CloudLabBox
Try the free demo

MikroTik MTCSE lab 10 of 10

Capstone: a hardening audit with planted weaknesses

Fernvale has bought a small ISP, and its edge router QUAYSIDE-GW is a mess: open services, a forgotten support account, MAC access everywhere, a firewall with a disabled drop rule and a hole into the LAN, no logs, and an OSPF link to Fernvale's core that never came up because the core insists on authentication. Audit it against Fernvale's standard, prove each weakness, and fix them all.

Run this lab

It needs Lite: its 5 nodes are set to 5 vCPU and 1,792 MB in total. That fits the free demo too.

In your workspace: Shared, then MikroTik MTCSE RouterOS v7 guided labs, then 10 - Capstone - a hardening audit with planted weaknesses

Try it free for 30 minutesRun it on Lite from £3 a day

The free demo needs no card and no email. Every lab plan includes every guided lab.

Level
Advanced
Time
About 90 minutes
Nodes need
5 vCPU, 1,792 MB
Smallest plan
Lite

The scenario

Fernvale has bought a small ISP at Quayside, and its edge router QGW joins Fernvale's network today. Before it does, it must pass Fernvale's hardening standard, which you have built up over labs 1 to 6. The previous owners left it in a state you'll recognise. There is also a practical problem: the OSPF link to Fernvale's CORE router never came up, so QGW can't reach Fernvale's servers (10.20.0.0/24).

DeviceAddressRole
QGWether1 203.0.113.2/29 (WAN) · ether2 192.168.40.1/24 (staff) · ether3 10.10.10.1/24 (NOC) · ether4 10.0.0.2/30 (core) · loopback 10.255.0.2the router under audit
CORE10.0.0.1/30 · servers 10.20.0.1/24Fernvale's core router (don't change it)
STAFF192.168.40.20/24a staff PC (RouterOS)
NOC (Linux)10.10.10.10/24runs a syslog listener on UDP 514, writing to /root/qgw.log
ATT (Linux)203.0.113.6/29the Internet, with a route to the staff LAN through QGW

Fernvale's hardening standard

  1. Accounts: no shared or default-password accounts; every IP login only from the NOC (10.10.10.0/24).
  2. Services: only SSH and WinBox, both only from 10.10.10.0/24; no Telnet, FTP, HTTP or API; SSH with strong crypto.
  3. Layer 2: MAC-Telnet, MAC-WinBox and neighbour discovery only on the MGMT list; no MAC ping.
  4. Input firewall: established and related accepted, invalid dropped, ICMP accepted, everything from the WAN that isn't a reply dropped. No open DNS resolver.
  5. Forward firewall: nothing from the WAN reaches the staff LAN unless it's a reply.
  6. Routing protocols: OSPF with SHA-256 authentication, key ID 1, key Fv-Ospf-Key-2026.
  7. Logging: firewall and account messages to the NOC's syslog (10.10.10.10, UDP 514); WAN drops logged with the prefix WAN-DROP, at most 5 lines a second.

What you’ll practise

  • Audit a router methodically: accounts, services, layer 2 access, firewall, routing protocols and logging
  • Prove each weakness from the outside before fixing it
  • Apply the fixes from labs 1 to 6 together without locking yourself out
  • Bring up OSPF with SHA-256 authentication to match the core

The tasks

  1. Address the Linux hosts
  2. Prove the weaknesses from outside
  3. Audit the router, section by section
  4. Fix OSPF to the core
  5. Prove the fixes

The Lab Tasks pane has the scenario, these tasks, the checks to run, hints and the full solution.

Topology and devices

The network as it opens in EVE-NG, drawn from the lab’s own canvas, and the image each node runs.

Topology of Capstone - a hardening audit with planted weaknesses5 nodes, 4 links. Every link is listed as text below the diagram.QGWCORESTAFFNOCATTether4ether1ether1eth0ether2ether1ether3eth0
5 nodes, with the interface names each link uses. On a narrow screen, scroll the diagram sideways.
Every link, as text
  • QGW ether1 to ATT eth0
  • QGW ether2 to STAFF ether1
  • QGW ether3 to NOC eth0
  • QGW ether4 to CORE ether1
Nodes in Capstone: a hardening audit with planted weaknesses, with the image each runs and the vCPU and RAM it’s set to
NodeDeviceImage in Add NodeSet to
QGWMikroTik RouterOSmikrotik-7.14.21 vCPU, 256 MB
COREMikroTik RouterOSmikrotik-7.14.21 vCPU, 256 MB
STAFFMikroTik RouterOSmikrotik-7.14.21 vCPU, 256 MB
NOCAlpine Linuxclbalpinebase-alpine-base-3-20-31 vCPU, 512 MB
ATTAlpine Linuxclbalpinebase-alpine-base-3-20-31 vCPU, 512 MB

How to open this lab

  1. Sign in to your workspace at lab.cloudlabbox.com.

  2. In File Manager, open Shared, then the folder MikroTik MTCSE RouterOS v7 guided labs.

  3. Open 10 - Capstone - a hardening audit with planted weaknesses and start its nodes, then open Lab Tasks for the scenario and the steps.

The lab is read-only. You can start the nodes and configure the devices, but changes to the topology can’t be saved. To change it, rebuild it in your own folder.

More MikroTik MTCSE labs

All MikroTik MTCSE labs

Related labs in other courses

CloudLabBox is independent of MikroTik. The lab follows exam topics and isn’t vendor training material; vendor names identify the exams and the images in the workspace.