Lab 02-03 · Static ARP: only residents get their mail¶

MTCNA

Module 2 · DHCP of the MikroTik MTCNA course, official slides p126–134 (ARP, the ARP table, static ARP, DHCP and ARP together, and the LAB "ARP estático" on p133–134).

At the end of Lab 02-02 your neighbour found the loophole: the DHCP server refused to give them an address, so they simply typed one by hand, 192.168.199.50, and went on browsing with your Internet. A "reservations only" sign does nothing against someone who brings their own chair.

In this lab you close that gap with a much older tool than DHCP: ARP, the way devices on a LAN find each other's hardware address. You will tell the router to deal only with devices it has written down, watch the intruder get locked out, and then let the DHCP server do the writing for you, so your own laptop keeps working without any manual list.

What you will learn

Explain what ARP does: from an IP address (Layer 3) to a MAC address (Layer 2).
Read the router's ARP table and tell dynamic, static and DHCP entries apart.
Add a static ARP entry and set the bridge's ARP mode to reply-only.
Predict what happens to a device with a hand-typed address and no ARP entry (and see it with tcpdump).
Combine static-only DHCP, static leases and Add ARP For Leases into one easy-to-use, harder-to-abuse LAN.
Know the limits: reply-only ARP is not a firewall.

The analogy: a block of flats with a concierge¶

Your LAN is a block of flats, and the router is the concierge who hands every parcel to the right door.

Block of flats	Network
A resident's name	The IP address (`192.168.199.123`)
The flat door	The MAC address (`02:00:00:00:01:01`)
The concierge's notebook: "name → door"	The ARP table
Shouting in the hall "Who is 123? Which door?"	An ARP request (broadcast)
"That's me, door 01:01"	An ARP reply
The concierge writes down anyone who answers	ARP mode enabled (the default): dynamic entries
The concierge only uses the residents list, never writes anybody new	ARP mode reply-only
A name written in the list by hand	A static ARP entry
The letting office adds you to the list when it gives you your key	DHCP Add ARP For Leases

What is ARP?¶

ARP (Address Resolution Protocol, RFC 826, 1982) finds the MAC address that belongs to an IP address on the local network.

Why is that needed? Inside a LAN, frames are delivered by MAC address (Layer 2, the network card's hardware address). But programs talk in IP addresses (Layer 3). Before the router can hand a reply to 192.168.199.123, it must know which network card that is.

sequenceDiagram
    participant R as r1 (192.168.199.1)
    participant P1 as pc1 (192.168.199.123)
    participant P2 as pc2
    R->>P1: ARP request (broadcast to everybody) "Who has 192.168.199.123?"
    R->>P2: (same broadcast, pc2 ignores it)
    P1->>R: ARP reply "192.168.199.123 is at 02:00:00:00:01:01"
    Note over R: writes it in the ARP table (dynamic entry)
    R->>P1: now the real packet can be delivered

The answers are kept in the ARP table (IP → ARP in RouterOS) for a while, so the router does not have to shout before every packet. ARP works dynamically by default, but the course points out that it can also be configured by hand.

ARP as a security tool¶

The course's idea (slides p128–131):

Write the trusted devices in the ARP table by hand (static entries).
Set the LAN interface's ARP mode to reply-only: the router stops adding dynamic entries.
A device that is not in the table cannot hold a conversation with the router, so it cannot use the Internet, even with a valid hand-typed address. And a known client cannot simply switch to a different IP address, because the table ties each IP to one MAC.

Writing every device by hand would be painful, so step 4 is the clever part:

Let the DHCP server add the ARP entry whenever it hands out a lease (Add ARP For Leases). Combined with static-only DHCP and static leases, only the devices you booked get an address and an ARP entry. Users still just plug in; strangers get nothing.

Three kinds of ARP entries¶

Flag in `/ip arp print`	Kind	Who created it	Survives reply-only?
`D` (+ `C` = complete)	Dynamic	The router learned it from an ARP reply	No: reply-only removes them and stops learning
(none)	Static	You, with `/ip arp add`	Yes
`H`	DHCP	The DHCP server, from a lease, with Add ARP For Leases	Yes, while the lease is bound

The scenario¶

flowchart LR
    INET["<b>internet</b><br>198.51.100.10"]
    CAP["<b>class-ap</b><br>10.0.0.1"]
    subgraph R1["r1 · your router"]
        WAN["ether2 (WAN)<br>10.0.0.x by DHCP"]
        BR["<b>bridge1</b> 192.168.199.1/24<br>dhcp1: static-only<br>ARP: enabled → reply-only"]
    end
    PC1["<b>pc1</b> (you)<br>02:00:00:00:01:01<br>static lease .123"]
    PC2["<b>pc2</b> (the intruder)<br>02:00:00:00:02:02<br>types .50 by hand"]
    INET --- CAP
    CAP ---|"10.0.0.0/24"| WAN
    BR ---|"ether3"| PC1
    BR ---|"ether4"| PC2

Node	Role	Address
`internet`	"The Internet" (ping and a web page)	`198.51.100.10/24`
`class-ap`	Classroom gateway, DNS, NAT	`10.0.0.1/24`
`r1`	Your router, as Lab 02-02 left it: server `dhcp1` static-only, static lease for pc1	LAN `192.168.199.1/24` on `bridge1` (ether3 + ether4)
`pc1`	Your laptop, MAC `02:00:00:00:01:01`	By DHCP: `192.168.199.123`
`pc2`	The intruder, MAC `02:00:00:00:02:02`	Typed by hand: `192.168.199.50/24`

Why ether2 and not ether1?

On a real hAP the Internet port is ether1. In the virtual lab ether1 is reserved for the lab itself, so the Internet port is ether2 and the LAN ports start at ether3. The course slides call the LAN bridge bridge-local; here it is bridge1.

The course says: you must still have the DHCP server static-only and a static lease for your laptop; if not, repeat the previous lab. This lab starts exactly there.

Start the lab¶

Download the lab files and unzip them: 02-03-static-arp.zip. Open a terminal inside the 02-03-static-arp folder.

sudo containerlab deploy -t topology.clab.yml

Wait about two minutes for RouterOS, then open three terminals:

ssh admin@clab-mtcna-02-03-r1            # password: admin
docker exec -it clab-mtcna-02-03-pc1 bash
docker exec -it clab-mtcna-02-03-pc2 bash

Step 1 · Reproduce the loophole¶

Your laptop gets its booked address. On pc1:

dhclient -v eth1
ip -br address show eth1          # 192.168.199.123/24
ping -c 3 198.51.100.10           # works

The intruder types an address by hand. On pc2:

ip address add 192.168.199.50/24 dev eth1
ip route add default via 192.168.199.1
ping -c 3 198.51.100.10

The ping works. Static-only DHCP did not stop it. Now look at the concierge's notebook on r1 (WinBox: IP → ARP):

/ip arp print

Expected: dynamic entries (DC) for 192.168.199.123 (pc1) and 192.168.199.50 (pc2), both on bridge1. The router learned the intruder's door all by itself.

Check yourself

Copy pc2's ARP entry. Which part is Layer 3 and which part is Layer 2?
Why did static-only DHCP not stop pc2?

Done when you see both PCs in the ARP table.

Step 2 · Write your laptop in the list by hand¶

Before telling the router to stop learning, make sure your own laptop is in the list, or you lock yourself out too. The course: make your laptop's ARP entry static.

WinBox: IP → ARP → +, Address 192.168.199.123, MAC Address 02:00:00:00:01:01, Interface bridge1 (copy them from the dynamic entry).

/ip arp add address=192.168.199.123 mac-address=02:00:00:00:01:01 interface=bridge1 comment="pc1 by hand"
/ip arp print

Expected: pc1's line now has no D flag and its status is permanent: the static entry replaces the dynamic one.

RouterOS 7 has no make-static for ARP in the terminal

Leases have make-static (Lab 02-02), but in RouterOS 7.23 /ip arp make-static does not exist. Add the entry with /ip arp add as above.

Done when pc1 has an ARP entry without the D flag.

Step 3 · Switch the bridge to reply-only¶

Now the concierge stops writing new names. The course does it on the bridge interface (slide p130).

WinBox: Bridge → Bridge (or Interfaces), double-click bridge1, General → ARP: reply-only.

/interface bridge set bridge1 arp=reply-only
/ip arp print

Expected: every dynamic entry on bridge1 is gone, including pc2's. Only pc1's static entry remains (and the entries on ether1/ether2, which are other interfaces). Test both PCs:

ping -c 3 198.51.100.10           # on pc1: works
ping -c 3 198.51.100.10           # on pc2: 100% packet loss
ping -c 3 192.168.199.1           # on pc2: also fails, even the router itself

Look under the hood with tcpdump

Open a second terminal on pc2 and capture ARP and ping traffic:

docker exec -it clab-mtcna-02-03-pc2 tcpdump -eni eth1 'arp or icmp'

In the first pc2 terminal run ip neigh flush dev eth1 and ping -c 2 192.168.199.1. What we saw on RouterOS 7.23.8:

pc2 asks "who-has 192.168.199.1" and the router does answer "is-at ...".
pc2's echo requests reach the router, but no echo reply ever comes back.

The router knows where pc2's packets come from, but it has no ARP entry for 192.168.199.50 and, in reply-only mode, it will not learn or ask for one. It has no door to deliver the answer to. With tcpdump -ni eth1 icmp on the internet node you can even see pc2's pings arrive and get answered: the answers die at r1. One-way traffic is useless, so pc2 has no working Internet.

Check yourself

Why was it essential to do Step 2 before Step 3?
In your own words: why does pc2 get no answer even though its packets reach the router?

Done when pc1 works and pc2 cannot even ping 192.168.199.1.

Step 4 · Let DHCP write the list¶

Writing every laptop by hand does not scale. The DHCP server already knows the MAC and IP of every device it serves, so let it add the ARP entries.

WinBox: IP → DHCP Server → DHCP, double-click dhcp1, tick Add ARP For Leases (slide p132).

/ip dhcp-server set dhcp1 add-arp=yes
/ip dhcp-server print

Expected: the ADD-ARP column says yes. While you are there, confirm the conditions from the course: ADDRESS-POOL is static-only and /ip dhcp-server lease print shows pc1's static lease (no D flag).

Done when dhcp1 shows add-arp yes.

Step 5 · Remove the hand-written entry and watch pc1 break¶

The course: remove your laptop's static entry from the ARP table and check the Internet (it does not work). This proves that, from now on, the entry must come from somewhere else.

WinBox: IP → ARP, select pc1's static entry, −.

/ip arp remove [find address="192.168.199.123"]
/ip arp print

On pc1:

ping -c 3 198.51.100.10           # 100% packet loss

pc1 now has exactly the same problem as the intruder: no line in the notebook.

Check yourself

pc1 still has its lease and its address. Why did enabling Add ARP For Leases not create its entry yet?

Done when pc1 cannot reach the Internet.

Step 6 · Renew the lease and look at the ARP table¶

When pc1 asks for its lease again, the DHCP server grants it and writes the ARP entry. On pc1:

dhclient -r eth1
dhclient -v eth1
ping -c 3 198.51.100.10           # works again
curl http://www.mikrotik.com/     # Welcome to the Internet

On r1:

/ip arp print
/ip arp print detail where address="192.168.199.123"

Expected: pc1's entry is back with the flag H (DHCP), status permanent. pc2 still has no entry and still has no Internet.

Check yourself

Write down pc1's ARP line and explain each flag.
A friend with a static lease on your router plugs in their laptop. Do you need to touch the ARP table? Why not?

Done when pc1 works with an H entry and pc2 is still locked out. Run ./check.sh: it must say Lab 02-03 solved.

Reply-only ARP is a fence, not a firewall

It only works inside your LAN, it only checks the IP-to-MAC pair, and a determined intruder who copies a booked device's IP and MAC while that device is offline can still get in. Real protection adds the firewall (Module 6). Also remember the danger in the other direction: if you set reply-only on the interface you are connected through before your own laptop is in the table, you lock yourself out (on real hardware, MAC-WinBox still works, because it does not use IP or ARP).

If something goes wrong¶

Symptom	Likely cause	Fix
You lost access to the router right after Step 3 (real hardware)	Your laptop was not in the ARP table	Reconnect with MAC-WinBox, add the static entry, or set ARP back to `enabled`
`/ip arp make-static` gives "expected end of command"	That command does not exist in RouterOS 7	Use `/ip arp add address=... mac-address=... interface=bridge1`
pc2 can still ping the router after Step 3	pc2's dynamic entry survived, or ARP was set on a port instead of the bridge	`/interface bridge print` must show `arp=reply-only` on `bridge1`; `/ip arp print`
pc1 still fails after Step 6	`add-arp` is off, or the lease is dynamic and was released (static-only gives no new one)	`/ip dhcp-server print`; check pc1's static lease; renew again
pc1 has no address after `dhclient -r`	Its static lease is gone or has the wrong MAC	Recreate it as in Lab 02-02

Clean up¶

sudo containerlab destroy -t topology.clab.yml --cleanup

Key takeaways¶

ARP turns an IP address (Layer 3) into a MAC address (Layer 2) with a broadcast request and a reply, and keeps the answers in the ARP table.
ARP entries are dynamic (D, learned), static (added by hand) or DHCP (H, added by the DHCP server).
With reply-only, the interface stops learning: only devices already in the ARP table can talk with the router.
Add ARP For Leases makes the DHCP server write the ARP entry for every lease it grants.
Static-only DHCP + static leases + reply-only + Add ARP For Leases: booked devices just plug in and work; strangers, even with hand-typed addresses, do not.
Reply-only ARP is a LAN fence, not a firewall, and it can lock you out if your own device is not in the table.

Quick check¶

1. What does ARP find out?

The MAC address that belongs to an IP address on the LAN
The IP address that belongs to a domain name
The fastest route to a remote network
The IP address a DHCP server should hand out

ARP maps a Layer 3 IP address to a Layer 2 MAC address inside the local network. Names to IPs is DNS's job, and routes are the routing table's.

2. How does a device send an ARP request when it does not yet know the other device's MAC?

As a broadcast that every device on the LAN receives
As an email to the network administrator
Directly to the DHCP server's MAC address
Through the default gateway to the Internet

The asker does not know the target's MAC, so it broadcasts "who has this IP?". Only the owner of that IP replies with its MAC. Broadcasts stay inside the LAN.

3. What happens to the dynamic entries on bridge1 when you set its ARP mode to reply-only?

They are removed, and no new dynamic entries are learned
They become static entries automatically
They stay, but no new static entries can be added
They are copied into the DHCP lease table

In reply-only mode the interface stops adding dynamic entries and the old ones disappear. That is why your own laptop must be in the table first, as a static or DHCP entry.

4. Which flag marks an ARP entry that the DHCP server created with Add ARP For Leases?

H
D
X
I

H stands for DHCP. D is a dynamic entry learned from ARP, X is disabled and I is invalid.

5. Reply-only is on and pc2 types 192.168.199.50 by hand. Its pings to the Internet fail. Where do the replies get lost?

At the router, which has no ARP entry to deliver them to pc2
At the Internet server, which refuses unknown addresses
At pc2, which cannot find the router's MAC address
At class-ap, which blocks addresses from 192.168.199.0/24

pc2's packets go out and the Internet answers, but r1 cannot find pc2's MAC: there is no entry for .50 and reply-only forbids learning one. With nowhere to deliver them, the answers are dropped at r1.

6. After Add ARP For Leases is enabled you delete pc1's hand-made ARP entry. What brings pc1's Internet back?

Renewing pc1's DHCP lease
Pinging the router from pc1 several times
Setting a new IP address on pc1 by hand
Waiting for the router to learn pc1's MAC

The DHCP server writes the ARP entry when it grants a lease. A renewal (dhclient -r then dhclient) creates the H entry. Pings cannot help, because reply-only never learns.

7. Your router uses static-only DHCP, static leases, reply-only ARP and Add ARP For Leases. A friend you already gave a static lease plugs in. What must you do?

Nothing, the lease creates the ARP entry automatically
Add a static ARP entry for the friend by hand
Switch the bridge back to ARP enabled for a minute
Give the friend's laptop a hand-typed address

That is the point of the combination: the static lease gives the address and Add ARP For Leases writes the ARP entry, so booked devices just plug in and work, while strangers get neither.

That closes Module 2. You now control who gets an address and who the router talks to; next, Module 3 looks at the box that joins your LAN ports together, the bridge.