CloudLabBox
Try the free demo

MikroTik MTCNA practice labs

19 guided labs on RouterOS 7 that follow every hands-on module of the MTCNA training outline: first access and the CLI, users and services, Internet access, DHCP and ARP, backups and upgrades, bridging and RSTP, VLAN filtering, static routing, firewall and NAT, queues and PCQ, PPPoE, tunnels, WireGuard and the monitoring tools, finished with two troubleshooting labs and a branch-office capstone.

Start this courseTry it free for 30 minutes

Lite for a month, £45.00, runs every lab here, with nothing extra to pay for the guided labs. Every lab here also runs in the free demo.

Guided labs
19
Follows
MikroTik MTCNA, on RouterOS v7
Runs every lab
Lite
Devices
RouterOS, Alpine Linux, EVE-NG GUI server and VPCS

Who these labs are for

For anyone preparing for the MTCNA course and exam, and engineers who look after MikroTik routers at a small business, school or ISP. You need basic TCP/IP and subnetting; no MikroTik experience is assumed.

The routers are MikroTik CHR, which has no radio or switch chip, so wireless is a reading section rather than a lab. Without a paid licence CHR limits each interface to about 1 Mbit/s, so the queue limits sit below that.

The 19 labs

Every lab in the folder, as the workspace lists them, with what each runs and the smallest plan that fits. Read on 2 November 2026.

MTCNA course 19 labs

Shared folderMikroTik MTCNA RouterOS v7 guided labs

One MTCNA module per lab, then two troubleshooting labs and a branch office built from scratch.

  1. 01First access and the RouterOS command line

    Log in to a brand-new RouterOS 7 router, learn the command line you will use in every other lab, give the router a name, a clock and a LAN address, then manage it from a browser with WebFig.

    1× RouterOS, 1× EVE-NG GUI server, 1× VPCS

    3 vCPU, 3,328 MBFits LiteRuns in the free demo

  2. 02Users services and secure management access

    Give each administrator their own account with the right rights, switch off the management services nobody needs, and allow SSH, WinBox and MAC access only from the IT network.

    2× Alpine Linux, 1× RouterOS

    3 vCPU, 1,280 MBFits LiteRuns in the free demo

  3. 03Connect an office to the Internet

    Build the classic small-office set-up by hand: a DHCP client on the WAN, a LAN bridge with a DHCP server, the router as DNS cache, and NAT masquerade so the office PCs reach the Internet.

    2× RouterOS, 2× VPCS

    4 vCPU, 2,560 MBFits LiteRuns in the free demo

  4. 04DHCP server in depth and ARP

    Run a working DHCP server like a professional: read and manage leases, hand out extra options, reserve an address for a printer, and use ARP reply-only so only devices that got their address from DHCP can use the network.

    1× Alpine Linux, 1× RouterOS, 2× VPCS

    4 vCPU, 2,816 MBFits LiteRuns in the free demo

  5. 05Backups exports upgrades and recovery

    Protect a router's configuration the way a support team does: readable exports and encrypted binary backups, copied off the router, restored when something is deleted, and taken automatically every night. Then look at packages, update channels, resets and Netinstall.

    2× RouterOS

    2 vCPU, 512 MBFits LiteRuns in the free demo

  6. 06Bridging MAC learning and RSTP

    Turn three RouterOS devices into switches with bridges, watch them learn MAC addresses, and let RSTP break the loop in a ring of links: choose the root bridge, find the blocked port, protect the edge ports, and test a link failure. Ends with a reading section on RouterOS wireless.

    3× RouterOS, 2× VPCS

    5 vCPU, 2,816 MBFits LiteRuns in the free demo

  7. 07VLANs with bridge VLAN filtering

    Split one switched network into staff, guest and management VLANs the RouterOS 7 way: one bridge per switch, access and trunk ports with PVID and frame types, the bridge VLAN table, VLAN filtering switched on last, and a router-on-a-stick for routing between VLANs.

    3× RouterOS, 3× VPCS

    6 vCPU, 3,840 MBFits LiteRuns in the free demo

  8. 08Static routing

    Connect three sites with static routes: read the RouterOS 7 routing table and its flags, add routes to remote networks, use a default route with a more specific exception, and add a backup route with a higher distance, then find out why a backup must work in both directions.

    3× RouterOS, 3× VPCS

    6 vCPU, 3,840 MBFits LiteRuns in the free demo

  9. 09Firewall - protect the router

    Close an Internet-facing router: see what an outsider can reach, then build the input chain rule by rule with connection tracking, an address list for administrators, logging and counters, and prove the result from outside and inside.

    2× Alpine Linux, 2× RouterOS, 1× VPCS

    5 vCPU, 2,560 MBFits LiteRuns in the free demo

  10. 10Firewall - protect the customers address lists and FastTrack

    Protect the networks behind the router: prove that NAT is not a firewall, build the forward chain the way RouterOS's default configuration does, keep guests away from staff, block sites with an address list, and see what FastTrack does.

    2× RouterOS, 1× Alpine Linux, 2× VPCS

    5 vCPU, 3,072 MBFits LiteRuns in the free demo

  11. 11NAT - src-nat masquerade port forwarding 1 -1 NAT redirect and hairpin

    Publish an internal web server to the Internet with a port forward and a 1:1 NAT address, use src-nat instead of masquerade on a static WAN, force every DNS query through the router with redirect, and make the public address work from inside with hairpin NAT.

    3× Alpine Linux, 2× RouterOS

    5 vCPU, 2,048 MBFits LiteRuns in the free demo

  12. 12QoS - simple queues burst and PCQ

    Measure real throughput with iperf, cap one user with a simple queue, find out why FastTrack makes the queue do nothing, add burst, and then share the line fairly between every user with one PCQ queue.

    3× Alpine Linux, 1× RouterOS

    4 vCPU, 1,792 MBFits LiteRuns in the free demo

  13. 13PPPoE - access server and customer routers

    Build a small ISP access network: an IP pool, a PPP profile with DNS and a speed limit, customer accounts (one with a fixed address), a PPPoE server, and two customer routers that dial in, get point-to-point addresses and a default route, and NAT their LAN.

    3× RouterOS, 1× VPCS

    4 vCPU, 1,792 MBFits LiteRuns in the free demo

  14. 14Tunnels - IPIP GRE and EoIP

    Join two sites across the Internet three ways: an IPIP tunnel and a GRE tunnel with keepalive carrying routed traffic (with automatic fail-over between them), and an EoIP tunnel that stretches the head-office LAN to a shop at layer 2, encrypted with IPsec.

    3× RouterOS, 3× VPCS

    6 vCPU, 3,840 MBFits LiteRuns in the free demo

  15. 15WireGuard - site-to-site and remote access

    Build RouterOS 7's modern VPN: a WireGuard hub at head office with a branch router and a travelling laptop as peers, keys exchanged by hand, allowed addresses doing the routing policy, routes for the remote LANs and a firewall hole for the tunnel.

    4× RouterOS, 2× VPCS

    6 vCPU, 3,072 MBFits LiteRuns in the free demo

  16. 16Monitoring and troubleshooting tools

    Use RouterOS's own toolbox on a router that is misbehaving: ping and traceroute with options, interface statistics, Torch to find a mystery traffic source, the profiler, the packet sniffer, netwatch, remote syslog, SNMP and a support file.

    2× RouterOS, 1× Alpine Linux, 1× VPCS

    4 vCPU, 2,048 MBFits LiteRuns in the free demo

  17. 17Troubleshooting - the office has no Internet

    A small-office router built by someone else doesn't work: PCs get no addresses, then no Internet, then no names. Work bottom-up with RouterOS tools to find six realistic faults, fix each one and record what you found.

    2× RouterOS, 1× Alpine Linux, 2× VPCS

    5 vCPU, 3,072 MBFits LiteRuns in the free demo

  18. 18Troubleshooting - VLANs and bridges

    The hotel VLAN network from lab 7 has been 'tidied up' by a contractor and now staff, guests and the switches' management are each broken in a different way. Use the bridge's own tables to find four VLAN faults and fix them.

    3× RouterOS, 3× VPCS

    6 vCPU, 3,840 MBFits LiteRuns in the free demo

  19. 19Capstone - build a branch office from scratch

    Put the whole MTCNA course together: a new branch router dials PPPoE, serves staff and guest VLANs through a managed switch with DHCP and DNS, protects itself and its users with the firewall, shares the guest line fairly with PCQ, joins head office over WireGuard, and is hardened and backed up.

    4× RouterOS, 2× VPCS

    6 vCPU, 3,072 MBFits LiteRuns in the free demo

Devices and images

The exact Add Node images the labs use, and the vCPU and RAM their nodes are set to. Your plan counts what each running node is set to.

Devices and images in the MikroTik MTCNA practice labs, as read on 2 November 2026
DeviceImage in Add NodeSet toLabsNodes
MikroTik RouterOSmikrotik-7.14.21 vCPU, 256 MB1944
Alpine Linuxclbalpinebase-alpine-base-3-20-31 vCPU, 512 MB814
EVE-NG GUI server (Docker)eve-gui-server:latest1 vCPU, 2,048 MB11
VPCS hostBuilt in to EVE-NGcounted as 1 vCPU, 1,024 MB1530

Browse every image in the Add Node list

How to open the labs

  1. Sign in to your workspace at lab.cloudlabbox.com.

  2. In File Manager, open Shared, then the folder MikroTik MTCNA RouterOS v7 guided labs.

  3. Open a lab and start its nodes, then open Lab Tasks for the steps.

The labs are read-only. You can start the nodes and configure the devices, but changes to the topology can’t be saved. To change a lab, rebuild it in your own folder.

The Shared folder in the EVE-NG File Manager, recorded on 2 November 2026 with a test account.
The EVE-NG File Manager open on the read-only Shared folder: one folder per guided course, including Arista EOS, BGP in depth, CCIE Enterprise Infrastructure, CCNA, CCNP ENARSI and ENCOR, Check Point, Cisco ASA, Cisco Nexus NX-OS, CompTIA Network Plus and FortiGate
A guided CCNA lab with its Lab Tasks pane, recorded on 1 November 2026 with a test account.
A guided CCNA lab open in EVE-NG with its nodes running: four routers and two PCs on the canvas, and the Lab Tasks pane beside them with the scenario, the addressing plan and the first task

Questions about the MikroTik MTCNA labs

Are these MikroTik MTCNA labs free?

They’re included with every lab plan, with nothing extra to pay, rather than free. Plans start at £3 a day or £0.50 an hour. To try one first, the free demo gives you 30 minutes with 6 vCPU and 8 GB, enough to run every one of these labs.

Which plan do I need for these labs?

Lite, with 6 vCPU and 8 GB, runs every lab here. EVE-NG admits a node by the vCPU and RAM configured on it, so a lab needs the total its running nodes are set to. The biggest here, “VLANs with bridge VLAN filtering”, needs 6 vCPU and 3,840 MB. Each lab’s Lab Tasks pane names the plan it needs.

Can I change these labs?

You can start the nodes and configure the devices, but the labs are read-only: changes to the topology can’t be saved. To change one, rebuild it in your own folder.

Are these labs from MikroTik?

No. CloudLabBox wrote them to follow the topics of MikroTik’s MTCNA (MikroTik Certified Network Associate) training outline. They aren’t training material from MikroTik, and CloudLabBox is independent of MikroTik.

Try a lab before you choose

The free demo is a real workspace for 30 minutes, with 6 vCPU and 8 GB: enough to run every one of these labs. No card and no email.

Try it free for 30 minutesStart this course

Plans from £3 a day or £0.50 an hour, each with every guided lab.

More practice labs

CloudLabBox is independent of MikroTik. The labs follow exam topics and aren’t vendor training material; vendor names identify the exams and the images in the workspace.