TOP 10 RouterOS configuration mistakes - MikroTik · PDF filePresenter –Andis Arins andis[at]router.lv 2 MikroTik Consultant at MikroTik/ Microsoftcertified trainer Member of the

TOP10 RouterOS configuration mistakes

Presenter – Andis Arins

andis[at]router.lv

www.linkedin.com/in/andisarins

2

� MikroTik Consultant at

� MikroTik / Microsoft certified trainer

� Member of the board in Latvian Internet Association

� Review expert for EU in future networking research

MUM USA, Dallas 2016.04.28 Andis Arins / WISP TRACON | router.lv

/

3


10

The same IP on multiple interfaces

4



5



survival strategy: MAC telnet or

connection from different network

6


9

Lack of monitoring

7


Lack of monitoring

� What is the health of my router?

� Is it reachable from everywhere it should?

� Isn’t it overloaded ?

8


Lack of monitoring

9


Lack of monitoring

IP - SNMP

/snmp> send-trap

for proactive

action

10


Lack of monitoring

The Dude

you can monitor and

manage your devices

new features sinceRouterOS 6.34

11


Lack of monitoring

tools-

netwatch

12


Lack of monitoring

tools-

Traffic monitor

13


Lack of monitoring

IP- Traffic Flow

14


Lack of monitoring

Also HA solutions without monitoring may fail one day

VRRP for 99.9%+

availability

0.365 days or

8.76 hours

down in year

15


8

DNS issues

16


DNS issues

Many requests from

spoofed IPs

VICTIM

17


DNS issues

10.0.0.0/24

18


7

Firewall inefficiency

19


Firewall inefficiency

internet 123.123.123.123

webserver

20


6

NAT issues

21


NAT issues

10.0.0.0/24 123.123.123.123

159.148.147.196

src-ip: 10.0.0.10

dst-ip: 159.148.147.196NAT

masquarade

src-ip: 10.0.0.10

src-ip: 123.123.123.123

dst-ip: 159.148.147.196

22


NAT issues

10.0.0.0/2410.1.1.0/24

10.1.1.0/24

123.123.123.0/24

bad

ok

ok

23


NAT issues

10.0.0.0/24 192.168.0.0/24

IPSec

24


5

Allowed IP Spoofing

25


Allowed IP Spoofing

10.0.0.0/24 123.123.123.123

src-ip: 13.13.13.13

dst-ip: 159.148.147.196 ? 1. routing decision

2. firewall decision

26


Allowed IP Spoofing

Tools- Traffic Generator

27


Allowed IP Spoofing

https://spoofer.caida.org/Test your network

http://ieeexplore.ieee.org/

28


Allowed IP Spoofing

10.0.0.0/24

src-ip: 13.13.13.13

dst-ip: 159.148.147.196 X routing

decision

29


4

Bridge issues

30


Bridge issues

31


Bridge issues

wanlan

bridge

master slave slave slave

32


Bridge issues

bridge-lan

DHCP-Server on individual port, not on bridge itself

33


3

PoE issues

34


PoE issues

Mikrotik PoE standart

(4,5pin +) (7,8pin -)

Hello from DC !!!

35


PoE issues

eth1

PoE in

DC adaper

data,power 2

DC power 1

36


2

Waiting for hackers

37


Waiting for hackers

Dude (if installed ) port 2211

38


Waiting for hackers

39


Waiting for hackers

MAC telnet/winbox server on all interfaces

default configuration allows MAC access only from initial bridge

40


1

Try to Guess …

41


admin / no password

42


admin / no password


That’s it!

Documents

TOP 10 RouterOS configuration mistakes - MikroTik · PDF filePresenter –Andis Arins andis[at]router.lv 2 MikroTik Consultant at MikroTik/ Microsoftcertified trainer Member of the