Configuring is easy; fixing someone else's mess at 2am is the actual job. This lab plants seven realistic faults across a RouterOS network and hands them to you as support tickets — the exact bugs that recur on real MikroTik sites, and the diagnostic command that finds each one. The twin of the Cisco broken-campus lab.
Every fault below is one I've genuinely fixed on a live RouterOS box, dressed as a ticket. The value isn't the answer — it's the method: a symptom points at a layer, and one targeted command confirms or clears it. Work bottom-up (link → L2 → L3 → NAT/firewall → routing) and you converge fast; guess randomly and you're there all night. Build the network from the earlier labs, have a colleague break it, then work these.
The recurring theme on MikroTik specifically: the bridge does most L2 work and has non-obvious rules (VLAN filtering, PVID, hardware offload), and the connection-tracking / routing-mark model behind NAT and policy routing hides state you have to think about. These are the same categories the Cisco broken-campus lab plants, expressed in RouterOS's idioms.
01
Guests get no DHCP and can't ping the gateway; other VLANs are fine. Smells like Layer 2 on that one VLAN.
> /interface bridge vlan print vlan-ids=20 bridge=bridge tagged=ether1 untagged= # the guest access port is MISSING # Root cause: the guest access port was never added to VLAN 20's untagged # list (and/or its PVID isn't 20). With vlan-filtering=yes the bridge drops # frames on a port not in the VLAN's member list. > /interface bridge vlan set [find vlan-ids=20] untagged=ether5 > /interface bridge port set [find interface=ether5] pvid=20
02
Staff browse fine; the new sales VLAN gets a DHCP lease and can ping the router but not the internet. Classic NAT scope.
> /ip firewall nat print chain=srcnat action=masquerade src-address=10.10.0.0/24 out-interface-list=WAN # Root cause: masquerade is scoped to ONE subnet (10.10.0.0/24), not the # sales subnet (10.10.30.0/24). Old copy-paste rule never generalised. > /ip firewall nat set [find action=masquerade] src-address="" # Better: masquerade by out-interface-list=WAN for any internal source.
03
Two routers, cabled and pingable across the link, but the OSPF neighbour never reaches Full — it sits in Exchange/Loading. The signature of one specific fault.
> /routing ospf neighbor print state=Exchange ... # stuck here = almost always MTU > /interface ethernet print where name=ether2 # mtu=1480 one side, 1500 other # Root cause: MTU mismatch. OSPF exchanges DBD packets that include the # MTU; a mismatch stalls the adjacency at Exchange. Match both ends. > /interface ethernet set ether2 mtu=1500
04
No client gets an address. Someone "tidied up" the bridge yesterday. The server exists and is enabled — so it's bound wrong.
> /ip dhcp-server print name=LAN-DHCP interface=ether2 ... # bound to a PHYSICAL port, not the bridge # Root cause: the LAN was moved into a bridge, but the DHCP server is still # bound to ether2. Clients live on the bridge broadcast domain; the server # on a single port no longer hears their DISCOVERs. > /ip dhcp-server set LAN-DHCP interface=bridge
05
A new rule to block a host's internet is in place but the host still browses. The rule looks correct in isolation — so it's ordering or fast-path.
> /ip firewall filter print stats 0 chain=forward action=fasttrack-connection connection-state=established,related ... 8 chain=forward action=drop src-address=10.10.0.66 bytes=0 # never hit # Root cause: a fasttrack rule above sends established/related flows down the # fast path, bypassing later rules. The host's existing connections skip the # drop. Put the drop ABOVE fasttrack, and flush the host's connections. > /ip firewall connection remove [find src-address~"10.10.0.66"]
06
Policy-routed dual-WAN, but some sessions fail intermittently — logins bounce, downloads reset. The signature of a flow leaving by two paths.
> /ip firewall mangle print chain=prerouting action=mark-routing new-routing-mark=via-B protocol=tcp dst-port=443 # Root cause: routing-mark is applied PER PACKET on a match, with no # connection-mark. Return/other packets of the same flow miss the match and # take the other WAN -> asymmetric, stateful NAT breaks. Mark the CONNECTION # first, then derive the routing-mark from it (see the policy-routing post).
07
Throughput tanked and CPU is maxed on a box that used to switch at line rate. Something turned off hardware offload.
> /interface bridge port print # INTERFACE BRIDGE HW ... 0 ether2 bridge no # H(ardware) offload OFF — traffic hits the CPU > /interface bridge print dhcp-snooping=yes ... # root cause: enabling snooping dropped offload on this chip # Fix: decide per box — keep snooping and accept CPU switching on a small # router, or disable the feature that costs offload on a high-throughput core.
Takeaways
/interface bridge vlan print.NOCTIS untangles and stabilises RouterOS and Cisco networks across Crete — methodical fault-finding, documentation, and the fixes that stop the 2am calls.
Book a Discovery Call →