Skip to content

P01-T02 - RouterOS Baseline

Objective

Establish the first approved RouterOS runtime baseline after the clone is created, so WAN reachability and router identity are confirmed before VLAN, NAT, firewall, or Windows service flows depend on the router.

Validated lab status

Validated against the live lab on Friday, July 17, 2026:

  • HQ-CHR01 bootstrapped successfully from rw/autorun.scr
  • the runtime router kept the expected ether1 WAN and ether2 trunk model
  • static WAN addressing on 172.31.255.2/30 was active
  • the default route to 172.31.255.1 was active
  • router DNS and outbound internet access were validated with live pings
  • bidirectional reachability between HQ-CHR01 and HQ-DC01 was validated later in the same deploy

Inputs

Key Value
Node H1
VMID 4010
Hostname HQ-CHR01
WAN bridge GEILWAN
LAN bridge GEILLAN
WAN IP 172.31.255.2/30
WAN gateway 172.31.255.1
Hypervisor validation IP 172.20.100.11/24

Target State

Property Value
Identity HQ-CHR01
Time zone America/Santo_Domingo
WAN interface ether1
LAN interface ether2
WAN addressing model Static
Default route 0.0.0.0/0 -> 172.31.255.1

Prechecks

  • Confirm qm status 4010 returns running.
  • Confirm qm config 4010 still shows net0 on GEILWAN and net1 on GEILLAN.
  • Confirm P01-T01 injected rw/autorun.scr into the runtime clone, not into the template.
  • Use a stable RouterOS console session for the first interactive login.
  • Confirm no firewall or NAT rules are assumed at this stage.
  • Treat qm guest exec support in RouterOS as non-authoritative even if the guest agent pings successfully.

Execution

  1. Verify clean state:

This block confirms what the router actually looks like after the first-boot bootstrap, before any additional baseline changes are layered on top.

/system resource print
/system package print
/interface print
/ip dhcp-client print detail
/ip address print
/ip route print
/system identity print
/system clock print
  1. Set identity:

Use this only if the first-boot bootstrap did not already leave the router with the expected identity.

/system identity set name=HQ-CHR01
  1. Set time zone:

Use this only if the first-boot bootstrap did not already leave the router in the expected time zone.

/system clock set time-zone-name=America/Santo_Domingo
  1. Remove any leftover DHCP client from ether1.

This block prevents the router from mixing static WAN state with a stray DHCP client.

For this lab, WAN is static. Do not leave a DHCP client attached to ether1, even if it is only in searching... state.

/ip dhcp-client remove [find where interface=ether1]
  1. Configure WAN:

This block defines the day-zero WAN identity used by the rest of the lab.

/ip address add address=172.31.255.2/30 interface=ether1 comment=WAN
/ip route add dst-address=0.0.0.0/0 gateway=172.31.255.1 comment=Default
  1. Validate basic reachability:

This block proves the router has a usable WAN path before more configuration is layered on top.

/ip dhcp-client print detail
/ping 172.31.255.1 count=5
/ping 1.1.1.1 count=5

Validation

  • qm guest cmd 4010 get-host-name should eventually reflect HQ-CHR01 after the bootstrap and a subsequent reboot if needed.
  • ether1 and ether2 show running.
  • No DHCP client remains on ether1.
  • 172.31.255.1 responds from CHR if upstream allows it.
  • 1.1.1.1 responds from CHR.
  • Default route is present.
  • Router identity and time zone match target state.

Evidence

  • Output of qm guest cmd 4010 get-host-name
  • Output of /ip address print.
  • Output of /ip dhcp-client print detail.
  • Output of /ip route print.
  • Output of /system identity print.
  • Output of /system clock print.
  • Output of /ping 1.1.1.1.
  • Screenshot of serial console only if handoff requires it.

Rollback

  • Recreate the WAN IP and default route after removing any accidental DHCP client if the wrong values were applied.
  • Restore from the last known clean backup before proceeding to VLAN creation.