Networking and network services

39 courses, 680 lessons. A real Kali Linux lab in the browser.

Network fundamentals: TCP/IP, ARP, DNS (Level 101, 19 lessons): TCP/IP, addresses, ports, protocols and the journey of a packet.
Linux networking: ip, ss, ping, dig (Level 101, 18 lessons): ip, ss, ping, traceroute and network configuration.
Addressing and subnetting practice (Level 101, 16 lessons): You solve address maths from binary to VLSM first by hand, then with ipcalc, and build a real address plan in every section.
Talking to protocols by hand: nc, telnet, openssl (Level 101, 15 lessons): You connect to HTTP, SMTP, POP3, IMAP, FTP and DNS without a client program, typing line by line, and see what services really say.
Secure file transfer with SSH, scp and rsync (Level 201, 22 lessons): Keys, scp, sftp and rsync.
DNS (BIND) and DHCP services (Level 201, 19 lessons): Name resolution, record types and handing out addresses.
File sharing with NFS and Samba (Level 201, 18 lessons): Sharing and access control on Linux and Windows networks.
TCP/IP in depth: IP, ICMP, TCP, UDP (Level 201, 18 lessons): You read every protocol header field by field with tcpdump and see fragmentation, handshakes and connection close-down in your own traffic.
IPv6 in practice: addressing, SLAAC, DHCPv6 (Level 201, 16 lessons): You set up IPv6 address types, neighbour discovery and automatic addressing on Linux machines and see where IPv4 habits no longer work.
Routing fundamentals: routes, metrics, policy routing (Level 201, 21 lessons): You build static routes, backup links and source-based routing with Linux routers and take your first step into dynamic routing.
Switching and VLANs: bridges, 802.1Q, STP (Level 201, 18 lessons): You build virtual switches with Linux bridges and Open vSwitch, split the network with VLANs, prevent loops with STP and read the MAC table.
VPNs with WireGuard (Level 201, 17 lessons): You build remote-access and site-to-site VPNs with WireGuard, manage keys and set up routing and DNS through the tunnel correctly.
Network infrastructure services: NTP, SNMP, PXE and IPAM (Level 201, 17 lessons): You set up the quiet heroes of every network — time sync, SNMP, network boot and address management — and see how devices rely on them.
Windows networking: ipconfig, netsh, PowerShell (Level 201, 15 lessons): You manage network settings, DNS and DHCP roles and SMB shares on Windows clients and servers from the command line, and solve problems in networks mixed with Linux.
Wireless networks: Wi-Fi, WPA2/WPA3 and enterprise Wi-Fi (Level 201, 16 lessons): You learn Wi-Fi frequencies, channels and security, build an access point with hostapd, protect it with WPA2, WPA3 and 802.1X, and solve problems with iw and logs.
Network troubleshooting: layer by layer (Level 201, 21 lessons): You narrow down “it won’t connect” systematically from the physical layer to the application, collecting evidence and finding the root cause each time.
Network fault challenges: fix broken networks (Level 201, 18 lessons): In every lesson a broken network is waiting; hints are few, evidence is plenty. You find the fault, fix it and write a short report.
TCP performance: windows, congestion and latency (Level 301, 18 lessons): You find the cause of a slow connection by measuring latency, loss, window size and congestion control, then fix it with kernel settings.
IPv6 transition and security: NAT64, DNS64, RA guard (Level 301, 17 lessons): You build transition methods such as dual stack, NAT64 and DNS64, see IPv6-specific risks such as rogue router advertisements and apply the defences.
Dynamic routing with OSPF (FRRouting) (Level 301, 19 lessons): You run OSPF on several routers with FRRouting, manage areas, costs and convergence, and watch the network heal itself when a link breaks.
NAT and the packet path on a Linux router: nftables, conntrack (Level 301, 18 lessons): You work with netfilter’s packet path, connection tracking and source/destination NAT in nftables, solving real problems such as port forwarding and hairpin NAT.
LAN security: ARP, DHCP and 802.1X (Level 301, 19 lessons): You watch attacks such as ARP spoofing, rogue DHCP and MAC flooding in your own isolated lab, detect them and stop them with 802.1X and port security.
Linux virtual networking: namespaces, veth, macvlan (Level 301, 16 lessons): You build a full network on one machine with namespaces, veth pairs, bridges, macvlan and ipvlan, and see from the inside how container and VM networking works.
Enterprise VPNs: IPsec (strongSwan) and OpenVPN (Level 301, 17 lessons): You build IKEv2/IPsec with strongSwan and certificate-based VPNs with OpenVPN, and solve problems with site-to-site links to other vendors.
Mail services: Postfix, Dovecot, SPF, DKIM, DMARC (Level 301, 20 lessons): You run your own mail server with Postfix and Dovecot, protect your domain from spoofing with SPF, DKIM and DMARC, and trace undelivered mail.
Proxies and load balancing: HAProxy, Squid (Level 301, 18 lessons): You set up a forward proxy with Squid and a reverse proxy and load balancer with HAProxy, trying health checks, sticky sessions and TLS termination on real backends.
DNS security: DNSSEC, Unbound, DoT and DoH (Level 301, 16 lessons): You sign a BIND zone with DNSSEC, run a validating resolver with Unbound, and learn to use encrypted DNS and watch for DNS-based threats.
Network monitoring: SNMP, flow data and Prometheus (Level 301, 16 lessons): You build a system that watches devices and links all the time, see who generates how much traffic from flow data, and spot problems before users do with thresholds and alerts.
From RFC to packet: verifying protocol behaviour against the spec (Level 401, 14 lessons): You learn to read protocol standards (RFCs), reproduce edge cases in the lab and compare two systems against the spec, reporting where they differ.
BGP: routing between autonomous systems (FRRouting) (Level 401, 20 lessons): You build eBGP and iBGP sessions with FRRouting and use path attributes and route policies to control which link traffic enters and leaves by.
Redundant gateways and load sharing: VRRP, ECMP, bonding (Level 401, 14 lessons): You build a network with no single point of failure using link bonding, VRRP with keepalived and ECMP, and verify every failover by measuring it.
Tunnels and overlay networks: GRE, VXLAN, EVPN (Level 401, 16 lessons): You build virtual networks on top of the physical one with GRE and VXLAN, add a control plane with EVPN and solve MTU and encryption issues.
Traffic control and QoS: tc and queueing disciplines (Level 401, 15 lessons): You limit bandwidth with tc, build priority classes, emulate delay and loss, and protect sensitive traffic such as voice calls at busy times.
Network automation: Ansible, Netmiko and templates (Level 401, 18 lessons): You move hand-made configuration into templates, inventory and version control, and manage dozens of devices consistently and reversibly with Ansible and Python.
Enterprise network design: segmentation, redundancy, documentation (Level 401, 18 lessons): Starting from requirements you design an organisation’s network — address plan, security zones, redundancy and documents — then build and test it in the lab.
Job role: network administrator (Level 401, 16 lessons): You spend a week as a company’s network administrator: an inherited network, a new branch, user requests and an outage, delivering every job with evidence and documents.
Internet routing security: RPKI, route leaks, incident response (Level 501, 16 lessons): You reproduce route hijacks and leaks between lab ASes, prevent them with RPKI and filtering, and learn from real-world incidents.
Zero-trust network access: identity, mTLS, micro-segmentation (Level 501, 17 lessons): You build an access architecture that checks every request by identity and device state instead of trusting the network, with VPN-less app access, mTLS and fine-grained segmentation.
Job role: network engineer, a multi-site enterprise network (Level 501, 18 lessons): You build a three-site organisation’s network from scratch — OSPF and BGP, redundant gateways, VPN, monitoring and automation — then defend it in planned outage drills.

Projects

A subnet plan for a new school building: You divide a single address block into subnets sized for the classrooms, the computer room, management and printers of the new building of Gelincik Okulları. You apply the plan to the lab devices and show each subnet reaches its gateway.
Check services by hand: web, mail, DNS and time: You check the web, mail, DNS and time services on the guest services server of Mercanköşk Otelcilik one by one with nc, openssl and dig. You prepare a status sheet with each service’s reply, open port and certificate expiry date.
Set up a temporary branch-office network: You plan addresses, routing and basic network settings for a temporary branch office and show its devices can reach headquarters.
Reach a service by name (DNS records): You let people reach an internal service by name instead of IP address using DNS records, and show the name points to the right address.
Choose the right links: latency, bandwidth, backup: You compare latency, bandwidth and backup needs and recommend, with reasons, the best connection option for an office.
Move a site to a new address (DNS cut-over): You plan the DNS change for moving a website to a new server address, complete the switch without downtime, and show traffic no longer goes to the old address.
WireGuard access for remote staff: You set up a WireGuard server for the lawyers of Sedirli Hukuk Bürosu who work from home, giving each person their own key and access to the file server only. You revoke the key of someone who has left and show their connection no longer works.
A nightly sync between two branches: SSH keys and rsync: You sync the design files from the workshop of Karaçam Mobilya to the head office server with rsync every night. You turn off password login, define a restricted key that can do only this job, and show an interrupted transfer resumes where it stopped.
Three faults on an office network: find and fix them layer by layer: The office network of Ilgıntepe Tekstil has three complaints: one department cannot reach the internet, a server cannot be found by name, and one link is very slow. You find each fault by testing from the lowest layer upwards, fix it, and write a fault report with the evidence.
Run network services: DNS, DHCP and file sharing: You set up DNS (name lookup), DHCP (automatic addresses) and file sharing for a small office network, and show all devices work smoothly.
Separate guest and staff devices: You split guest and staff devices onto separate networks and show guests cannot reach internal systems while staff keep working.
Connect two sites with a secure tunnel: You join two office networks with an encrypted tunnel and verify that traffic between them is protected and the networks can see each other.
Serve a service over IPv6 as well: You make an existing service reachable over IPv6, the newer address system, as well as IPv4, and show it works over both.
Dynamic routing with OSPF between three depots: You connect the three depots of Mavikaya Lojistik with OSPF instead of hand-written routes. You cut one link on purpose, measure how quickly traffic moves to the backup path, and document it with the routing tables.
NAT and a firewall on a Linux router (nftables): You write an nftables ruleset on a Linux router for the factory network of Ayçiçeği Gıda: everything closed by default, address translation (NAT) for the internal network, port forwarding for the order server. You show with a test table what each rule allows and blocks.
Set up mail for a domain and authenticate it: SPF, DKIM, DMARC: You set up a mail server with Postfix and Dovecot for the lavinya.lab domain of Lavinya Klinikleri. You add SPF, DKIM and DMARC records and show in the headers of a message sent to a second domain that all three checks pass.
A redundant gateway: VRRP and link bonding: On the branch network of Yelkovan Bankası you turn the single gateway into two routers sharing a virtual address with VRRP, and make the server uplink a bonded pair. You switch off the active router and measure how many packets are lost and how many seconds the takeover takes.
Standardise router settings with Ansible templates: You move the hand-entered settings on six routers of Yakamoz Telekom into one Ansible template with per-device variable files. You apply the template, catch a manual change on one device with a drift report, and put it right.
A campus network design document: segmentation, redundancy, addressing: You write a network design document for the three-building campus of Saklıvadi Üniversitesi: segments, a redundant backbone, an address plan and which segment may reach which. You build the most critical part in the lab and show the access rules in the document hold.
Guard against wrong route announcements: origin validation with RPKI: On the network of Demirsu Enerji, connected to two providers, you examine the records of a wrong route announcement incident prepared in the lab. You add RPKI origin validation and prefix filters to the border routers, show the invalid announcement is no longer accepted, and write the incident report.