How the labs work
Each lab opens as a topology on a canvas: hosts, switches, routers, firewalls, DNS and DHCP servers, already wired and addressed. You can rearrange it, break it, and put it back together.
There are two ways to run one. Simulation is a deterministic packet model — it walks a packet through the topology and explains every forwarding decision, NAT translation, firewall verdict, TTL change and MPLS label along the way, including the exact reason a packet was dropped. It is instant and needs no containers.
Live mode is real Linux networking: each node becomes a network namespace with real interfaces and routes, BIRD2 for OSPF and BGP, iptables for firewalling and NAT, and dnsmasq for DNS and DHCP. Commands like ping, traceroute, ip route, iptables and birdc run for real against it.
Live mode is genuine Linux networking, not vendor firmware emulation — it does not run Cisco IOS or JunOS. For learning IOS command syntax specifically, GNS3, EVE-NG and Containerlab are the right tools, and the comparison page is honest about where each one wins. What these labs are for is understanding how networks actually behave, in a browser, with nothing to set up.
Many of the labs below are deliberately broken. That is the point: a lab called I Added Allow But Still Blocked or Packets Enter But Never Leave reproduces a specific failure so you can diagnose it yourself, with traces and the device console, rather than read about it.
Beginner 8 labs
Two Hosts And A Switch
Two PCs on one switch and one subnet. See how they find each other with ARP and talk directly, with no router involved.
Understand how two hosts on the same subnet reach each other through a switch.
Router Between Two Networks
A client and a web server on two different subnets, joined by a router. Learn what a default gateway does by taking one away.
See why hosts need a default gateway and how a router moves packets between two LANs.
Direct Connection: Two Hosts, One Cable
The smallest possible network: two PCs joined by one cable, no switch and no router.
Understand what two devices need to talk over a single link: a cable, and addresses on the same subnet.
Three Hosts, One LAN
Three PCs share one switch and one subnet. Every PC reaches every other directly, and one unplugged cable only cuts off its own PC.
See how a switch lets several devices share one LAN, and what a single cable fault does and does not break.
Your Home Network
A PC and a phone behind a home router that shares one public address with NAT. Take the NAT rule away and see why every home network needs it.
Understand how devices at home share one internet connection through a router that does NAT.
Subnetting: Why /24 Matters
Sales and Engineering share one switch, but their PCs are on different subnets, so they refuse to talk to each other directly.
Understand how an address and its mask define a subnet, and why two devices need the same subnet to talk without a router.
Connected But Can't Ping (Mask Mismatch)
Two PCs on the same switch, one with the wrong subnet mask. Each decides differently what is local, and the ping fails in both directions.
Learn how a subnet mask decides what a host treats as local, and why both ends must agree.
WiFi Connected But No Internet
The laptop is connected and has an address, but its default gateway points at a device that does not exist. Local traffic works; nothing beyond does.
Understand why 'connected' does not mean 'online', and how to spot and fix a wrong default gateway.
Beginner+ 8 labs
Campus Routing Demo
A workstation on an access switch, an edge router, and a server on another subnet: the pattern behind most office networks.
Trace traffic across a switch and a router, and see that the switch is the workstation's only path to its gateway.
DHCP: Automatic Addressing
One PC gets its address and gateway from a DHCP server; another was configured by hand and someone forgot the gateway. Both can talk on the LAN, but only one can leave it.
Learn what a DHCP pool hands out, and what breaks when a device has an address but is missing the rest of the configuration.
Missing Gateway: Why Hosts Need Routes
A deliberately broken lab: PC-Left has no default gateway. Find out why that breaks PC-Left's traffic and PC-Right's pings too, then fix it.
Discover why a host without a default gateway cannot talk to other subnets, in either direction.
Hosting Your First Server
A laptop reaches a web server on another subnet through a router. Open a second service, then break the server's way back and watch the reply go missing.
Learn what a server needs to be reachable: a listening port, a route to it, and a route back.
Coffee Shop WiFi: DHCP + NAT
A laptop on coffee shop WiFi can reach a website by its address but not by its name. The shop's DHCP pool hands out an address and a gateway but no DNS server, so give the laptop one.
Understand what a DHCP lease gives a device, how the shop's router shares one public address through NAT, and why a device with an address and a gateway still cannot use names without a DNS server.
Why My Firewall Doesn't Forward
A firewall sits between PC-A and a web server, but both sides were given the same network, 192.168.1.0/24. PC-A decides the server is local and never sends anything to the firewall.
Understand why each side of a firewall or router needs its own subnet, and why the failure shows up at the hosts before the firewall is ever involved.
Names Don't Resolve
PC reaches the web server by address, but every name fails: its DNS server setting points at an address where nothing answers.
Learn to tell a name-resolution problem from a network problem, and to check which DNS server a device is really asking.
One Switch Dies, Everything Dies
Four devices hang off one central switch. Losing the Server costs one service; losing the switch cuts every conversation.
Understand what a single point of failure is, how to spot one in a star topology, and what removing it really takes.
Intermediate 27 labs
Firewall: Allow & Deny
A stateful firewall with two allow rules and a default deny. See which services get through, which are dropped even though the server is listening, and open a new one.
Understand allow rules, the default-deny policy, rule priority, and how a stateful firewall lets replies back in.
NAT: Private to Public
An office PC with a private address reaches a server on the internet through a NAT gateway. Watch the source address being rewritten on the way out, and find out why the gateway's port forward leads nowhere until something listens behind it.
Learn how source NAT lets private hosts start connections to the internet, how connection tracking translates the replies back, and what a port forward needs before it works.
DNS: Name Resolution
A Laptop looks up web.lab by asking its DNS server, then connects to the address it gets back. See what happens when a name has no record, or points at an address nobody uses.
Understand how a device turns a name into an address by asking its own DNS server, and why a successful lookup does not guarantee a working connection.
VLANs: Network Segmentation
One switch split into VLAN 10 for Sales and VLAN 20 for Engineering, with a router that has one port in each VLAN. Move a port into the wrong VLAN and watch a device with a correct address lose its neighbours.
See how access VLANs divide one physical switch into separate Layer 2 segments, and how a router connects them.
Router ACLs: Interface Filtering
A router filters traffic leaving one interface with an access control list. See what it blocks, why a reply can be blocked too, and add a rule in the right place.
Understand how an ACL attached to one router interface and direction filters traffic, and what it means that ACLs are stateless.
NAT: Port Forwarding
Expose an internal web server to the outside with port forwards. HTTP and HTTPS work, a forward to a port nothing listens on is refused, and a port with no forward is refused by the gateway itself.
Understand how destination NAT rewrites incoming connections to reach an internal service, how their replies are translated back, and why a forward is useless without a listening service behind it.
Dual Router Path: Multi-Hop Routing
Three networks joined by two routers in a row. Each router forwards using only its own networks and the static routes it was given, so the path needs routes in both directions.
Understand how a packet crosses several routers, each making its own next-hop decision, and why the reply needs routes of its own.
Firewall + NAT: Defense in Depth
An office PC reaches an internet web server through a firewall that decides what may leave and a NAT gateway that translates the address. See which device does which job, and open SSH with one firewall rule.
See how a firewall and a NAT gateway work together, and why filtering and address translation are separate jobs.
NAT Deep Dive: Address Translation Visualized
Watch source NAT and a port forward rewrite addresses hop by hop, then take the SNAT rule away and see which traffic breaks and which keeps working.
Understand exactly what SNAT, DNAT and connection tracking each do, by watching the addresses change and by removing one rule to see what depends on it.
Port Forward: Gaming Server
You host a Minecraft server at home and your friend cannot join. Set up the port forward on your home router, and see what it does and does not open.
Learn to create a port forward (DNAT) that exposes one service behind NAT, and see that it opens exactly one port to exactly one host.
Startup Office: WiFi + Servers + Firewall
Guest WiFi, staff and servers each get their own subnet on the office firewall. Staff reach the servers, guests reach nothing, and then you open exactly one page to visitors.
Build office segmentation that really separates guests from servers: understand which traffic crosses the firewall, which never does, and how to open one service without opening the rest.
Why This Route, Not That One?
A router has a broad route and a narrower route that both cover the same addresses. The most specific match wins, whatever order the routes were added in.
Master longest prefix match: how a router chooses between several routes that all match a destination.
I Added Allow But Still Blocked
The firewall has allow rules for HTTP and ping, and a deny-all at priority 1 that matches every packet before they are ever checked. Find it and move it to the end.
Understand first-match rule evaluation, and why a broad deny must come after the specific allows.
Packets Enter But Never Leave
Requests from Sender reach Receiver, but Router-2 has no route back to Sender's network, so every reply is dropped. One-way reachability looks like a dead server.
Understand that communication needs a forward path and a return path, and learn to find the router where the return path ends.
Two Layers of NAT
A home router behind an ISP's carrier-grade NAT. Browsing works through both translations, but the port forward on the home router cannot be reached from the internet until the ISP's gateway forwards the port too.
Understand carrier-grade NAT, why outbound traffic survives two translations, and why a port forward only helps on the NAT that owns the public address.
Works Locally But Not Remotely
A developer says the web server works on the server itself, yet clients get 'connection refused'. Ping works, so the network is fine; the server has no service on its network address. Start one on port 80.
Learn to tell a network problem from a service problem, and understand why a server bound to 127.0.0.1 refuses connections from the network.
Asymmetric Path Breaks Firewall
Client's requests reach Server through a plain router, but Server's replies come back through a stateful firewall that never saw the request. Ping works, HTTP hangs. Make the path symmetric.
Learn why a stateful firewall must see both directions of a connection, how asymmetric routing breaks TCP while ping still works, and how to fix it with routing.
Hairpin NAT: Can't Reach Myself
A web server behind a NAT gateway works from the internet, but a PC on the same LAN that uses the public address cannot connect. Find out why the reply goes astray and add the hairpin NAT rule that fixes it.
Understand why an inside client using a port forward's public address fails without hairpin NAT, and how masquerading that traffic to the gateway's LAN address brings the reply back through the gateway.
Stale DNS Record: The Server Moved
The app moved to a new server, but its DNS record still points at the old address. The old machine is still switched on, so connections are refused instead of timing out.
Recognise an outdated DNS answer, fix the record, and understand how TTL and caching stretch the same problem out in real networks.
MTU Black Hole: Ping Works, Big Transfers Hang
Small packets cross a narrow 1280-byte link fine, but full-size packets vanish without an error, because a firewall throws away the message that would have told the sender to shrink them.
Understand MTU, path MTU discovery, and why blocking the wrong ICMP turns a narrow link into a black hole.
Stateful vs Stateless Firewall
Two firewalls with the same single rule: allow HTTP from the client subnet. The stateful one lets the replies back; the stateless one drops them until you write a rule for the return direction.
Understand what connection tracking does, why a stateless filter needs rules for both directions, and how this maps to AWS security groups and network ACLs.
Accidental Lockout: Locked Out of My Server
An admin 'tightened security' with a deny-all at priority 1, above the rule that allows their own SSH. Now nobody reaches the server. Put the rules back in the right order without opening SSH to everyone.
Learn why a deny-all must come after the allows, how a source address narrows an allow rule, and how admins avoid locking themselves out.
Overlapping Subnets: The Router Is Never Asked
Both sides of a router were given the same network, 10.0.1.0/24. The hosts conclude everyone is local, look for each other on their own cable, and never send anything to the router.
Understand why every router interface needs its own subnet, why overlapping subnets break at the hosts first, and what a complete renumbering involves.
Default Route Loop: Infinite Bounce
Router-A and Router-B point their default routes at each other, so anything without a specific route bounces between them until its TTL runs out, including the intranet behind Core.
Understand how circular default routes create a routing loop, how TTL ends it, and how default routes should form a chain toward the exit.
MPLS: Label Switching Basics
PE1 pushes a label, P swaps it, PE2 pops it. P has no route to either host's network, so the only thing carrying the packets across it is the label.
Understand the three MPLS operations (push, swap, pop), why a label switched path runs in one direction only, and how a core router can forward traffic it has no IP route for.
MPLS: What Happens Without Labels
PE1 has an LSP for Host-B's network but routes traffic by a default route the LSP is not bound to, so packets enter the core unlabelled and the core router, which has no IP routes, drops them.
Understand why a label-only core drops plain IP packets, and why an ingress PE pushes a label only for traffic that matches the exact prefix the label is bound to.
MPLS: Wrong Label Mapping
PE1 pushes label 16001, but P's label table expects 16099 on that path. P drops the packet, and because every ping needs a reply, the one bad entry breaks traffic in both directions.
See how a label mismatch between two neighbouring routers drops traffic, and how to find it by comparing what one router sends with what the next expects.
Intermediate+ 8 labs
Web Stack: Client → LB → Servers
A browser reaches two app servers through a load balancer's virtual IP. See the balancer rewrite the destination to a backend and the source to itself, and find out why clients never need a route to the servers behind it.
See how a layer 4 load balancer turns connections to one virtual IP into connections to backend servers, what the backends see, and which ports it really serves.
DNS + Routing: Cross-Subnet Resolution
A Workstation resolves names through a DNS server on its own subnet and connects to servers behind a router. Then a server on the other subnet tries the same DNS server and gets no answer.
See a DNS lookup and the connection that follows as two separate conversations, each needing a path in both directions.
Redundant Paths: Two Routers, One Destination
Two routers join the same two networks, but each host uses only the gateway it is configured with. Cut the primary router off and find out what it takes to use the backup.
Understand how default gateways choose the path in each direction, and why a second router is not failover on its own.
DNS Hierarchy: Resolver and Authoritative Server
A Client asks its local Resolver, which holds no records for example.lab and forwards those questions to Auth-DNS, the server that owns the zone.
Understand the difference between a resolver that asks on your behalf and an authoritative server that owns the answers, and why the resolver needs its own path to that server.
CDN: Load Balancer + Multiple Origins
An edge load balancer spreads connections across three origin servers. Take one origin's web service down and see why a balancer without health checks keeps sending traffic to it.
Learn how an edge load balancer spreads connections across origin servers, what it does and does not know about them, and why production balancers need health checks.
Container Networking: Pod to Service
A simplified Kubernetes cluster: a frontend pod calls an API Service that spreads connections over two API pods. See how a Service's virtual IP works, what this lab simplifies, and what happens when a pod stops serving.
Understand pod addresses, Service virtual IPs and the part kube-proxy plays, and why a Service keeps sending traffic to a broken pod unless readiness checks remove it.
MPLS: Penultimate Hop Popping
The second-to-last router pops the label, so the egress router receives a plain IP packet and needs no label table at all.
Understand penultimate hop popping (PHP): who removes the label, what the egress router does instead, and why networks do it.
MPLS: Multi-Hop Label Path
A longer LSP through two core routers: PE1 pushes, P1 and P2 each swap, PE2 pops. Neither core router has a route to either host network.
See how a label is swapped at every transit router, why each label only means something on one link, and what a static LSP cannot do when a core link fails.
Advanced 15 labs
Full Office Network
An office LAN with DHCP and DNS servers, an edge firewall, and a load balancer in front of two web servers. Follow a request by name from an employee PC to a web server, then tighten the firewall so the server side cannot start connections into the office.
Trace a request through name resolution, a stateful firewall and a load balancer, and see what each device allows, rewrites or refuses.
Data Center Tiers: Web, App, Database
A three-tier network with a firewall in front of each tier. Each firewall lets in only the service the tier behind it offers, plus ping, so a compromised web server still cannot reach the database.
Learn network segmentation with firewalls between web, app and database tiers, and how routes and least-privilege rules work together.
Troubleshooter Challenge: Find Three Bugs
Laptop cannot load the web server's page. Exactly three things are misconfigured, on three different devices. Trace, find each one, fix it, and trace again.
Practise systematic troubleshooting: test, read where and why the trace stops, fix that one thing, and re-test until the whole conversation works.
BGP: Two ISPs Exchanging Routes
Two ISPs in different autonomous systems peer with eBGP. Neither has a static route: every path between their customers is learned over BGP, and it disappears when the session does.
Understand what a BGP session needs, what the routers advertise over it, and how to tell a BGP-learned route from a configured one.
Anycast: Same IP, Multiple Locations
Two sites each run a DNS server at the same address, 10.99.0.53, and each site's router announces the network over BGP. The backbone sends queries to one site; cut that site off and the same address is answered by the other.
Understand anycast: one address announced from several places, how BGP picks which one you reach, and why losing a site does not change the address clients use.
OSPF Failure Recovery
Three routers in a triangle, with OSPF doing all of the routing. Unplug a link and trace again to see traffic take the long way round; then stop OSPF on one router and see what redundancy cannot save.
Understand how OSPF learns routes, picks the cheapest path, reroutes around a failed link, and why a router that stops running OSPF cuts off the network behind it.
Multi-Homed Customer: Two ISP Uplinks
A company router runs BGP with two ISPs, and a web server sits in a hosting network that both ISPs also reach. Traffic uses ISP-A; fail that uplink and BGP moves both directions of the conversation to ISP-B.
Learn how a multi-homed network learns the same destination from two ISPs, how BGP picks one, and what really happens when an uplink fails.
Zero Trust: Microsegmentation
Four services in a chain, each behind its own firewall with default deny. Every allowed flow names one source, one destination and one port, so no service can skip a step.
Learn microsegmentation: a firewall at every service boundary, rules that name exact sources, and routing that sends each flow through the gate meant to judge it.
Internet Exchange Point: 3 ISPs Peering
Three ISPs plug into one switch at an Internet Exchange Point and run a BGP session with each other across it. Every route between their customers is learned over those sessions, and unplugging one ISP withdraws its routes from the other two.
Understand how ISPs peer across a shared exchange switch, why the switch does no routing, and how BGP picks between a direct path and a longer one.
Incident Response: Database Breach
SSH logins to the database came from outside. Trace how the attacker got in, find the two over-permissive firewall rules, and close the path in the right order without breaking the website.
Practise incident investigation: trace the attack path, identify which rule on which firewall allowed each step, remediate, and prove the fix with traces.
Switch Loops and Broadcast Storms
Three switches cabled in a triangle form a loop. On real switches without spanning tree, that loop would flood the network with broadcasts; this platform runs connected switches as one loop-free segment, so you can study the loop without the outage.
Understand why a switching loop causes a broadcast storm, how spanning tree prevents it, and what redundant switch links really protect against.
Ring vs Star: Topology Trade-offs
A star of three PCs on one switch beside a ring of three switches, each with a PC. Unplug cables to see which failures each layout survives, and why a trace looks the same in both.
Understand the redundancy trade-off between star and ring switch layouts, and what a trace does and does not show about switches.
MPLS: Multiple LSPs
One PE router runs two LSPs to two different sites, pushing a different label for each destination network and sending each down its own core router.
Understand forwarding equivalence classes: how an ingress PE chooses a label by destination prefix, and why the label must match the path the packet takes.
MPLS: Two Customer Sites Over a Provider Core
A customer's two sites are joined across a provider's MPLS core. The PE routers label the customer's traffic with a single label, and the core router in the middle has no route to either site. This is the transport half of an MPLS VPN; the VPN half (VRFs and a second label) is explained, not built.
See how a provider carries a customer's traffic across a core that knows nothing about the customer's addresses, and what a full MPLS L3VPN adds on top.
MPLS: Triangle with Redundant Paths
Three routers in a triangle. Traffic to Host-B is sent the long way, R1 to R2 to R3, over an LSP through a router that has no IP route to Host-B at all, while plain IP traffic to Host-C takes the direct R1-R3 link.
See an LSP carry traffic along a path that plain IP forwarding could not use, and learn why a static LSP neither follows route changes nor fails over by itself.
Pick one and open it
Every lab above opens in one click. Nothing to install, no account needed, and the simulation runs instantly.
Open your first lab →