In MikroTik RouterOS (and in routing in general), the "distance" value determines the priority of a route. The route with the lowest distance will be preferred.
Here:
Route to 0.0.0.0/0 via 1.1.1.1 has distance = 10
Route to 0.0.0.0/0 via 2.2.2.2 has distance = 5 → lower, so preferred✅
Unless the lower-distance route is invalid or unreachable, it will always be selected.
MTCNA Course Manual – Static Routing:
“The lower the distance value, the higher the route’s priority. Routes are selected based on administrative distance first.”
René Meneses Study Guide – Route Distance:
“A route with distance 1 is preferred over a route with distance 2. It does not matter which was added first.”
Terry Combs Notes – Routing Behavior:
“RouterOS evaluates the distance (priority) before anything else. Smallest value wins.”
Answer: AQUESTION NO: 44 [Firewall]
What does the firewall action "Redirect" do? Select all true statements.
A. Redirects a packet to a specified port on the router
B. Redirects a packet to a specified IP
C. Redirects a packet to the router
D. Redirects a packet to a specified port on a host in the network
Answer: A, C
The redirect action in MikroTik’s NAT firewall rules is used to force traffic (usually from LAN clients) to a local service on the router — for example, redirecting all DNS queries to the router’s DNS server, or forcing web traffic to a proxy.
Details:
It changes the destination IP to the router's IP automatically (without needing to specify it)
It also allows port redirection (e.g., dst-port=80 → to 3128 for proxy)
Evaluation:
A.✅True — You can redirect to a specific port on the router
B.❌False — Redirect does not change destination IP to an arbitrary host; for that, use dst-nat
C.✅True — Redirect forces traffic to the router itself
D.❌False — dst-nat is used to forward packets to internal hosts, not redirect
MTCNA Course Manual – NAT Actions:
“Redirect action changes destination to the router itself. This is useful for forcing traffic through router services.”
René Meneses Guide – NAT Behavior:
“Redirect = router-local services like DNS or proxy. Use dst-nat for remote hosts.”
Terry Combs Notes – Firewall Actions:
“Use redirect when you want to intercept traffic and handle it locally on the router.”
Answer: A, CQUESTION NO: 45 [PPP / Tunnels]
Which port does PPTP use by default?
A. TCP 1721
B. UDP 1723
C. TCP 1723
D. UDP 1721
Answer: C
PPTP (Point-to-Point Tunneling Protocol) uses:
TCP port 1723 for control and session initiation
GRE (Generic Routing Encapsulation) protocol (protocol number 47) for tunneling
No UDP port is used by PPTP.
Evaluation:
A. TCP 1721 →❌Invalid port
B. UDP 1723 →❌Incorrect protocol (TCP is used, not UDP)
C.✅TCP 1723 → Correct
D.❌Invalid (wrong protocol and port)
MTCNA Tunneling Section – PPTP Overview:
“PPTP uses TCP port 1723 for control and GRE protocol for tunneling traffic.”
René Meneses MTCNA Guide – PPTP Characteristics:
“PPTP = TCP/1723 + GRE (not a port, but a protocol). Allow both on firewall.”
Terry Combs Notes – VPN Protocol Reference:
“PPTP: TCP 1723. GRE must be permitted for tunnel data.”
Answer: CQUESTION NO: 46 [Firewall]
Which firewall chain should you use to filter ICMP packets from the router itself?
A. input
B. postrouting
C. forward
D. output
Answer: D
MikroTik RouterOS uses firewall chains to process packets based on direction:
input: For packets destined to the router itself (from outside)
output: For packets originating from the router (e.g., router pings)
forward: For packets passing through the router between interfaces
postrouting: Used for NAT and marking, not filtering
Therefore:
To block/allow ICMP (ping) generated by the router (e.g., netwatch, DNS probes), use the output chain
To block incoming pings to the router, use input
To block pings between LAN and WAN, use forward
MTCNA Firewall Module – Chain Responsibilities:
“To control traffic originating from the router itself, use the output chain. For example, when the router itself sends ICMP requests.”
René Meneses Guide – Firewall Chains Explained:
“output is for locally generated traffic. input is for inbound traffic to the router.”
Terry Combs Notes – Chain Use Cases:
“Ping from router = output. Ping to router = input. Ping between networks = forward.”
