Skip to content

P01-T04 - Interface Lists and Foundation Services

Objective

Prepare HQ-CHR01 for NAT and firewall enforcement by creating authoritative interface lists, enabling only the minimum foundation services, and keeping administrative exposure controlled before Windows services are introduced.

Validated lab status

Validated against the live lab on Friday, July 17, 2026:

  • interface lists WAN, LAN, MGMT, SERVERS, WORKSTATIONS, PRINTERS, VOICE, CORPWIFI, GUEST, DMZ, BACKUP, HYPERVISORS, and BUILD exist in the validated foundation
  • router DNS is set to 1.1.1.1,9.9.9.9
  • NTP client is enabled with time.cloudflare.com and time.google.com
  • administration from VLAN100 was validated through the deployed firewall policy
  • RouterOS management service hardening was identified as a required day-zero control and is documented below as an execution step
  • the CONTAINERS interface list is added later only when P01-T10 is in scope

Inputs

Key Value
Router HQ-CHR01
WAN interface ether1
Trunk interface ether2
Management VLAN vlan10-mgmt
Hypervisor VLAN vlan100-hypervisor
Build VLAN vlan110-build

Target State

Property Value
Interface lists WAN, LAN, MGMT, SERVERS, WORKSTATIONS, PRINTERS, VOICE, CORPWIFI, GUEST, DMZ, BACKUP, HYPERVISORS, BUILD
DNS for router External resolvers configured
NTP Time synchronized
Admin exposure No broad admin access from WAN or BUILD

Prechecks

  • Complete P01-T03.
  • Confirm all VLAN interfaces exist and are addressed correctly.
  • Confirm ether1 is the WAN side and ether2 is the LAN trunk.

Execution

  1. Create the interface lists if they do not already exist:
:foreach listName in={"WAN";"LAN";"MGMT";"SERVERS";"WORKSTATIONS";"PRINTERS";"VOICE";"CORPWIFI";"GUEST";"DMZ";"BACKUP";"HYPERVISORS";"BUILD"} do={
    :if ([:len [/interface list find where name=$listName]] = 0) do={
        /interface list add name=$listName
    }
}
  1. Add interfaces to the correct lists:
:if ([:len [/interface list member find where list="WAN" and interface="ether1"]] = 0) do={ /interface list member add list=WAN interface=ether1 }

:if ([:len [/interface list member find where list="LAN" and interface="vlan10-mgmt"]] = 0) do={ /interface list member add list=LAN interface=vlan10-mgmt }
:if ([:len [/interface list member find where list="LAN" and interface="vlan20-servers"]] = 0) do={ /interface list member add list=LAN interface=vlan20-servers }
:if ([:len [/interface list member find where list="LAN" and interface="vlan30-workstations"]] = 0) do={ /interface list member add list=LAN interface=vlan30-workstations }
:if ([:len [/interface list member find where list="LAN" and interface="vlan40-printers"]] = 0) do={ /interface list member add list=LAN interface=vlan40-printers }
:if ([:len [/interface list member find where list="LAN" and interface="vlan50-voice"]] = 0) do={ /interface list member add list=LAN interface=vlan50-voice }
:if ([:len [/interface list member find where list="LAN" and interface="vlan60-corpwifi"]] = 0) do={ /interface list member add list=LAN interface=vlan60-corpwifi }
:if ([:len [/interface list member find where list="LAN" and interface="vlan70-guestwifi"]] = 0) do={ /interface list member add list=LAN interface=vlan70-guestwifi }
:if ([:len [/interface list member find where list="LAN" and interface="vlan80-dmz"]] = 0) do={ /interface list member add list=LAN interface=vlan80-dmz }
:if ([:len [/interface list member find where list="LAN" and interface="vlan90-backup"]] = 0) do={ /interface list member add list=LAN interface=vlan90-backup }
:if ([:len [/interface list member find where list="LAN" and interface="vlan100-hypervisor"]] = 0) do={ /interface list member add list=LAN interface=vlan100-hypervisor }
:if ([:len [/interface list member find where list="LAN" and interface="vlan110-build"]] = 0) do={ /interface list member add list=LAN interface=vlan110-build }

:if ([:len [/interface list member find where list="MGMT" and interface="vlan10-mgmt"]] = 0) do={ /interface list member add list=MGMT interface=vlan10-mgmt }
:if ([:len [/interface list member find where list="SERVERS" and interface="vlan20-servers"]] = 0) do={ /interface list member add list=SERVERS interface=vlan20-servers }
:if ([:len [/interface list member find where list="WORKSTATIONS" and interface="vlan30-workstations"]] = 0) do={ /interface list member add list=WORKSTATIONS interface=vlan30-workstations }
:if ([:len [/interface list member find where list="PRINTERS" and interface="vlan40-printers"]] = 0) do={ /interface list member add list=PRINTERS interface=vlan40-printers }
:if ([:len [/interface list member find where list="VOICE" and interface="vlan50-voice"]] = 0) do={ /interface list member add list=VOICE interface=vlan50-voice }
:if ([:len [/interface list member find where list="CORPWIFI" and interface="vlan60-corpwifi"]] = 0) do={ /interface list member add list=CORPWIFI interface=vlan60-corpwifi }
:if ([:len [/interface list member find where list="GUEST" and interface="vlan70-guestwifi"]] = 0) do={ /interface list member add list=GUEST interface=vlan70-guestwifi }
:if ([:len [/interface list member find where list="DMZ" and interface="vlan80-dmz"]] = 0) do={ /interface list member add list=DMZ interface=vlan80-dmz }
:if ([:len [/interface list member find where list="BACKUP" and interface="vlan90-backup"]] = 0) do={ /interface list member add list=BACKUP interface=vlan90-backup }
:if ([:len [/interface list member find where list="HYPERVISORS" and interface="vlan100-hypervisor"]] = 0) do={ /interface list member add list=HYPERVISORS interface=vlan100-hypervisor }
:if ([:len [/interface list member find where list="BUILD" and interface="vlan110-build"]] = 0) do={ /interface list member add list=BUILD interface=vlan110-build }
  1. Configure router DNS and allow remote requests only if you explicitly want the router to answer DNS for downstream clients later. For the base lab, keep the router using external resolvers for its own lookups:
/ip dns set servers=1.1.1.1,9.9.9.9 allow-remote-requests=no
  1. Configure time synchronization:
/system ntp client set enabled=yes mode=unicast servers=time.cloudflare.com,time.google.com

  1. Reduce unnecessary administrative exposure. At minimum, keep WAN closed and do not add BUILD to any admin-allowed list.

  2. Harden RouterOS management services.

Validated deploy evidence showed the router was reachable through firewall policy, but /ip service print still exposed unused services unless they were explicitly disabled or restricted. Do not leave this implicit.

Minimum day-zero hardening:

/ip service
set telnet disabled=yes
set ftp disabled=yes
set www disabled=yes
set www-ssl disabled=yes
set api disabled=yes
set api-ssl disabled=yes

If SSH or WinBox must remain enabled, restrict them to management sources only during the same change window.

Example management source restriction aligned with the validated lab model:

/ip service
set ssh address=172.20.10.0/24,172.20.100.0/24
set winbox address=172.20.10.0/24,172.20.100.0/24

If VLAN10 is not in active use yet, restrict at least to 172.20.100.0/24 until the final management model is in place.

Validation

  • /interface list print shows all required lists.
  • /interface list member print shows each VLAN in the expected list.
  • /ip dns print shows the configured resolvers.
  • /system ntp client print shows the client enabled.
  • BUILD exists only for staging traffic, not for router administration.
  • /ip service print shows unused services disabled or restricted intentionally.

Evidence

  • Output of /interface list print
  • Output of /interface list member print
  • Output of /ip dns print
  • Output of /system ntp client print
  • Output of /ip service print

Rollback

  • Remove incorrect list memberships individually.
  • Do not delete working lists unless the entire interface taxonomy is being rebuilt.