CloudLabBox
Try the free demo

MikroTik MTCSE practice labs

10 guided labs on RouterOS 7 that cover every module of the MTCSE training outline: hardening users, services, the MAC server and neighbour discovery, the stateful firewall and packet flow, the RAW table against floods, address lists against brute force and port scans, port knocking, rogue DHCP and bridge filters, attack detection, certificates, SSTP and L2TP/IPsec, and IKEv2 site-to-site IPsec, ending in a hardening audit.

Start this courseTry it free for 30 minutes

Lite for a month, £45.00, runs every lab here, with nothing extra to pay for the guided labs. Every lab here also runs in the free demo.

Guided labs
10
Follows
MikroTik MTCSE, on RouterOS v7
Runs every lab
Lite
Devices
RouterOS and Alpine Linux

Who these labs are for

For engineers who hold the MTCNA and are preparing for the MTCSE course and exam, and anyone who runs MikroTik routers on the Internet and wants hands-on practice at locking them down on RouterOS 7.

The 10 labs

Every lab in the folder, as the workspace lists them, with what each runs and the smallest plan that fits. Read on 2 November 2026.

MTCSE course 10 labs

Shared folderMikroTik MTCSE RouterOS v7 guided labs

One MTCSE module per lab, ending in a hardening audit with eight planted weaknesses.

  1. 01Securing the router - users services MAC server and neighbour discovery

    Fernvale's new Harbourside edge router went live with RouterOS defaults, and a quick audit found it offering Telnet, FTP and the web interface to everyone and announcing its model and version to the ISP. Lock it down: named accounts with least privilege, only the services the NOC needs, on a non-default port and only from the management network, and no MAC access or neighbour discovery outside it.

    3× RouterOS, 1× Alpine Linux

    4 vCPU, 1,280 MBFits LiteRuns in the free demo

  2. 02Stateful firewall - packet flow chains connection tracking and ICMP

    Fernvale Harbourside's router routes and NATs but filters nothing, so a host on the ISP's segment can reach the private staff LAN directly. Build a stateful firewall the way RouterOS's own default configuration does: an input chain that protects the router, a forward chain that protects the LAN and DMZ while keeping the published web server reachable, a custom chain for ICMP that keeps path MTU discovery working, and FastTrack for established traffic.

    4× RouterOS

    4 vCPU, 1,024 MBFits LiteRuns in the free demo

  3. 03RAW table and flood mitigation - SYN UDP ICMP and spoofed traffic

    An attacker on the ISP segment hammers Fernvale Harbourside's published web server with bursts of TCP SYNs, pings and spoofed packets. Stop them in the RAW table, before connection tracking spends memory on them: per-source SYN and ICMP rate limits that put offenders on a block list, drops for spoofed and broadcast-directed traffic, SYN cookies and strict reverse-path filtering, while a normal visitor keeps loading the site.

    3× RouterOS, 1× Alpine Linux

    4 vCPU, 1,280 MBFits LiteRuns in the free demo

  4. 04Brute force port scans and port knocking with address lists

    Fernvale's on-call engineer needs SSH to the Harbourside router from anywhere, and the Internet has noticed. Use dynamic address lists to blacklist sources that open connection after connection to SSH, catch port scanners with PSD and a Telnet honeypot and drop them in RAW, then hide SSH completely behind a port-knocking sequence that only the engineer knows.

    2× Alpine Linux, 2× RouterOS

    4 vCPU, 1,536 MBFits LiteRuns in the free demo

  5. 05Layer 2 troubleshooting - a rogue DHCP server DHCP snooping and bridge filters

    Staff at Harbourside are getting 10.99.0.x addresses and can't reach anything. Find the rogue DHCP server plugged into the office switch, stop it with DHCP snooping and a bridge filter, and fix the real DHCP server, which a maintenance change had quietly broken. A troubleshooting lab with two planted faults.

    4× RouterOS

    4 vCPU, 1,024 MBFits LiteRuns in the free demo

  6. 06Detecting attacks - firewall logging remote syslog and netwatch

    Harbourside's firewall drops attacks silently, so nobody knows they happen, and nobody noticed when the web server went down last week. Send the router's logs to the NOC's syslog server, log dropped and suspicious traffic with prefixes and rate limits, flag sources that probe the DNS service, and watch the web server with netwatch so an outage raises an alarm.

    2× Alpine Linux, 2× RouterOS

    4 vCPU, 1,536 MBFits LiteRuns in the free demo

  7. 07Certificates and PKI - your own CA HTTPS SSH keys and SSH tunnels

    Fernvale's NOC wants every management session encrypted and verifiable. Build Fernvale's own certificate authority on the Harbourside router, serve WebFig over HTTPS with a certificate that a client can verify, give the NOC engineer a key-only SSH account, and reach a switch's web page on an isolated management network through an SSH tunnel.

    3× RouterOS, 1× Alpine Linux

    4 vCPU, 1,280 MBFits LiteRuns in the free demo

  8. 08Secure remote access - SSTP with certificates and L2TP-IPsec

    Give Fernvale's field engineers remote access to head office: SSTP over TCP 443 where both the server and the client prove themselves with certificates from Fernvale's CA, and L2TP/IPsec with a pre-shared key for clients that only speak the built-in VPN, with plain L2TP refused.

    4× RouterOS

    4 vCPU, 1,024 MBFits LiteRuns in the free demo

  9. 09IPsec IKEv2 site-to-site with certificates NAT and FastTrack

    Join Fernvale's head office and the Quayside branch across the Internet with an IKEv2 IPsec tunnel authenticated by certificates from your own CA, then fix the two things that silently break site-to-site IPsec on a working router: source NAT and FastTrack.

    5× RouterOS

    5 vCPU, 1,280 MBFits LiteRuns in the free demo

  10. 10Capstone - a hardening audit with planted weaknesses

    Fernvale has bought a small ISP, and its edge router QUAYSIDE-GW is a mess: open services, a forgotten support account, MAC access everywhere, a firewall with a disabled drop rule and a hole into the LAN, no logs, and an OSPF link to Fernvale's core that never came up because the core insists on authentication. Audit it against Fernvale's standard, prove each weakness, and fix them all.

    3× RouterOS, 2× Alpine Linux

    5 vCPU, 1,792 MBFits LiteRuns in the free demo

Devices and images

The exact Add Node images the labs use, and the vCPU and RAM their nodes are set to. Your plan counts what each running node is set to.

Devices and images in the MikroTik MTCSE practice labs, as read on 2 November 2026
DeviceImage in Add NodeSet toLabsNodes
MikroTik RouterOSmikrotik-7.14.21 vCPU, 256 MB1033
Alpine Linuxclbalpinebase-alpine-base-3-20-31 vCPU, 512 MB69

Browse every image in the Add Node list

How to open the labs

  1. Sign in to your workspace at lab.cloudlabbox.com.

  2. In File Manager, open Shared, then the folder MikroTik MTCSE RouterOS v7 guided labs.

  3. Open a lab and start its nodes, then open Lab Tasks for the steps.

The labs are read-only. You can start the nodes and configure the devices, but changes to the topology can’t be saved. To change a lab, rebuild it in your own folder.

The Shared folder in the EVE-NG File Manager, recorded on 2 November 2026 with a test account.
The EVE-NG File Manager open on the read-only Shared folder: one folder per guided course, including Arista EOS, BGP in depth, CCIE Enterprise Infrastructure, CCNA, CCNP ENARSI and ENCOR, Check Point, Cisco ASA, Cisco Nexus NX-OS, CompTIA Network Plus and FortiGate
A guided CCNA lab with its Lab Tasks pane, recorded on 1 November 2026 with a test account.
A guided CCNA lab open in EVE-NG with its nodes running: four routers and two PCs on the canvas, and the Lab Tasks pane beside them with the scenario, the addressing plan and the first task

Questions about the MikroTik MTCSE labs

Are these MikroTik MTCSE labs free?

They’re included with every lab plan, with nothing extra to pay, rather than free. Plans start at £3 a day or £0.50 an hour. To try one first, the free demo gives you 30 minutes with 6 vCPU and 8 GB, enough to run every one of these labs.

Which plan do I need for these labs?

Lite, with 6 vCPU and 8 GB, runs every lab here. EVE-NG admits a node by the vCPU and RAM configured on it, so a lab needs the total its running nodes are set to. The biggest here, “Capstone - a hardening audit with planted weaknesses”, needs 5 vCPU and 1,792 MB. Each lab’s Lab Tasks pane names the plan it needs.

Can I change these labs?

You can start the nodes and configure the devices, but the labs are read-only: changes to the topology can’t be saved. To change one, rebuild it in your own folder.

Are these labs from MikroTik?

No. CloudLabBox wrote them to follow the topics of MikroTik’s MTCSE (MikroTik Certified Security Engineer) training outline. They aren’t training material from MikroTik, and CloudLabBox is independent of MikroTik.

Try a lab before you choose

The free demo is a real workspace for 30 minutes, with 6 vCPU and 8 GB: enough to run every one of these labs. No card and no email.

Try it free for 30 minutesStart this course

Plans from £3 a day or £0.50 an hour, each with every guided lab.

More practice labs

CloudLabBox is independent of MikroTik. The labs follow exam topics and aren’t vendor training material; vendor names identify the exams and the images in the workspace.