, no table.
Your DHCP server can do exactly both. Right now it treats every device as a walk-in and gives it whatever
address is free. In this lab you book a table for your laptop (it will always get 192.168.199.123),
and then you hang the "reservations only" sign: a neighbour who plugs into your router gets nothing.
What you will learn
- Explain the difference between a dynamic lease and a static lease.
- Turn a dynamic lease into a static one (Make Static) and change the address it gives.
- Understand why a client keeps its old address until it renews the lease.
- Set the server's address pool to static-only so that only known devices get an address.
- Prove it with a second PC, "the stranger", that asks and gets no answer.
- Know what DHCP options and lease scripts are for (captive portals, controllers, automation).
The analogy: a restaurant with bookings¶
| Restaurant | DHCP | On RouterOS |
|---|---|---|
| A walk-in customer | A device the server has never seen | Gets a dynamic lease (flag D) |
| A table free at the moment | An address from the pool | dhcp_pool1 = 192.168.199.2-254 |
| A booking under your name | A static lease: this MAC always gets this address | A lease without the D flag |
| Your name on the booking | The device's MAC address | 02:00:00:00:01:01 for pc1 |
| The "Reservations only" sign | Pool static-only | address-pool=static-only |
Static leases¶
A static lease is a permanent entry in the DHCP server that says: the device with this MAC address always gets this IP address.
A MAC address is the 48-bit hardware address of a network card, written as six pairs of hexadecimal
digits (02:00:00:00:01:01). The DHCP server identifies who is asking by that MAC, so it can recognise
your laptop every time.
Why would you want a fixed address handed out by DHCP instead of typing it into the device?
- Printers, cameras, servers: other devices must find them at a known address.
- Port forwarding and firewall rules (Module 6) point at one address. If it changes, the rule breaks.
- One place to manage it all: the device still uses DHCP, but the router decides. You never touch the device's settings.
The course also mentions the extreme case: a DHCP server without any dynamic pool, which only answers devices with a static lease. That is the "reservations only" sign, and it is the last part of this lab.
A static lease is not security
"Reservations only" stops strangers from getting an address automatically. Nothing stops a stranger from typing a free address by hand. Closing that gap is the job of the next lab, Static ARP.
Two more things a DHCP server can do¶
| Feature | What it does | Example from the course |
|---|---|---|
| DHCP options | Extra information sent with the lease, each identified by a number (the IANA keeps the list) | Option 43: where a Wi-Fi access point finds its controller. Option 160 in the slides (RFC 7710, 2015) tells a phone about a captive portal, the hotel or airport login page; RFC 8910 (2020) moved it to option 114 |
| Lease scripts | A small RouterOS script that runs when a lease is granted, renewed or released | Log or send a message when a new device joins |
You will not configure these today; just know they live in IP → DHCP Server → Options and in the server's Lease Script box.
The scenario¶
flowchart LR
INET["<b>internet</b><br>198.51.100.10"]
CAP["<b>class-ap</b><br>10.0.0.1"]
subgraph R1["r1 · your router"]
WAN["ether2 (WAN)<br>10.0.0.x by DHCP"]
BR["<b>bridge1</b><br>192.168.199.1/24<br>DHCP server dhcp1"]
end
PC1["<b>pc1</b> (you)<br>MAC 02:00:00:00:01:01<br>goal: always .123"]
PC2["<b>pc2</b> (the neighbour)<br>MAC 02:00:00:00:02:02<br>goal: no address"]
INET --- CAP
CAP ---|"10.0.0.0/24"| WAN
BR ---|"ether3"| PC1
BR ---|"ether4"| PC2| Node | Role | Address |
|---|---|---|
internet |
"The Internet" (ping and a web page) | 198.51.100.10/24 |
class-ap |
Classroom gateway, DNS, NAT | 10.0.0.1/24 |
r1 |
Your router, as Lab 02-01 left it. ether2 = WAN, ether3 + ether4 = LAN ports in bridge1 |
LAN 192.168.199.1/24, server dhcp1, pool dhcp_pool1 |
pc1 |
Your laptop, MAC 02:00:00:00:01:01 |
By DHCP, finally 192.168.199.123 |
pc2 |
The neighbour's laptop ("the stranger"), MAC 02:00:00:00:02:02 |
By DHCP, finally none |
Why ether2 and not ether1?
On a real hAP the Internet port is ether1. In the virtual lab ether1 is reserved for the lab itself, so the Internet port is ether2 and the LAN ports start at ether3.
In the classroom, "the stranger" is your neighbour plugging their laptop into your router. Here it is pc2.
Start the lab¶
Download the lab files and unzip them: 02-02-static-dhcp-leases.zip. Open a terminal inside the 02-02-static-dhcp-leases folder.
Wait about two minutes for RouterOS, then open three terminals:
ssh admin@clab-mtcna-02-02-r1 # password: admin
docker exec -it clab-mtcna-02-02-pc1 bash
docker exec -it clab-mtcna-02-02-pc2 bash
Step 1 · Everybody is a walk-in¶
First see the problem: the server gives an address to anyone who asks.
On pc1 and then on pc2:
On r1 (WinBox: IP → DHCP Server → Leases):
Expected: two leases, 192.168.199.254 for pc1 and 192.168.199.253 for pc2, both with the flag D
(dynamic). Now send the neighbour home for a moment. On pc2:
Check yourself
- Which column tells the server who each lease belongs to?
- If pc1 disappeared for two hours and came back, would it surely get
.254again? Why not?
Done when pc1 has a dynamic lease and pc2 has released its one.
Step 2 · Hang the "reservations only" sign¶
The course starts here: set the server's pool to static-only. From now on the server only answers devices that have a static lease.
WinBox: IP → DHCP Server → DHCP, double-click dhcp1, Address Pool: static-only.
/ip dhcp-server set dhcp1 address-pool=static-only
/ip dhcp-server print
/ip dhcp-server lease print
Expected: dhcp1 shows static-only in the ADDRESS-POOL column. pc1's dynamic lease is still there:
the sign only affects new customers. The pool dhcp_pool1 still exists in IP → Pool, but no new
lease will come out of it.
Customers already seated keep their table
Tested on RouterOS 7.23.8: a device that already holds a dynamic lease keeps renewing it after you switch to static-only. That is why pc2 released its lease in Step 1. On a real network, to send an existing dynamic client away you also remove its lease (Leases, select, −) and it must ask again.
Check yourself
- pc2 had kept its dynamic lease instead of releasing it. Would static-only have stopped it at its next renewal?
Done when dhcp1 uses static-only.
Step 3 · Book the table: make pc1's lease static¶
You could type a new static lease from zero, but the easiest way is to take the dynamic lease the server already created (it contains pc1's MAC) and freeze it.
WinBox: IP → DHCP Server → Leases, select pc1's lease, click Make Static.
Expected: the D flag disappears from pc1's lease. It is now a static lease.
No lease to make static?
If you released pc1 in Step 2, its dynamic lease was deleted and there is nothing to freeze. Create the booking by hand instead (WinBox Leases → +):
Done when pc1's lease has no D flag.
Step 4 · Choose the table: change the address to .123¶
A booking can be for any table you like. The course asks for 192.168.XY.123, here 192.168.199.123.
WinBox: double-click pc1's lease, Address: 192.168.199.123, and add a Comment such as
pc1 (student laptop) so you remember who it is.
/ip dhcp-server lease set [find mac-address=02:00:00:00:01:01] address=192.168.199.123 comment="pc1 (student laptop)"
/ip dhcp-server lease print
Now look at pc1 without touching it:
It still says 192.168.199.254. The router changed the booking, but nobody told the customer.
Check yourself
- Why does pc1 still use
.254although the lease now says.123? - Why is a comment on a static lease worth the five seconds it takes?
Done when the static lease says 192.168.199.123.
Step 5 · Renew the laptop¶
The course: renew the IP address of your laptop. On pc1:
Expected: DHCPOFFER of 192.168.199.123 and DHCPACK of 192.168.199.123, the address 192.168.199.123/24,
and the Internet answers. On r1, Log (/log print where topics~"dhcp") shows lines like
dhcp1 assigned 192.168.199.123 for 02:00:00:00:01:01 pc1.
Done when pc1 is 192.168.199.123 and pings 198.51.100.10.
Step 6 · The stranger tries again¶
Now the neighbour plugs in. On pc2:
-1 means "try once", and timeout 20 stops it after 20 seconds (otherwise dhclient keeps trying for a
minute). Expected: several DHCPDISCOVER lines and no DHCPOFFER. pc2 has no IPv4 address. Its
shouting gets no answer, because it has no booking.
Check yourself
- pc2's DISCOVER messages did reach the router. Why did the router stay silent?
- Your neighbour now types
192.168.199.50/24by hand on pc2. Will static-only stop them? (You will test this in Lab 02-03.)
Done when pc2 gets no address. Run ./check.sh: it must say Lab 02-02 solved.
If something goes wrong¶
| Symptom | Likely cause | Fix |
|---|---|---|
make-static finds nothing |
pc1's dynamic lease was released or expired | Create the lease by hand with lease add (Step 3 box) |
pc1 still shows .254 |
It has not renewed | dhclient -r eth1 then dhclient -v eth1 |
| pc1 gets nothing after a release | Its lease was dynamic: releasing deleted it, and static-only gives no new ones | Create the static lease (lease add, Step 3 box) and renew |
| pc2 still gets an address | The server still uses dhcp_pool1, or pc2 kept its old dynamic lease (existing leases keep renewing) |
/ip dhcp-server print; remove pc2's lease on r1 and run dhclient -r eth1 on pc2 |
| The static lease has the wrong MAC | Typo, or copied pc2's MAC | Compare with ip link show eth1 on pc1 |
Clean up¶
Key takeaways¶
- A dynamic lease (flag
D) is created on the fly from the pool; a static lease ties one MAC address to one IP address for good. - Make Static freezes an existing dynamic lease; you can then change its address and add a comment.
- A client only learns about a changed lease when it renews it.
- With the pool set to static-only, the server gives new leases only to devices that have a static lease (existing dynamic leases keep renewing until removed).
- Static-only stops strangers from getting an address automatically, not from typing one by hand.
- DHCP options (such as 43, or 114/160 for captive portals) and lease scripts extend what the server sends and does.
Quick check¶
1. What identifies a device to the DHCP server when it looks for a static lease?
- The device's MAC address
- The device's IP address
- The device's DNS server
- The router port it is plugged into
The server recognises a client by its MAC address, the hardware address of its network card. A new client has no IP address yet, so the IP cannot be what identifies it.
2. In the lease list, what does the flag D in front of a lease mean?
- It is a dynamic lease created automatically from the pool
- It is disabled and will not be handed out
- It belongs to a device that is down
- It was given to a DNS server
D means dynamic: the server created it on the fly from the pool. Making it static removes the flag.
3. You changed pc1's static lease from .254 to .123, but pc1 still shows .254. Why?
- pc1 keeps its current lease until it renews it
- Static leases only work after the router reboots
- The address .123 is outside the pool, so it is ignored
- pc1 must be given the new address by hand
The client holds its lease until it renews. After dhclient -r and dhclient, it receives the new
address. A static lease's address does not have to be inside the dynamic pool.
4. What does setting a DHCP server's address pool to static-only do?
- Only devices with a static lease receive an address
- Every device receives the same fixed address
- Devices must type their address by hand to join
- The server stops giving out DNS and gateway values
static-only means there is no dynamic pool: a DISCOVER from an unknown MAC gets no OFFER. Devices with a static lease still get everything as usual.
5. A neighbour plugs into your static-only router and types 192.168.199.50/24 with gateway 192.168.199.1 by hand. What does static-only do about it?
- Nothing, because DHCP is not involved when an address is typed by hand
- It removes the typed address from the neighbour's laptop
- It changes the neighbour's address to one from the pool
- It blocks the neighbour's MAC address on every port
Static-only only decides who gets an address by DHCP. A hand-typed address never asks the server. Stopping that needs another tool, such as reply-only ARP (next lab) or the firewall.
6. Which is a good reason to give a network printer a static DHCP lease?
- Other devices and rules can find it at the same address every day
- It makes the printer print faster
- It stops the printer from needing a MAC address
- It hides the printer from the rest of the network
A static lease keeps the printer at a known address while it still uses DHCP, so computers, port forwards and firewall rules that point at it keep working.
7. What is DHCP option 43 used for in the course example?
- Telling a device where its controller is
- Setting the lease time
- Choosing the client's MAC address
- Encrypting the lease
DHCP options carry extra information in the lease. The course's examples: option 43 to point a device at its controller, and option 160 (114 in today's RFC 8910) for a captive portal.
Next, in Lab 02-03, you close the hand-typed-address gap: the router will only talk to devices it has written down in its ARP table.