Lab 04-02 · Static routing: reach your neighbour's network¶
MTCNA
Module 4 · Routing of the MikroTik MTCNA course, official slides p173–176 (static routing and the LAB "Enrutamiento estático": ping your neighbour's laptop through a static route) and p181 (pros and cons of static routing).
Your best friend lives in the building across the street. You know the street (the classroom network), and you know where their front door is. But you have never been inside. You cannot just walk to flat 3B: you go to the front door of their building, and from there you are let in.
Your neighbour's laptop lives in a network behind their router, 192.168.89.0/24. Your router has never heard
of it. If you ping it, the packet follows the default route to the classroom gateway, which has never heard of
it either, and the packet dies. In this lab you write the missing instruction, a static route: "to reach
192.168.89.0/24, knock on the neighbour's router at 10.0.0.12".
What you will learn
- Explain what a static route is and when it is the right tool.
- Find the two facts you need from your neighbour: their LAN network and their router's address on the shared network.
- Add a static route in WinBox and in the terminal, and read it in the routing table.
- Explain why a ping needs a way there and a way back, and who provides each one.
- Use
tracerouteandtcpdumpto see the path, and discover what NAT does to your neighbour's view. - List the pros and cons of static routing (slide p181).
The analogy: the building across the street¶
| Street | Network | What it means |
|---|---|---|
| The street both buildings face | The class network 10.0.0.0/24 |
Both routers are connected to it |
| Your building | Your LAN 192.168.88.0/24 |
pc1 lives here |
| Your friend's building | The neighbour's LAN 192.168.89.0/24 |
pc2 lives here |
| Your friend's front door | The neighbour's router, 10.0.0.12 |
The gateway of your new route |
| A note: "for flat 3B, use the door of building 89" | A static route | 192.168.89.0/24 → 10.0.0.12 |
What is a static route?¶
A static route is a route you type by hand: "to reach this network, send the packets to this gateway". It stays in the routing table until you remove it.
The default route from Lab 04-01 is also a static route (slide p173): it just has the widest destination
possible. Now you add a narrow one. Because 192.168.89.0/24 is more specific than 0.0.0.0/0, packets
for the neighbour will use it, and everything else keeps following the default route.
What you need to know about your neighbour¶
The slides (p174) tell you to ask your neighbour two things:
- The address of their LAN,
192.168.XY.0/24: the destination of your route. - The address of their router on the network you share: the gateway. On the slides it is their wireless
address (the example on p176 is
192.168.37.0/24via192.168.250.37); in our classroom it is their router's cabled address on the class network.
Rule: the gateway must be in a network your router is directly connected to. 10.0.0.12 is fine because
your router has 10.0.0.11/24 on ether2.
Why fixed addresses on the class network today?
In the earlier labs your router got its class address from DHCP, and it can change. A gateway that moves
breaks every route pointing at it. For this lab each router uses a fixed class address: group X uses
10.0.0.(10+X), so r1 is 10.0.0.11 and r2 is 10.0.0.12. The LAN of group X is 192.168.(87+X).0/24
(the course's own table, p175, uses 192.168.1.0 to 192.168.12.0 for groups 1 to 12; the idea is identical).
A ping is a round trip¶
A ping is a question and an answer. The question needs a route from you to the neighbour; the answer needs a route back. Who provides the way back here is a surprise you will discover in Step 4.
flowchart LR
PC1["<b>pc1</b><br>192.168.88.254"] -->|"1 · default via 192.168.88.1"| R1["<b>r1</b><br>192.168.89.0/24<br>→ 10.0.0.12"]
R1 -->|"2 · static route"| R2["<b>r2</b><br>192.168.89.0/24 is<br>connected"]
R2 -->|"3 · delivered"| PC2["<b>pc2</b><br>192.168.89.254"]The scenario¶
flowchart LR
INET["<b>internet</b><br>198.51.100.10"]
CAP["<b>class-ap</b><br>10.0.0.1"]
subgraph R1["r1 · your router"]
R1W["ether2<br>10.0.0.11/24"]
R1B["bridge1<br>192.168.88.1/24"]
end
subgraph R2["r2 · neighbour's router"]
R2W["ether2<br>10.0.0.12/24"]
R2B["bridge1<br>192.168.89.1/24"]
end
PC1["<b>pc1</b><br>your laptop"]
PC2["<b>pc2</b><br>neighbour's laptop"]
INET --- CAP
CAP ---|"class network 10.0.0.0/24"| R1W
CAP ---|"class network 10.0.0.0/24"| R2W
R1B ---|"ether3"| PC1
R2B ---|"ether3"| PC2| Node | Role | Address |
|---|---|---|
internet |
"The Internet": answers ping, serves a web page | 198.51.100.10/24 |
class-ap |
The trainer's router: class gateway, DNS, NAT | 10.0.0.1/24 |
r1 |
Your router (group 1) | WAN 10.0.0.11/24 · LAN 192.168.88.1/24 |
r2 |
Your neighbour's router (group 2) | WAN 10.0.0.12/24 · LAN 192.168.89.1/24 |
pc1 |
Your laptop | By DHCP from r1 (192.168.88.254) |
pc2 |
Your neighbour's laptop | By DHCP from r2 (192.168.89.254) |
Both routers already have a default route to 10.0.0.1 and NAT (masquerade) on ether2, as at home.
Why ether2 and not ether1?
On a real hAP the Internet port is ether1. In the virtual lab ether1 is reserved for the lab itself (containerlab uses it to manage the router), so the Internet port is ether2 and the LAN ports start at ether3. Never touch ether1 in these labs. In the classroom your hAP's ether1 is plugged by cable into the trainer's router, exactly like ether2 here.
Start the lab¶
Download the lab files and unzip them: 04-02-static-routing.zip. Open a terminal inside the 04-02-static-routing folder.
Three RouterOS routers have to boot: give it two or three minutes. Then:
ssh admin@clab-mtcna-04-02-r1 # password: admin (also r2)
docker exec -it clab-mtcna-04-02-pc1 bash # also pc2
You configure r1, and you also play your neighbour on r2. At any moment you can run
CLAB_EXEC="docker exec" ./check.sh.
The laptops ask for their address by themselves when the lab starts; if ip -br address show eth1 shows
no IPv4 address yet (the router was still booting), run dhclient -v eth1.
Step 1 · Try to reach the neighbour without a route¶
First see the problem. On pc1 and pc2, check the addresses:
pc1 has 192.168.88.254, pc2 has 192.168.89.254 (if one is empty, run dhclient -v eth1). From pc1:
Expected: 100% packet loss with +3 errors, and a traceroute that stops after 192.168.88.1. Look at
r1's table:
There is no line for 192.168.89.0/24, so r1 uses the default route and hands the packet to class-ap.
class-ap has no route to 192.168.89.0/24 either: it drops the packet and answers "network unreachable"
(those are the errors).
Check yourself
- Which route of r1's table did the ping to
192.168.89.254use? Who finally dropped it?
Done when you have seen the ping fail and can explain why.
Step 2 · Add the static route on your router¶
On r1. WinBox: IP → Routes → +, Dst. Address 192.168.89.0/24, Gateway 10.0.0.12.
Expected, a new line:
A = active, s = static, distance 1. RouterOS checked that 10.0.0.12 is reachable through ether2.
Done when the route shows As.
Step 3 · Ping your neighbour's laptop¶
From pc1:
Expected: the ping answers, and the traceroute shows three hops: 192.168.88.1 (r1), 10.0.0.12 (r2),
192.168.89.254 (pc2). The packet no longer goes to class-ap.
Check yourself
- Copy the traceroute. Which hop is the gateway of your new route?
- Why did
class-apdisappear from the path?
Done when pc1 pings pc2.
Step 4 · Who answers back? Look through your neighbour's eyes¶
Wait: r2 has no route to 192.168.88.0/24. How did the replies come back? Watch the traffic on pc2
while pc1 pings again:
Expected on pc2:
pc2 does not see 192.168.88.254: it sees 10.0.0.11, your router's class address. Your router has a
masquerade (source NAT) rule on ether2, the same one that lets you browse the Internet. It rewrites the
sender of everything leaving ether2. The reply goes to 10.0.0.11, a network r2 is connected to, so no route
is needed for the way back. Your router then undoes the translation and hands the reply to pc1.
Now try the other direction, from pc2:
It fails. For packets that start at pc2, r2 needs its own route.
Check yourself
- Which address did pc2 see as the sender of your pings? Which RouterOS rule caused it?
- Why does the ping from pc2 to pc1 fail although the ping from pc1 to pc2 works?
Done when you can explain why only one direction works.
Step 5 · Add the route on your neighbour's router¶
On r2 (in class, your neighbour does it on their hAP), the mirror image of Step 2:
From pc2:
Now both directions work.
Done when pc1 pings pc2 and pc2 pings pc1. Run CLAB_EXEC="docker exec" ./check.sh: every line must
say PASS.
Without NAT, both routes are needed for every ping
In a company network there is usually no NAT between internal networks, so the neighbour would see the real
address 192.168.88.254, and r2 would need its route just to send the reply. Routing always needs a way
there and a way back; NAT only hid that here.
Backup: no cable available?
The slides do this lab over WiFi: the gateway is the neighbour's wireless address. In our classroom it
is the cabled address on the class network. If no cable is available, your hAP's wlan1 becomes the
Internet port (WiFi station), the route is the same and the gateway is still the neighbour's address on the
shared network. The configuration is in final/r1-wifi-backup.rsc (hAP ac², driver wireless).
Static routing: good and bad¶
From slide p181:
| Good | Bad |
|---|---|
| Easy to configure in a small network | Does not scale: 12 groups means 11 routes on every router |
| Uses almost no router resources (CPU, memory) | Every new network needs a manual change on every router |
| Fully predictable: the route is exactly what you typed | If a gateway dies, the route does not notice (unless you add check-gateway) |
That is why big networks use dynamic routing protocols (OSPF, BGP), where routers tell each other about their networks automatically. They belong to the MTCRE course.
If something goes wrong¶
| Symptom | Likely cause | Fix |
|---|---|---|
The route shows I (inactive) |
Gateway mistyped, or outside 10.0.0.0/24 |
/ip route set [find dst-address=192.168.89.0/24] gateway=10.0.0.12 |
Ping still fails, traceroute shows 10.0.0.1 as hop 2 |
Wrong destination network (e.g. 192.168.98.0/24) |
Check the destination with /ip route print |
Ping fails, traceroute shows 10.0.0.12 then stars |
pc2 has no address, or its gateway is wrong | On pc2: dhclient -v eth1; ip route must show default via 192.168.89.1 |
| pc2 → pc1 fails, pc1 → pc2 works | r2 has no route to 192.168.88.0/24 |
Step 5 |
You used the neighbour's LAN address 192.168.89.1 as gateway |
Not reachable: it is not in a network r1 is connected to | The gateway is always the neighbour's address on the shared network |
Clean up¶
Key takeaways¶
- A static route says "to reach this network, send packets to this gateway"; you type it, and it stays until removed.
- The gateway must be the neighbour's address on a network you share with them, never an address inside their LAN.
- A more specific static route beats the default route for that network only.
- A ping needs a way there and a way back; each router only routes the packets that cross it.
- Masquerade on the WAN rewrites the sender, which hid the missing return route in one direction.
- Static routing is simple and light, but it does not scale: big networks use dynamic routing protocols.
Quick check¶
1. Your neighbour's LAN is 192.168.89.0/24 and their router's class address is 10.0.0.12. Which static route do you add?
- dst-address=192.168.89.0/24 gateway=10.0.0.12
- dst-address=10.0.0.12/32 gateway=192.168.89.0
- dst-address=192.168.89.0/24 gateway=192.168.89.1
- dst-address=0.0.0.0/0 gateway=10.0.0.12
The destination is the network you want to reach, 192.168.89.0/24. The gateway is the next
router on the way, reachable on a network you share: 10.0.0.12.
2. Why can't the gateway of your route be 192.168.89.1, the neighbour's LAN address?
- Because addresses ending in .1 are reserved
- Because your router is not connected to 192.168.89.0/24, so it cannot reach that address directly
- Because a gateway must always be the classroom router
- Because RouterOS only accepts interface names as gateways
A gateway must be directly reachable through a connected network. Your router has no address in
192.168.89.0/24, so it cannot deliver anything to 192.168.89.1; the route would stay inactive.
3. Before adding the route, who dropped your ping to the neighbour's laptop?
- Your own router, because it had no default route
- The neighbour's router, because of its firewall
- The classroom gateway, which received it through the default route and had no route to that network
- The neighbour's laptop, because it ignores pings
With no specific route, your router used the default route and handed the packet to class-ap. The
classroom gateway had no route to 192.168.89.0/24 either, so it dropped it and answered "network
unreachable".
4. Only your router has the static route. Why does your ping to the neighbour's laptop still get answers?
- Because the neighbour's router learns your route automatically
- Because masquerade makes the ping come from 10.0.0.11, an address the neighbour's router can reach directly
- Because ICMP replies do not need routes
- Because the classroom gateway forwards the replies
Your masquerade rule rewrites the sender to your router's class address 10.0.0.11. The reply goes to
that address, which is in a network the neighbour's router is connected to, so no extra route is needed
for the way back.
5. Your static route is active and the ping works. What happens to your traffic to the Internet?
- It now goes through the neighbour's router
- It stops, because a static route replaces the default route
- It still uses the default route, because only 192.168.89.0/24 matches the new route
- It is split between both routers
The new route only matches 192.168.89.0/24. Every other destination still matches only 0.0.0.0/0, so
Internet traffic keeps following the default route.
6. Pick the two real disadvantages of static routing.
- Every new network needs a manual change on every router
- It uses a lot of CPU and memory
- It does not scale well to big networks
- It is impossible to configure in WinBox
Static routes are light and predictable, but every change is manual and the number of routes grows with the number of networks, so it does not scale. Big networks use dynamic routing protocols.
7. A classmate adds a route to 192.168.89.0/24 with gateway 10.0.0.21, which is nobody's address. What does the routing table show?
- The route is active and the packets go to class-ap
- The route exists, and the packets are sent to a gateway that never answers
- RouterOS refuses the command with an error
- The route is converted into a default route
10.0.0.21 is inside the connected network 10.0.0.0/24, so RouterOS accepts the route as reachable. But no
device has that address: ARP never gets an answer and the packets are lost. A plain static route does not
check that its gateway really exists; check-gateway does (Labs 04-04 and 04-05).
Next, an optional challenge: reach a neighbour's laptop through another neighbour's router, so the packet crosses two routers before arriving.