Wired LAN with RouterOS¶

Practical 3.4 wired-lan-with-routeros-annex.pdf · PDF

At home you plug a cable into the router and, a second later, you are online. You never typed an address. You never chose a DNS server. Somebody did all of that for you, years ago, in a factory. Today that somebody is you.

Last session your group cabled its LAN. The link lights came on... and nothing worked. A blank MikroTik does not hand out addresses, does not answer names, and does not even pass traffic from one port to the next. By the end of this page you will know the four pieces that turn a box of ports into a working LAN, and how to build them on RouterOS, MikroTik's operating system.

What a LAN needs: four pieces¶

Think about what the router at home does without you noticing. It has done four jobs since the day it was switched on:

A MikroTik with no configuration has none of them. You will add them in this order, because each one needs the one before.

flowchart LR
    B["<b>1 · Bridge</b><br>the corridor that<br>joins the rooms"] --> A["<b>2 · Address</b><br>10.G.0.1/24<br>on the bridge"]
    A --> D["<b>3 · DHCP server</b><br>hands out addresses<br>from the pool"]
    D --> N["<b>4 · DNS</b><br>answers names<br>for the LAN"]

The bridge: a switch inside the router¶

A bridge is a software switch inside the router: it joins several ports into one LAN.

Picture a blank MikroTik as a house with five separate rooms and no doors between them. Each port (ether1 to ether5) is a room. A PC in room ether2 cannot reach a PC in room ether3: nothing passes.

The bridge is the corridor that joins the rooms. Once ether2 to ether5 open onto the corridor, anything said in one room can reach the others. The bridge learns which MAC address lives behind which port, exactly like the switch you met in Ethernet, MAC and switching.

flowchart TB
    subgraph BEFORE ["Blank router: five separate rooms"]
        direction LR
        E2a["ether2"]
        E3a["ether3"]
        E4a["ether4"]
        E5a["ether5"]
    end
    subgraph AFTER ["With a bridge: one corridor"]
        direction LR
        BR["<b>bridge-lan</b><br>the corridor<br>10.G.0.1/24"]
        E2b["ether2"] --- BR
        E3b["ether3"] --- BR
        E4b["ether4"] --- BR
        E5b["ether5"] --- BR
    end
    BEFORE -->|"add the ports<br>to the bridge"| AFTER

Where the router's address goes¶

The router needs an address inside the LAN so the PCs can talk to it. Where do you put it? On the bridge, not on one port.

If you put 10.G.0.1/24 on ether2, only the room ether2 can reach the router. Put it on the corridor, and every room can. In the house picture, the reception desk belongs in the corridor, not inside one bedroom.

The address plan¶

Your group's LAN is 10.G.0.0/24, where G is your group number (1 to 8). A /24 has 254 usable addresses. You do not hand them all out automatically: you split them by job.

A DHCP pool is the range of addresses the DHCP server is allowed to hand out automatically.

Why not give the whole /24 to the pool? Because the router's own address and the fixed ones would collide with a lease: two devices with the same address, and neither works well.

Building it in WinBox¶

Your group does this on the real router, taking turns. These are the steps of Part A of the Exercise sheet (Practical 3.4), with G = 3 as the example.

1. Reset. System → Reset Configuration, tick No Default Configuration. WinBox loses the router (it has no address any more). Reconnect from Neighbors by clicking the MAC address, user admin.
2. Name and password. System → Identity: G3-router. System → Password.
3. Bridge. Bridge → Bridge tab → +, name bridge-lan. Then the Ports tab → + once per port, ether2 to ether5.
4. Address. IP → Addresses → +: 10.3.0.1/24, interface bridge-lan.
5. DHCP server. IP → DHCP Server → DHCP Setup: interface bridge-lan · network 10.3.0.0/24 · gateway 10.3.0.1 · addresses 10.3.0.100-10.3.0.199 · DNS 10.3.0.1 · lease time 30m.
6. DNS. IP → DNS, tick Allow Remote Requests. Static → +: name gw.tramuntana.internal, address 10.3.0.1.
7. A fixed address for one PC. IP → DHCP Server → Leases → right-click a lease → Make Static.

Step 6 makes the router answer DNS questions from the LAN. Without Allow Remote Requests, it only resolves names for itself. The static entry is a name you invent for your own network: gw.tramuntana.internal now means "the router".

A static lease ties one MAC address to one address in the DHCP server.

Checking from a PC¶

A configuration that nobody verified is not a configuration. Unplug your cable, plug it back in (so the PC asks for a new lease), and run:

ip -br address          # enp3s0  UP  10.3.0.199/24 ...
ip route                # default via 10.3.0.1 dev enp3s0 proto dhcp ...
ping -c 3 10.3.0.1
ping -c 3 10.3.0.198    # the PC of a classmate
dig +short gw.tramuntana.internal

What each line proves:

On the router you can look from the other side:

/ip dhcp-server lease print
/interface bridge host print

The first shows one lease per PC, status bound. The second is the bridge's MAC table: which MAC lives behind which port. It is the switch's table, inside the router.

When it does not work¶

The same thing as text: the CLI¶

Everything you clicked in WinBox has a path in the CLI (command-line interface). IP → Addresses becomes /ip address. In any menu, four verbs do almost everything:

Press Tab to complete a word and ? to list what can come next.

The DHCP Setup wizard hid three separate things. Typed by hand they are:

/ip pool add name=pool-lan ranges=10.3.0.100-10.3.0.199
/ip dhcp-server add name=dhcp-lan interface=bridge-lan address-pool=pool-lan disabled=no
/ip dhcp-server network add address=10.3.0.0/24 gateway=10.3.0.1 dns-server=10.3.0.1

Pool = which addresses. Server = on which interface. Network = what else to tell the client.

The whole LAN, in nine lines (this is Part B of the Exercise sheet, in the virtual lab, where the router has only ether2 and ether3 for PCs):

/interface bridge add name=bridge-lan
/interface bridge port add bridge=bridge-lan interface=ether2
/interface bridge port add bridge=bridge-lan interface=ether3
/ip address add address=10.3.0.1/24 interface=bridge-lan
/ip pool add name=pool-lan ranges=10.3.0.100-10.3.0.199
/ip dhcp-server add name=dhcp-lan interface=bridge-lan address-pool=pool-lan disabled=no
/ip dhcp-server network add address=10.3.0.0/24 gateway=10.3.0.1 dns-server=10.3.0.1
/ip dns set allow-remote-requests=yes
/ip dns static add name=gw.tramuntana.internal address=10.3.0.1

Watching DORA happen¶

On a lab PC, ask for a lease with dhclient -v:

dhclient -v eth1

It prints the four DHCP messages live: DHCPDISCOVER, DHCPOFFER of 10.3.0.199 from 10.3.0.1, DHCPREQUEST, DHCPACK, and then bound to 10.3.0.199. That is the DORA exchange from DHCP and DNS, happening in front of you. The Offer and the Ack come from the router.

Saving your work: /export¶

/export prints the router's whole configuration as the list of commands that would rebuild it.

/export
/export file=g3-0903

The first form prints it on screen. The second saves it on the router as g3-0903.rsc (find it in Files in WinBox and drag it to your PC). Read it: every line is one of the steps you did.

A text file can be read, compared and pasted into a report. That is why professionals prefer it to screenshots.

Key takeaways¶

• A LAN needs four pieces: a bridge, an address, a DHCP server and DNS, in that order.
• On a blank MikroTik every port is a separate network; a bridge is the software switch that joins them.
• The router's LAN address (10.G.0.1/24) goes on the bridge, so every port can reach it.
• A DHCP server has a pool (which addresses), an interface (where) and a network (gateway and DNS to tell the client). A static lease always gives one MAC the same address.
• DHCP gives address, mask, gateway and DNS, not internet.
• /export turns the configuration into readable commands; /system backup save makes the binary backup.

Quick check¶

Next: split the LAN so the dev and design departments get their own networks on the same router — VLANs.