CloudLabBox
Try the free demo

MikroTik MTCNA lab 19 of 19

Capstone: build a branch office from scratch

Put the whole MTCNA course together: a new branch router dials PPPoE, serves staff and guest VLANs through a managed switch with DHCP and DNS, protects itself and its users with the firewall, shares the guest line fairly with PCQ, joins head office over WireGuard, and is hardened and backed up.

Run this lab

It needs Lite: its 6 nodes are set to 6 vCPU and 3,072 MB in total. That fits the free demo too.

In your workspace: Shared, then MikroTik MTCNA RouterOS v7 guided labs, then 19 - Capstone - build a branch office from scratch

Try it free for 30 minutesRun it on Lite from £3 a day

The free demo needs no card and no email. Every lab plan includes every guided lab.

Level
Advanced
Time
About 120 minutes
Nodes need
6 vCPU, 3,072 MB
Smallest plan
Lite

The scenario

Fernvale has won the contract for a chain of opticians. You are setting up Branch 7: a new MikroTik router (Branch-GW) and a MikroTik switch (SW), both blank apart from their names and passwords. The provider (ISP) and head office (HQ) are ready and you must not change them. Everything below must work before you leave the site.

Requirements

#Requirement
R1WAN: PPPoE on ether1, service fernvale, account branch7 / Branch7-pass, default route and DNS from the provider.
R2Switch SW: one bridge with VLAN filtering. ether1 = trunk to Branch-GW (VLANs 10, 20, 99 tagged), ether2 = Staff (VLAN 10), ether3 = Guest (VLAN 20). Management 192.168.99.2/24 in VLAN 99, gateway 192.168.99.1.
R3Branch-GW routes the VLANs on ether2: 192.168.10.1/24 (Staff), 192.168.20.1/24 (Guest), 192.168.99.1/24 (Management).
R4DHCP on Staff and Guest, pools .100–.199, gateway and DNS = the router; the router answers DNS for the LAN.
R5LAN traffic to the Internet is masqueraded through the PPPoE interface (use interface lists WAN and LAN).
R6Input firewall: accept established/related, drop invalid, accept ICMP, accept DNS and DHCP from the LAN, accept SSH and WinBox only from Staff and Management, drop everything else.
R7Forward firewall: accept established/related, drop invalid, guests may reach only the Internet (not Staff, not Management, not HQ), drop new connections from the WAN that aren't DST-NATed.
R8Guests share 512 kbit/s up and down fairly (PCQ). Staff are not limited.
R9WireGuard to HQ: interface wg-hq, address 10.255.7.2/30, the private key below (HQ already trusts its public key), HQ's public key and endpoint, keepalive 25 s. Staff (only) reach the HQ file server 10.10.10.10.
R10Hardening: telnet, FTP, WWW, API and API-SSL off; SSH and WinBox only from 192.168.10.0/24 and 192.168.99.0/24; MAC-WinBox and neighbour discovery only on the LAN list.
R11Save an export called branch7-day1.
ItemValue
Branch-GW WireGuard private keyqLXjUBRNu8o+4qG4816KmRh40NHNa09etszRCLpTtXQ=
HQ WireGuard public keysD+ZYVLUftdVbFoo4nvTF/NGHgxVrjc5qzxea3cAE3k=
HQ endpoint203.0.113.2, UDP 13231; tunnel 10.255.7.1/30 at HQ
Internet test hostwww.fernvale.example = 198.51.100.10

What you’ll practise

  • Plan and build a complete branch office on RouterOS 7 from a requirements list
  • Combine PPPoE, VLAN filtering, DHCP, DNS, NAT, firewall, queues and WireGuard on one router
  • Isolate guests from staff, head office and management
  • Verify every requirement with your own tests

The tasks

  1. Switch (R2)
  2. Router LAN side (R3, R4)
  3. WAN and NAT (R1, R5)
  4. WireGuard to HQ (R9)
  5. Firewall and queue (R6, R7, R8)
  6. Hardening and backup (R10, R11)

The Lab Tasks pane has the scenario, these tasks, the checks to run, hints and the full solution.

Topology and devices

The network as it opens in EVE-NG, drawn from the lab’s own canvas, and the image each node runs.

Topology of Capstone - build a branch office from scratch6 nodes, 5 links. Every link is listed as text below the diagram.ISPHQBranch-GWSWStaff-PCGuest-PCether2eth0ether3eth0ether2ether1ether2ether1ether1ether1
6 nodes, with the interface names each link uses. On a narrow screen, scroll the diagram sideways.
Every link, as text
  • ISP ether1 to Branch-GW ether1
  • ISP ether2 to HQ ether1
  • Branch-GW ether2 to SW ether1
  • SW ether2 to Staff-PC eth0
  • SW ether3 to Guest-PC eth0
Nodes in Capstone: build a branch office from scratch, with the image each runs and the vCPU and RAM it’s set to
NodeDeviceImage in Add NodeSet to
ISPMikroTik RouterOSmikrotik-7.14.21 vCPU, 256 MB
HQMikroTik RouterOSmikrotik-7.14.21 vCPU, 256 MB
Branch-GWMikroTik RouterOSmikrotik-7.14.21 vCPU, 256 MB
SWMikroTik RouterOSmikrotik-7.14.21 vCPU, 256 MB
Staff-PCVPCS hostBuilt in to EVE-NGCounted as 1 vCPU, 1,024 MB
Guest-PCVPCS hostBuilt in to EVE-NGCounted as 1 vCPU, 1,024 MB

How to open this lab

  1. Sign in to your workspace at lab.cloudlabbox.com.

  2. In File Manager, open Shared, then the folder MikroTik MTCNA RouterOS v7 guided labs.

  3. Open 19 - Capstone - build a branch office from scratch and start its nodes, then open Lab Tasks for the scenario and the steps.

The lab is read-only. You can start the nodes and configure the devices, but changes to the topology can’t be saved. To change it, rebuild it in your own folder.

More MikroTik MTCNA labs

All MikroTik MTCNA labs

Related labs in other courses

CloudLabBox is independent of MikroTik. The lab follows exam topics and isn’t vendor training material; vendor names identify the exams and the images in the workspace.