Lab 04-01 · The default route: "all other directions"¶

Drive out of any town and look at the first roundabout. There are signs for a few places: Hospital, Airport, Port. And there is always one more sign, the most useful one: "All other directions". You do not need a sign for every town in Europe. If your town is not listed, you follow that one.

Your router works exactly like that roundabout. It knows a few networks by name (its own LAN, the classroom network), and for everything else, the whole Internet, it follows one sign: the default route. Until today the router got that sign automatically from DHCP, so you never saw it. In this lab you take it away, watch the Internet disappear, and put the sign back up by hand.

The analogy: the roundabout¶

What is routing?¶

Routing is choosing, for every packet, where to send it next. It works at Layer 3 (the network layer), using IP addresses.

A bridge (Module 3) joins networks into one. A router does the opposite: it keeps networks separate and passes packets between them. For each packet it looks at the destination IP address, searches its routing table, and sends the packet to the gateway of the best matching route. The gateway is the next router on the way, which repeats the same process, hop by hop, until the packet arrives.

A route is one line of the routing table: a destination network and the gateway (the next hop) that leads there.

In RouterOS: WinBox IP → Routes, terminal /ip route print.

Which route wins? Most specific first¶

A packet can match several routes. Slide p164's example:

A packet for 192.168.90.135 matches both (.135 is inside .0–.255 and inside .128–.255). The router picks the most specific one, the /25, because it describes a smaller, more precise network. So the packet goes to 5.6.7.8. This is the longest prefix match rule: the longer the prefix (the number after the slash), the more specific the route.

The default route 0.0.0.0/0 has a prefix of zero: it matches every address, and it is the least specific route possible. That is why it only wins when nothing else matches.

Equally specific? The distance breaks the tie¶

If two routes are equally specific, the router compares their administrative distance (RouterOS: distance). It is a number that says how much the router trusts the source of the route. Lower wins.

Slide p167 adds: if two routes are equally specific and have the same distance, it depends on the vendor. The slide says MikroTik uses the one it learned first; the current RouterOS manual simply says the active one is chosen arbitrarily, so never rely on the order. You will meet the exception, ECMP, in Lab 04-04.

The default route¶

The default route (or default gateway) is the route to 0.0.0.0/0: "every destination". The router sends there all traffic for which it has no more specific route.

At home, your router's default route points at your Internet provider. Here it points at the trainer's router, class-ap (10.0.0.1). Without it, your router only knows the networks it is directly connected to, and the Internet does not exist for it.

Where routes come from, and the v7 flags¶

Routes appear in three ways:

• Connected: when you add an IP address to an interface, RouterOS creates the route to that network by itself (slide p171). 192.168.88.1/24 on bridge1 creates 192.168.88.0/24 → bridge1.
• Dynamic from a protocol: the DHCP client can install a default route; OSPF or BGP install many.
• Static: you type them. They stay until you remove them.

Each line of /ip route print starts with flags. The slides (p171–172) show RouterOS v6 flags in capitals, like ADC. RouterOS v7 prints them differently:

So DAc in v7 is the v6 ADC (same letters, different order and case), and a DHCP default route looks like DAd.

The scenario¶

flowchart LR
    INET["<b>internet</b><br>198.51.100.10<br>web server"]
    CAP["<b>class-ap</b><br>trainer's router<br>10.0.0.1"]
    subgraph R1["r1 · your router"]
        WAN["ether2 (WAN)<br>DHCP client 10.0.0.x"]
        BR["<b>bridge1</b> (LAN)<br>192.168.88.1/24"]
    end
    PC1["<b>pc1</b><br>your laptop<br>192.168.88.x"]
    INET ---|"198.51.100.0/24"| CAP
    CAP ---|"10.0.0.0/24"| WAN
    BR ---|"ether3"| PC1
    WAN -.->|"default route 0.0.0.0/0<br>gateway 10.0.0.1"| CAP

Start the lab¶

Download the lab files and unzip them: 04-01-default-route.zip. Open a terminal inside the 04-01-default-route folder.

sudo containerlab deploy -t topology.clab.yml

Give RouterOS about two minutes to boot. Then:

ssh admin@clab-mtcna-04-01-r1            # password: admin
docker exec -it clab-mtcna-04-01-pc1 bash

The laptops ask for their address by themselves when the lab starts; if ip -br address show eth1 shows no IPv4 address yet (the router was still booting), run dhclient -v eth1.

At any moment you can run CLAB_EXEC="docker exec" ./check.sh to see which parts are already solved.

Step 1 · Read the routing table¶

Before changing anything, read the signs your router already has.

WinBox: IP → Routes.

/ip route print
/ip route print detail

Expected (the addresses 10.0.0.x may differ):

Flags: D - DYNAMIC; A - ACTIVE; c - CONNECT, d - DHCP
    DST-ADDRESS       GATEWAY   ROUTING-TABLE  DISTANCE
DAd 0.0.0.0/0         10.0.0.1  main                  1
DAc 10.0.0.0/24       ether2    main                  0
DAc 172.31.255.28/30  ether1    main                  0
DAc 192.168.88.0/24   bridge1   main                  0

Four routes. Two are your networks (c, connected, distance 0). One is the lab's management network on ether1: ignore it. And one is the default route, installed by the DHCP client (d), pointing at 10.0.0.1.

Test it from the router and from the laptop:

/ping 198.51.100.10 count=3

curl http://www.mikrotik.com/

Both work; curl prints Welcome to the Internet.

Done when you can explain every line of the table.

Step 2 · Stop DHCP from installing the default route¶

The slides (p169) say: disable "Add Default Route" in the DHCP client settings and check the Internet connection (it does not work). The DHCP client keeps getting the address; it just stops putting up the sign.

WinBox: IP → DHCP Client, double-click the client on ether2, Add Default Route: no.

/ip dhcp-client set [find interface=ether2] add-default-route=no
/ip route print

Expected: the DAd 0.0.0.0/0 line is gone. The two connected routes are still there.

Now test again:

/ping 198.51.100.10 count=3

curl -m 5 http://www.mikrotik.com/

The router answers no route to host, and curl fails. The router still knows 10.0.0.0/24 (try /ping 10.0.0.1 count=3: it works), but for 198.51.100.10 there is no sign at all.

Done when /ip route print has no 0.0.0.0/0 line and the Internet is unreachable.

Step 3 · Add the default route by hand¶

The slides (p170): add the default gateway manually (the trainer's router) and check that the Internet is available. The trainer's router is 10.0.0.1.

WinBox: IP → Routes → +, Dst. Address 0.0.0.0/0, Gateway 10.0.0.1.

/ip route add dst-address=0.0.0.0/0 gateway=10.0.0.1
/ip route print

Expected:

#     DST-ADDRESS       GATEWAY   ROUTING-TABLE  DISTANCE
0  As 0.0.0.0/0         10.0.0.1  main                  1
  DAc 10.0.0.0/24       ether2    main                  0

The new line has A (active) and s (static), and no D: it is yours, not RouterOS's. Its distance is 1, the default for static routes.

Done when the static default route shows the flags As.

Step 4 · Test the Internet again¶

From the router and from the laptop:

/ping 198.51.100.10 count=3

curl http://www.mikrotik.com/
traceroute -n 198.51.100.10

curl prints Welcome to the Internet again. traceroute shows the path: 192.168.88.1 (your router), 10.0.0.1 (class-ap), 198.51.100.10 (the web server).

Done when curl works from pc1. Run CLAB_EXEC="docker exec" ./check.sh: every line must say PASS.

If something goes wrong¶

Clean up¶

sudo containerlab destroy -t topology.clab.yml --cleanup

Key takeaways¶

• Routing works at Layer 3: for each packet the router looks up the destination in its routing table and sends it to the route's gateway.
• The most specific route (longest prefix) wins; between equally specific routes, the lowest distance wins.
• The default route 0.0.0.0/0 matches everything and is used when nothing more specific matches.
• Routes are connected (from interface addresses), dynamic (DHCP, OSPF...) or static (typed by hand).
• RouterOS v7 shows flags like DAc, DAd, As: lowercase letters for the route's source, unlike the v6 capitals on the slides.
• A gateway must be reachable through a connected network, otherwise the route is inactive.

Quick check¶

Next: your neighbour's laptop lives in another network, 192.168.89.0/24. The default route sends it to the classroom gateway, which has never heard of it. Time for your first static route.