Lab 06-03 · Address lists: the bouncer's guest list¶
MTCNA
Module 6 · Firewall of the MikroTik MTCNA course, official slides p253–257 (address lists, using them in rules, adding addresses automatically, and the LAB "Lista de direcciones").
A birthday party at a club. The bouncer does not get one instruction per guest ("let Ana in", "let Biel in", "let Carla in"...). He gets one instruction, "let in whoever is on this list", and a sheet of paper with names. When a new friend is invited, you add a line to the paper, not a new instruction.
Firewalls work the same way. In lab 06-01 you wrote the laptop's address straight into a rule. Fine for one laptop; painful for the ten devices of the IT department. Today you build an address list, protect WinBox with it, and, as a bonus, teach the bouncer to write troublemakers into a black book by himself.
What you will learn
- Explain what an address list is and why it beats writing addresses into every rule.
- Create a list and use it in a rule with Src. Address List.
- Protect WinBox (8291/tcp) so only listed addresses can reach it.
- Use the action add src to address list to fill a list automatically, with a timeout.
- Avoid the trap of banning yourself with an automatic rule.
Address lists¶
An address list is a named set of IP addresses that firewall rules can refer to all at once.
What slide 253 tells us about them:
- one rule can act on many addresses at once;
- an entry can be one IP address, a range (
192.168.88.10-192.168.88.20) or a whole subnet (192.168.88.0/24); - entries can be permanent or last for a timeout (for example 10 minutes) and then disappear;
- the firewall itself can add addresses to a list while it works.
| Instead of... | ...you write |
|---|---|
| 3 accept rules, one per admin laptop | 1 accept rule with src-address-list=allowed + 3 list entries |
| editing rules when a new admin arrives | adding one entry to the list |
In WinBox the lists live in IP → Firewall → Address Lists. In a rule, you do not use the General tab's address field: you go to Advanced and choose Src. Address List (who sends) or Dst. Address List (who receives), as slide 255 shows.
The black book: adding addresses automatically¶
The action add src to address list (slide 256) does not accept or drop: it writes the packet's source address into a list, optionally with a timeout, and the bouncer keeps reading the next rules. Combined with a drop rule for that list, you get a self-maintaining black book: "whoever tries the back door is banned for 10 minutes".
flowchart TB
P["packet from 192.168.88.199<br>to port 23 (telnet)"] --> R1{"<b>rule A</b><br>source in list <i>blocked</i>?"}
R1 -- "yes" --> D["<b>drop</b><br>banned"]
R1 -- "no" --> R2{"<b>rule B</b><br>dst-port 23?"}
R2 -- "yes" --> L["<b>add src to address list</b><br><i>blocked</i>, timeout 10 min<br>(and keep reading)"]
R2 -- "no" --> N["next rules..."]
L --> NDo not ban yourself
An automatic rule cannot tell an attacker from a curious student. If your laptop trips it, you are in the black book too. Test it from a second address, and remember the timeout lets you back in.
The scenario¶
On a real hAP the Internet port is ether1; in the virtual lab ether1 is reserved for the lab itself, so the Internet port is ether2 and the LAN ports start at ether3.
flowchart LR
PC1["<b>pc1</b> (your laptop)<br>192.168.88.200<br>+ stranger .199 for tests"] -- "LAN" --- R1["<b>r1</b> (your router = the club)<br>bridge1 = ether3: 192.168.88.1/24<br>WinBox 8291 · WebFig 80 · Telnet 23"]
R1 -- "ether2 = WAN<br>10.0.0.x" --- AP["<b>class-ap</b><br>10.0.0.1"]
AP --- NET["<b>internet</b><br>198.51.100.10"]| Node | Role | Address |
|---|---|---|
pc1 |
your laptop; in the tests it also plays a stranger | 192.168.88.200 (DHCP) and, temporarily, 192.168.88.199 |
r1 |
your router, with WinBox (8291), WebFig (80) and Telnet (23) enabled | LAN 192.168.88.1/24 · WAN ether2 10.0.0.x |
class-ap |
trainer's router | 10.0.0.1 |
internet |
"the Internet" | 198.51.100.10 |
You cannot run the WinBox program inside a container, so pc1 has a small helper, knock: it tries to
open a TCP connection, exactly what WinBox does first, and prints OPEN or NO ANSWER.
knock 192.168.88.1 8291 # knock on WinBox's door as yourself (.200)
knock 192.168.88.1 8291 192.168.88.199 # knock pretending to be .199
Start the lab¶
Download the lab files and unzip them: 06-03-address-list.zip. Open a terminal inside the 06-03-address-list folder.
From the lab folder guions/tema-3/lab/mtcna/06-03-address-list/:
After about two minutes:
ssh admin@clab-mtcna-06-03-r1 # the router (password: admin)
docker exec -it clab-mtcna-06-03-pc1 bash # the laptop
Step 1 · See that WinBox is open to everybody¶
On pc1, give the laptop a second address so it can play the stranger without losing its own:
ip addr add 192.168.88.199/24 dev eth1
knock 192.168.88.1 8291 # OPEN: 192.168.88.1:8291 answered
knock 192.168.88.1 8291 192.168.88.199 # OPEN ... from 192.168.88.199
Both get in: no rules yet.
Check yourself
Who could connect to WinBox on your router right now? Think of everyone who can plug into the LAN or join its WiFi.
Done when: both knocks print OPEN.
Step 2 · Write the guest list¶
Slide 257: create a list of allowed IPs, and make sure your laptop is on it.
IP → Firewall → Address Lists → + · Name allowed, Address 192.168.88.200, Comment my laptop
/ip firewall address-list add list=allowed address=192.168.88.200 comment="my laptop"
/ip firewall address-list print
There is no separate "create list" command: a list exists as soon as it has one entry.
Check yourself
Write the command to also allow the whole subnet 192.168.88.0/28 on the same list. How many addresses does that entry cover?
Done when: the list allowed contains 192.168.88.200.
Step 3 · Let only the guest list into WinBox¶
Two rules, in this order: accept WinBox from the list, then drop WinBox for everybody else.
Rule 1. IP → Firewall → Filter Rules → + · General: Chain input, Protocol 6 (tcp),
Dst. Port 8291, In. Interface bridge1 · Advanced: Src. Address List allowed ·
Action: accept · Comment WinBox: only guests on the allowed list
Rule 2. Same, but without the address list, Action drop, Comment WinBox: everybody else
/ip firewall filter add chain=input in-interface=bridge1 protocol=tcp dst-port=8291 src-address-list=allowed action=accept comment="WinBox: only guests on the allowed list"
/ip firewall filter add chain=input in-interface=bridge1 protocol=tcp dst-port=8291 action=drop comment="WinBox: everybody else"
/ip firewall filter print
Check yourself
The accept rule names the list in Src. Address List, not in Dst. Address List. Why source and not destination here?
Done when: both rules are listed, accept above drop.
Step 4 · Test the guest list¶
On pc1:
knock 192.168.88.1 8291 # OPEN (you are on the list)
knock 192.168.88.1 8291 192.168.88.199 # NO ANSWER (the stranger is not)
knock 192.168.88.1 80 192.168.88.199 # OPEN (WebFig: these rules only guard 8291)
On the router, the drop rule's counter has grown:
Check yourself
A new teacher, 192.168.88.50, must also manage the router with WinBox. Write the one command you need. Why don't you need to touch the filter rules?
Done when: .200 opens WinBox, .199 does not, .199 still reaches port 80.
Step 5 · Bonus: the black book¶
Teach the bouncer to ban anybody who knocks on Telnet (23/tcp), an old, unencrypted remote-control door that nobody in your network should be using. Two rules:
- whoever knocks on 23/tcp is written into the list
blockedfor 10 minutes; - anybody in
blockedis dropped, whatever they ask for. This one must be the first rule.
IP → Firewall → Filter Rules → + · General: Chain input, Protocol 6 (tcp), Dst. Port 23,
In. Interface bridge1, Connection State new · Action: add src to address list,
Address List blocked, Timeout 00:10:00. Then a second rule: Chain input, In. Interface
bridge1, Advanced: Src. Address List blocked, Action drop, and drag it to the top.
connection-state=new means "only the first packet of a new knock". Without it, the leftover packets of
an old telnet conversation could put the address back on the list again and again. You will meet connection
states properly in lab 06-08.
/ip firewall filter add chain=input in-interface=bridge1 protocol=tcp dst-port=23 connection-state=new action=add-src-to-address-list address-list=blocked address-list-timeout=10m comment="telnet knockers go into the black book for 10 min"
/ip firewall filter add chain=input in-interface=bridge1 src-address-list=blocked action=drop comment="drop everybody in the black book"
/ip firewall filter move [find comment="drop everybody in the black book"] destination=0
/ip firewall filter print
move ... destination=0 moves the rule to position 0, the top. Now be the troublemaker, only from .199:
knock 192.168.88.1 23 192.168.88.199 # OPEN: the door opened once...
knock 192.168.88.1 80 192.168.88.199 # NO ANSWER: ...and now .199 is banned everywhere
knock 192.168.88.1 80 # OPEN: you (.200) are fine
Expected: a new entry blocked 192.168.88.199, flagged D (dynamic, created by the firewall) with a
timeout counting down from 10 minutes. The entry disappears by itself when the timeout runs out.
Check yourself
The very first telnet knock got OPEN. Why did the add-to-list rule not stop that first packet?
(Hint: does add src to address list accept or drop?)
When you finish, remove the second address from pc1:
Then run the checker from the lab folder on your PC:
Done when: .199 appears in blocked after knocking on 23 and check.sh ends with RESULT: lab 06-03 solved.
If something goes wrong¶
| Symptom | Likely cause | Fix |
|---|---|---|
| Your own laptop cannot reach WinBox | .200 is not in allowed, or the list name has a typo (Allowed ≠ allowed) |
/ip firewall address-list print; list names are case-sensitive |
The stranger .199 still gets OPEN on 8291 |
the drop rule is above the accept, or disabled | print, fix the order, enable |
| .199 cannot reach port 80 either (before step 5) | the drop rule has no dst-port=8291 |
add protocol=tcp dst-port=8291 |
| You banned yourself | you knocked on 23 from .200 | /ip firewall address-list remove [find list=blocked], or wait 10 minutes |
blocked stays empty |
the add-to-list rule is below a rule that already accepted or dropped the packet | move it up |
knock: command not found |
you are not inside pc1 | docker exec -it clab-mtcna-06-03-pc1 bash |
Clean up¶
Key takeaways¶
- An address list is a named set of addresses (single IPs, ranges or subnets) that one rule can use at once.
- Use lists in rules from the Advanced tab: Src. Address List or Dst. Address List.
- To manage who may use a service, change the list, not the rules.
- The action add src to address list writes the sender into a list, with an optional timeout, and then keeps reading the rules.
- A drop rule for a "black book" list must sit at the top to protect everything below it.
Quick check¶
1. What is an address list in RouterOS?
- A list of the router's own IP addresses
- A named set of addresses that firewall rules can refer to
- The DHCP server's list of leases
- A list of blocked websites
An address list groups many addresses under one name. A rule that uses the list matches any of them.
2. Which of these can be an entry in an address list?
- Only a single IP address
- Only a whole subnet
- An IP address, a range of addresses or a subnet
- Only a MAC address
Slide 253: an entry can be one IP, an IP range or a whole subnet, permanently or with a timeout.
3. Where do you select an address list in a WinBox firewall rule?
- General tab, Src. Address
- Advanced tab, Src. Address List
- Action tab, Address List
- Extra tab, Limit
Address lists are chosen in the Advanced tab (Src. Address List or Dst. Address List). The Action tab's Address List field is for the add to list actions.
4. What does the action add src to address list do with the packet itself?
- It drops it
- It accepts it
- It records the source address and lets the next rules decide
- It sends it back to the sender
It is a non-terminating action: the source is written into the list and the bouncer keeps reading the following rules. That is why the first telnet knock still opened the door.
5. Why must the rule that drops the blocked list be at the top?
- Because dynamic lists only work in rule 0
- Because a rule above it could accept the banned address first
- Because RouterOS reads the list from the bottom
- Because the timeout only runs for the first rule
First match wins. If an accept rule for WebFig or WinBox came first, a banned address would be let in before the bouncer ever checked his black book.
6. Three new technicians need WinBox access next week. With this lab's setup, what do you change?
- Add three new accept rules
- Add three entries to the list allowed
- Remove the drop rule for 8291
- Add the technicians to the list blocked
The rules already say "accept WinBox from the list allowed". New people only need new entries
in that list; the rules stay the same.
7. A dynamic entry in the blocked list has a 10-minute timeout. Which two statements are true?
- The entry disappears by itself after 10 minutes
- The entry is saved forever in the configuration
- The entry is created by a firewall rule, not by hand
- The entry blocks the address on every router of the class
Dynamic entries (flag D) are created by the firewall and removed when their timeout expires. They only exist on this router.
The bouncer now has a guest list and a black book, but he forgets who he turned away. In 06-04 · Firewall logging you give him a notebook.