SILAB documentation

Getting started

Installation

SILAB installs everything it needs — QEMU, the RouterOS image, nginx and its own services — from one command. It is independent: it installs on a clean Ubuntu box and sits beside anything else already on the host without touching it.

Every install is verified: the bootstrap checks the release manifest's signature against SILAB's release key and the bundle's SHA256 before anything runs, then asks you to accept MikroTik's licence.

Pick your platform:

• L Linux (one command) Ubuntu 22.04 / 24.04 / 26.04, amd64 or arm64. No VT-x needed.
• W Windows (WSL2) Windows 10 (2004+) or 11 — its own WSL2 instance and a desktop menu.
• i Requirements & options Hardware sizing, what the installer sets up, environment overrides.

Installation

Linux (one command)

On Ubuntu 22.04, 24.04 or 26.04 (amd64 or arm64), run as root:

curl -fsSL https://silab.securytik.com/install.sh | sudo bash

The installer downloads from our download bucket, and from SILAB's GitHub release by itself when the bucket cannot be reached — there is nothing to choose.

What happens

1. The bootstrap fetches the latest release manifest, checks its signature and expiry, downloads the bundle and checks its SHA256. A mismatch stops the install before anything runs.
2. It asks you to accept MikroTik's licence for RouterOS CHR, then downloads the latest stable CHR image from MikroTik and verifies its SHA256. The image is never redistributed by SILAB.
3. It installs QEMU, nginx and SILAB's services, and publishes the web UI on port 80 — or 8088 when port 80 is already taken, for example by SAMM.

First sign-in

Open the server in a browser and sign in:

Change the password right away under System → Profile. SILAB shows a warning while the default password is in use.

Installation

Windows (WSL2)

SILAB runs on Windows 10 (version 2004 or newer) and Windows 11 in its own WSL2 instance, set up by one installer. Open PowerShell — not Command Prompt (cmd) — and run the line below. If PowerShell is not running as administrator, Windows asks for permission: click Yes and the installation continues in a new administrator window.

irm https://silab.securytik.com/install.ps1 | iex

It downloads from our download bucket, and from SILAB's GitHub release by itself when the bucket cannot be reached.

The bootstrap downloads the full installer to %ProgramData%\SILAB\silab-windows.ps1 and runs it from there, so it can elevate itself and carry on after a restart.

What happens

1. It enables WSL2. The first time this needs one restart of Windows; setup then continues by itself.
2. It imports a dedicated Ubuntu 24.04 instance named SILAB (checksum-verified). Your other WSL distributions are untouched.
3. It installs SILAB inside that instance with the Linux installer.
4. It adds a SILAB icon to the desktop and the Start menu: a small menu to Start, Stop, see the Status, Open it in the browser, and Share on the LAN so other PCs — and their WinBox — can reach the lab.

Installing from a downloaded file

The full installer can also be run directly, for example from a copy on a USB stick:

powershell -ExecutionPolicy Bypass -File silab-windows.ps1

Uninstalling

-Uninstall removes the SILAB instance, the shortcut and the LAN sharing rules:

powershell -ExecutionPolicy Bypass -File "$env:ProgramData\SILAB\silab-windows.ps1" -Uninstall

Installation

Requirements & options

Requirements

• Linux: Ubuntu 22.04, 24.04 or 26.04, amd64 or arm64, with root / sudo access. KVM is used automatically when /dev/kvm is usable; without it SILAB runs under software emulation — no VT-x needed.
• Windows: Windows 10 version 2004 (build 19041) or newer, or Windows 11, with hardware virtualization (VT-x / AMD-V) switched on for WSL2.
• Size: 2 cores and 4 GB of RAM run a handful of routers; plan about 200–300 MB of RAM per router.
• RouterOS: CHR 7.15 or newer, downloaded from MikroTik.

What the installer sets up

Environment overrides

Set these in front of the install command, e.g. curl -fsSL https://silab.securytik.com/install.sh | sudo SILAB_HTTP_PORT=8080 bash.

Getting started

Your first lab

Two routers and a cable, from an empty canvas to a ping across the link.

1. Sign in as admin / admin and change the password under System → Profile.
2. Create a lab, then open Lab → Topology.
3. Click + Node and add two Router (CHR) nodes — R1 and R2 in this example.
4. Click + Connect, click R1 then R2, and pick the ports — for example ether1 on both.
5. Press Start lab. Under software emulation a clean two-router lab is up and provisioned in about half a minute.
6. Double-click R1 to open its console, give ether1 an address on each router, and use Ping — click R1, then R2 — to test the cable.

The lab file

A lab is a small YAML diagram. Exported as a .silab file it carries the diagram plus one .rsc per router — usually a few KB. The receiver's SILAB rebuilds the lab from its own RouterOS image, and imported files are validated strictly: no host paths, no raw QEMU arguments.

silab: 1
name: OSPF basics
routeros: "7.24.4"
nodes:
  - {id: 1, name: R1, kind: router, x: 100, y: 100, config: R1.rsc}
  - {id: 2, name: R2, kind: router, x: 400, y: 100}
  - {id: 3, name: LAN, kind: hub,    x: 250, y: 300}
  - {id: 4, name: PC1, kind: pc,     x: 250, y: 450}
links:
  - {a: {node: 1, port: 1}, b: {node: 2, port: 1}, delay_ms: 20}
  - {a: {node: 2, port: 2}, b: {node: 3}}
  - {a: {node: 4}, b: {node: 3}}

A lab pins its RouterOS version, so a shared lab behaves the same everywhere.

Building labs

Nodes & cables

Add nodes with + Node and cable them port to port with + Connect — while the lab runs, with no restart.

Node types

Rename a router on the canvas and its RouterOS identity follows, live. Each router can carry a startup configuration (.rsc), applied on first boot.

Cables

• Point-to-point cables pass every frame: STP, LACP, LLDP, MNDP and VLAN tags.
• Unplug and plug a cable, or impair it on purpose: delay, jitter, loss, bandwidth.
• Several cables between the same two nodes are drawn side by side, each with its own labels.
• Right-click a cable to capture it live in Wireshark.

Power

Right-click a router for a VMware-style power menu:

Building labs

Reaching a router

Double-click a router for its console in the browser. It works over the router's serial port, so it keeps working even when the student has erased every IP address. Every router also gets fixed ports on the SILAB host, reachable from the LAN or the Internet.

So router 1 answers WinBox on 20010, SSH on 20011 and WebFig on 20012; router 2 on 20020, 20021 and 20022. Routers log in as admin / admin.

ssh -p 20011 admin@<silab-host>

WinBox in one click

Right-click a router → WinBox and WinBox opens already connected, with the address, user and password filled in. A web page cannot start a program on your PC by itself, so this needs the WinBox helper, installed once per PC from System → Helpers:

• Windows — download the helper, right-click it → Run with PowerShell. If it cannot find WinBox, it asks where WinBox.exe is. Restart the browser once.
• Linux — download the helper and run sh silab-winbox-linux.sh (not as root). It finds WinBox, or asks for the path of the WinBox binary.
• macOS — until a helper exists, right-click a router → Links → WinBox copies the address.

The helper needs no administrator rights. You need WinBox itself first, from mikrotik.com/download.

The management port

SILAB reaches each router through a management port kept in its own VRF, vrf-mgmt: out of the student's routing table and out of OSPF and BGP. The student's ports stay ether1..N, exactly as drawn.

Building labs

Virtual PCs

A PC node is a lightweight client with no VM behind it. Set its IP from the canvas — DHCP client, Static, PPPoE client (optionally only the server offering a given service name) or No address — or from its console. The console has no host shell behind it; these are its commands:

Ping between any two devices

Next to + Connect on the topology, Ping tests reachability without opening a console: click two devices, five pings run in the background, and the result opens in a pop-up. SILAB pings the address on the subnet the two share, else the target's first address; an Internet node as the target pings 8.8.8.8.

Building labs

Capture in Wireshark

Right-click a cable → Capture in Wireshark: Wireshark opens on your PC and shows that cable's traffic live, in both directions, until you close it.

Install the Wireshark helper once

Like WinBox, this needs a small helper per PC, from System → Helpers. It needs no administrator rights.

• Windows — download the helper, right-click it → Run with PowerShell. If it cannot find Wireshark, it asks where Wireshark.exe is. Restart the browser once: capture links then open Wireshark without asking.
• Linux — download the helper and run sh silab-wireshark-linux.sh (not as root). It finds Wireshark, or asks for the path of the wireshark binary. It needs curl.

You need Wireshark itself first, from wireshark.org.

Building labs

Bulk actions

Lab → Bulk actions makes one change on every router of the lab — or the ones you tick — and shows the result per router.

System

Updates

System → Updates shows the installed version, the latest release and What's new. A daily timer checks for new releases.

1. Apply update downloads the signed release and checks it.
2. It backs up the install to /var/backups/silab, swaps in the new files and restarts the engine and the web. Running routers keep running.
3. If anything fails, the previous version is put back automatically.

After an Ubuntu release upgrade (22.04 → 24.04 → 26.04) the services rebuild SILAB's Python environment themselves on their next start; re-running the installer also works.

RouterOS versions

Several RouterOS versions can be installed side by side, and SILAB tells you when a newer RouterOS is out. Nothing updates on its own: a lab pins its version. Add one from the command line:

silab image latest
silab image pull 7.24.4
silab image list

System

Backup & restore

System → Backup & restore creates, downloads, uploads and restores backups.

• Every backup holds every lab with its startup configs, the accounts and the settings.
• Tick Include the routers' disks to keep their full state too — the file is larger.
• RouterOS images are not included; they are downloaded again from MikroTik.
• An automatic backup runs every day at 04:00 (server clock). Choose how many automatic copies to keep; backups you made or uploaded yourself are never deleted.
• Uploads must be a .tar.gz made by SILAB; anything else is refused.

From the command line:

silab backup create --disks
silab backup list

System

Command line

Everything on the canvas can also be done from the server's shell with silab:

silab lab load ospf-basics.silab
silab up
silab link impair R1:1 --delay 50 --loss 2
silab console R1

Reference

FAQ & troubleshooting

Need more help?

Email [email protected] to report a bug or request a feature.