Network, VPN & proxy configuration and testing
Join networks, set DNS, proxies and VPN profiles, and verify connectivity, speed and latency.
20 project-authored proposals · taxonomy v1.1 · 0 new benchmark runs. Verifiers and partial-credit rules below are designs, not executed results.
- Typical applications
- Network settings · VPN clients
- Class GUI-need label
G2· GUI-essential
Task proposals · 20
Expand to inspect the complete original wording and proposed checks. Original proposal text remains English in both interfaces.
R01.04.01.01-T01 Set two DNS servers on Wi-Fi
Original instruction
In Network > Wi-Fi > Details > DNS, replace the current DNS servers with exactly 1.1.1.1 and 9.9.9.9 in that order. Leave search domains unchanged.
- Platforms
mac· macOS- Applications
- Network settings
- Interfaces
desk· Desktop GUI- GUI need · task setting
G2· GUI-essential- GUI need · ordinary access
CL· CLI-sufficient- Interaction primitives
click· Point & clicktype· Text & forms- Work product
WP08· App/system state- Conditions
- None declared
- Proposed difficulty
- 2 / 5
Proposed verifier
`networksetup -getdnsservers Wi-Fi` (grader) lists exactly 1.1.1.1 then 9.9.9.9; search domains equal seed. Terminal withheld; eslogger detecting networksetup/scutil by the agent -> 0.
Proposed partial credit
70% exact servers; 20% order; 10% search domains unchanged
R01.04.01.01-T02 Manual proxy with a bypass list on Windows 11
Original instruction
Set a manual proxy 10.0.0.5:3128 in Settings > Network & internet > Proxy, bypass it for *.local and *.corp.test, and tick 'Don't use the proxy server for local (intranet) addresses'.
- Platforms
win· Windows- Applications
- Network settings · Windows Settings
- Interfaces
desk· Desktop GUI- GUI need · task setting
G2· GUI-essential- GUI need · ordinary access
CL· CLI-sufficient- Interaction primitives
click· Point & clicktype· Text & forms- Work product
WP08· App/system state- Conditions
- None declared
- Proposed difficulty
- 2 / 5
Proposed verifier
HKCU Internet Settings ProxyEnable=1, ProxyServer=10.0.0.5:3128, ProxyOverride contains *.local;*.corp.test;<local>. regedit/cmd/PowerShell blocked by AppLocker; Sysmon EID1 detects reg.exe/netsh winhttp by the agent -> 0.
Proposed partial credit
40% proxy enabled with address; 40% bypass entries; 20% local addresses bypass
R01.04.01.01-T03 Authenticated HTTP/HTTPS proxy on macOS
Original instruction
Configure Wi-Fi to use web proxy (HTTP) and secure web proxy (HTTPS) proxy.test:8080 with username/password from fixtures/proxy_creds.txt, bypass '*.corp.test, 169.254/16', and confirm Safari can load http://check.test through it.
- Platforms
mac· macOS- Applications
- Network settings · Safari
- Interfaces
desk· Desktop GUI- GUI need · task setting
G2· GUI-essential- GUI need · ordinary access
G2· GUI-essential- Interaction primitives
click· Point & clicktype· Text & forms- Work product
WP08· App/system state- Conditions
- None declared
- Proposed difficulty
- 3 / 5
Proposed verifier
`networksetup -getwebproxy/-getsecurewebproxy Wi-Fi` enabled, host/port; authenticated flag on; bypass list exact; proxy access log shows authenticated GET check.test from this host. Terminal withheld; eslogger detects networksetup -> 0.
Proposed partial credit
30% HTTP proxy; 30% HTTPS proxy; 20% bypass list; 20% authenticated request logged
R01.04.01.01-T04 Import a WireGuard tunnel in GNOME and limit autoconnect
Original instruction
In GNOME Settings > Network > VPN, import ~/wg0.conf as a WireGuard connection named 'Office', set it not to connect automatically, and make it available to this user only. Connect once and confirm 10.99.0.1 is reachable.
- Platforms
lin· Linux- Applications
- GNOME Settings · VPN clients
- Interfaces
desk· Desktop GUI- GUI need · task setting
G2· GUI-essential- GUI need · ordinary access
CL· CLI-sufficient- Interaction primitives
click· Point & clicktype· Text & forms- Work product
WP08· App/system state- Conditions
- None declared
- Proposed difficulty
- 3 / 5
Proposed verifier
`nmcli -f connection.id,connection.type,connection.autoconnect,connection.permissions connection show Office`: wireguard, autoconnect no, permissions user:<u>; ping log 10.99.0.1 success from the session. Terminal withheld; auditd detects nmcli by the agent -> 0.
Proposed partial credit
40% imported and named; 20% autoconnect off; 15% user-only; 25% connected and reachable
R01.04.01.01-T05 Static IPv4 with DNS suffix on Ethernet
Original instruction
Set the Ethernet adapter to static IPv4 192.168.50.20/24, gateway 192.168.50.1, DNS 192.168.50.2 then 1.1.1.1, and connection-specific DNS suffix corp.test. Keep IPv6 on automatic.
- Platforms
win· Windows- Applications
- Network settings · Control Panel
- Interfaces
desk· Desktop GUI- GUI need · task setting
G2· GUI-essential- GUI need · ordinary access
CL· CLI-sufficient- Interaction primitives
click· Point & clicktype· Text & formsnav· Pan/zoom/scroll- Work product
WP08· App/system state- Conditions
- None declared
- Proposed difficulty
- 3 / 5
Proposed verifier
Get-NetIPConfiguration (grader): IPv4 address/prefix, default gateway, DNS order; Get-DnsClient ConnectionSpecificSuffix corp.test; IPv6 DHCP/RA unchanged. cmd/PowerShell blocked by AppLocker; Sysmon detects netsh/New-NetIPAddress by the agent -> 0.
Proposed partial credit
35% address/mask/gateway; 30% DNS order; 20% suffix; 15% IPv6 unchanged
R01.04.01.01-T06 Create an Office network location with static IP and PAC
Original instruction
Create a network location 'Office' where Ethernet uses static IP 10.20.5.40/24 router 10.20.5.1 and automatic proxy configuration http://pac.corp.test/proxy.pac, while the 'Automatic' location stays unchanged. Switch to 'Office'.
- Platforms
mac· macOS- Applications
- Network settings
- Interfaces
desk· Desktop GUI- GUI need · task setting
G2· GUI-essential- GUI need · ordinary access
CL· CLI-sufficient- Interaction primitives
click· Point & clicktype· Text & formsnav· Pan/zoom/scroll- Work product
WP08· App/system state- Conditions
- None declared
- Proposed difficulty
- 4 / 5
Proposed verifier
`networksetup -listlocations` includes Office and current location Office; scutil/preferences.plist for Office: manual IPv4 values and ProxyAutoConfigURLString; Automatic set's services hash-equal seed. Terminal withheld; eslogger detects networksetup -> 0 (control pair T20).
Proposed partial credit
25% location created and active; 35% static IP; 25% PAC URL; 15% Automatic untouched
R01.04.01.01-T07 Split-tunnel IKEv2 VPN with built-in Windows client
Original instruction
Add a built-in VPN 'Lab IKEv2' to vpn.test (IKEv2, EAP-MSCHAPv2, credentials in fixtures\vpn.txt). In the adapter's IPv4 advanced settings untick 'Use default gateway on remote network', add a route so only 10.20.0.0/16 uses the VPN, connect, and confirm public IP unchanged.
- Platforms
win· Windows- Applications
- VPN clients · Windows Settings · Control Panel
- Interfaces
desk· Desktop GUI- GUI need · task setting
G2· GUI-essential- GUI need · ordinary access
CL· CLI-sufficient- Interaction primitives
click· Point & clicktype· Text & formsnav· Pan/zoom/scroll- Work product
WP08· App/system state- Conditions
- None declared
- Proposed difficulty
- 5 / 5
Proposed verifier
Get-VpnConnection: TunnelType Ikev2, AuthenticationMethod Eap, SplitTunneling true; Get-VpnConnectionRoute includes 10.20.0.0/16; connected state; egress-IP echo service sees non-VPN IP while 10.20.1.1 reachable. PowerShell blocked by AppLocker; Sysmon detects Add-VpnConnection/rasdial by the agent -> 0.
Proposed partial credit
30% VPN profile; 30% split tunnel; 20% route; 20% connected with correct egress
R01.04.01.01-T08 Install and approve a VPN configuration profile
Original instruction
Install fixtures/lab_vpn.mobileconfig by opening it and approving it in System Settings > Privacy & Security > Profiles (admin password in fixtures/admin.txt), then connect the 'Lab IKEv2' VPN it adds and confirm 10.99.0.1 is reachable.
- Platforms
mac· macOS- Applications
- System Settings · VPN clients
- Interfaces
desk· Desktop GUI- GUI need · task setting
G3· GUI-only- GUI need · ordinary access
G2· GUI-essential- Interaction primitives
click· Point & clicktype· Text & forms- Work product
WP08· App/system state- Conditions
- None declared
- Proposed difficulty
- 4 / 5
Proposed verifier
`profiles list` includes the profile identifier; `scutil --nc list` shows Lab IKEv2 Connected; utun interface has 10.99.x address; ping 10.99.0.1 succeeds. `profiles install` is not available for user profiles on modern macOS, so GUI approval is required; Terminal withheld and eslogger detects scutil --nc start -> 0.
Proposed partial credit
40% profile installed; 30% VPN connected; 30% host reachable
R01.04.01.01-T09 Import a WireGuard tunnel and convert it to split tunnel
Original instruction
Import fixtures/full_tunnel.conf into the WireGuard app, edit it so only 10.99.0.0/24 and 10.98.0.0/24 go through the tunnel (not 0.0.0.0/0), keep DNS unset, activate it, and check that your public IP is unchanged while 10.99.0.10 responds.
- Platforms
mac· macOSwin· Windows- Applications
- WireGuard · VPN clients
- Interfaces
desk· Desktop GUI- GUI need · task setting
G2· GUI-essential- GUI need · ordinary access
CL· CLI-sufficient- Interaction primitives
click· Point & clicktype· Text & forms- Work product
WP08· App/system state- Conditions
- None declared
- Proposed difficulty
- 4 / 5
Proposed verifier
Tunnel config (app store/keychain or C:\Program Files\WireGuard\Data\Configurations dpapi) AllowedIPs exactly two CIDRs, no DNS; tunnel active; egress echo IP equals pre-task; curl 10.99.0.10 OK. Terminal/PowerShell withheld; eslogger/Sysmon detect wg-quick or wireguard.exe /installtunnelservice by the agent -> 0.
Proposed partial credit
20% imported; 40% AllowedIPs edited; 20% active; 20% correct egress and reachability
R01.04.01.01-T10 Join a hidden WPA3 network with fixed private address
Original instruction
On the lab test Mac join the hidden network 'LAB-5G' (WPA3 Personal, password in fixtures/wifi.txt) via 'Other…', enable Auto-Join, turn on Low Data Mode for it, and set Private Wi-Fi address to Fixed.
- Platforms
mac· macOS- Applications
- Network settings · Control Center
- Interfaces
desk· Desktop GUI- GUI need · task setting
G2· GUI-essential- GUI need · ordinary access
G2· GUI-essential- Interaction primitives
click· Point & clicktype· Text & forms- Work product
WP08· App/system state- Conditions
- None declared
- Proposed difficulty
- 3 / 5
Proposed verifier
Preferred networks (com.apple.wifi.known-networks.plist) entry LAB-5G: Hidden=1, SecurityType WPA3, AutoJoin=1, LowDataMode=1, PrivateMACAddressMode=fixed; currently associated SSID LAB-5G. Terminal withheld; eslogger detects networksetup -addpreferredwirelessnetwork -> 0.
Proposed partial credit
40% joined hidden WPA3; 20% auto-join; 20% low data; 20% fixed private address
R01.04.01.01-T11 Prune saved Wi-Fi networks and set metered Office
Original instruction
Forget every saved Wi-Fi network except 'Office' and 'Home'. Set 'Office' as a metered connection and set its random hardware addresses option to 'Change daily'.
- Platforms
win· Windows- Applications
- Network settings · Windows Settings
- Interfaces
desk· Desktop GUI- GUI need · task setting
G2· GUI-essential- GUI need · ordinary access
CL· CLI-sufficient- Interaction primitives
click· Point & clicknav· Pan/zoom/scroll- Work product
WP08· App/system state- Conditions
risk· Irreversible/risky- Proposed difficulty
- 3 / 5
Proposed verifier
`netsh wlan show profiles` (grader) lists only Office and Home; Office profile cost Fixed (metered) via WLAN cost policy; random MAC setting 'daily' in WlanSvc interface profile. cmd/PowerShell blocked by AppLocker; Sysmon detects netsh wlan delete profile by the agent -> 0.
Proposed partial credit
40% only two profiles left; 30% metered; 30% random MAC daily
R01.04.01.01-T12 Firefox-only SOCKS5 proxy with remote DNS
Original instruction
Make only Firefox use the SOCKS5 proxy 127.0.0.1:1080 with 'Proxy DNS when using SOCKS v5' on and no proxy for localhost and *.corp.test. The system proxy settings must remain off.
- Platforms
mac· macOSwin· Windowsweb· Any OS (web)- Applications
- Firefox
- Interfaces
brow· Browser- GUI need · task setting
G2· GUI-essential- GUI need · ordinary access
CL· CLI-sufficient- Interaction primitives
click· Point & clicktype· Text & forms- Work product
WP08· App/system state- Conditions
- None declared
- Proposed difficulty
- 3 / 5
Proposed verifier
Firefox prefs.js: network.proxy.type=1, socks host/port, socks_version=5, socks_remote_dns=true, no_proxies_on contains both entries; system proxy unchanged; SOCKS server log shows Firefox CONNECT with hostname (not IP). Shells withheld; eslogger/Sysmon detect prefs.js/user.js edits not made by Firefox -> 0.
Proposed partial credit
40% SOCKS configured; 25% remote DNS; 15% bypass list; 20% system proxy untouched
R01.04.01.01-T13 Write a PAC file with failover and apply it system-wide
Original instruction
Write proxy.pac so *.corp.test and 10.0.0.0/8 go DIRECT, *.partner.test goes via proxy-a.test:3128 then proxy-b.test:3128 as fallback, and everything else via proxy-a only. Serve it from the provided local web root and set it as the automatic proxy URL in system settings.
- Platforms
mac· macOSwin· Windows- Applications
- Network settings · text editor
- Interfaces
desk· Desktop GUIterm· Terminal- GUI need · task setting
HY· Hybrid- GUI need · ordinary access
CL· CLI-sufficient- Interaction primitives
code· Code & commandsclick· Point & clicktype· Text & forms- Work product
WP08· App/system state- Conditions
- None declared
- Proposed difficulty
- 5 / 5
Proposed verifier
Grader evaluates FindProxyForURL with pacparser on 30 URL/host cases (exact return strings); system auto-proxy URL set (networksetup/WinHTTP-IE AutoConfigURL); live request to app.partner.test logged by proxy-a.
Proposed partial credit
60% PAC logic cases; 25% system uses PAC URL; 15% live request routed
R01.04.01.01-T14 Corporate VPN client connect after trusting the right CA
Original instruction
Cisco Secure Client warns about an untrusted server when connecting to vpn.lab.test. Do not click 'Connect Anyway'. Import fixtures/LabRootCA.cer into the trusted root store, then connect with group 'Engineering' and the test credentials.
- Platforms
mac· macOSwin· Windows- Applications
- Cisco Secure Client · Keychain Access · Certificate Manager
- Interfaces
desk· Desktop GUI- GUI need · task setting
G2· GUI-essential- GUI need · ordinary access
CL· CLI-sufficient- Interaction primitives
click· Point & clicktype· Text & forms- Work product
WP08· App/system state- Conditions
licensed· Licensed pro apprisk· Irreversible/risky- Proposed difficulty
- 5 / 5
Proposed verifier
Trust store contains LabRootCA (thumbprint exact) and no other new roots; client profile/preferences BlockUntrustedServers unchanged; headend log shows session for group Engineering with valid cert chain; client UI log has no 'Connect Anyway' event. Terminal/PowerShell withheld; eslogger/Sysmon detect `security add-trusted-cert`/certutil -> 0.
Proposed partial credit
30% correct CA trusted; 20% no untrusted-server bypass; 50% connected to right group
R01.04.01.01-T15 Restore internet on a Mac that says 'connected, no internet'
Original instruction
Wi-Fi shows connected but no pages load. Seeded causes: a stale manual web proxy pointing to 10.9.9.9 and a DNS server 192.0.2.53 that does not answer. Fix the network settings so https://check.test loads; do not change the Wi-Fi network.
- Platforms
mac· macOS- Applications
- Network settings · Safari
- Interfaces
desk· Desktop GUI- GUI need · task setting
G2· GUI-essential- GUI need · ordinary access
CL· CLI-sufficient- Interaction primitives
click· Point & clicknav· Pan/zoom/scroll- Work product
WP08· App/system state- Conditions
- None declared
- Proposed difficulty
- 3 / 5
Proposed verifier
`networksetup -getwebproxy Wi-Fi` Enabled: No; DNS set to working servers or DHCP; Safari load of check.test logged by test server; SSID unchanged. Terminal withheld; eslogger detects networksetup -> 0.
Proposed partial credit
40% proxy cleared; 40% DNS fixed; 20% verified load
R01.04.01.01-T16 Per-domain DNS resolver for an internal zone
Original instruction
The VPN does not push DNS for corp.test. Make only *.corp.test queries go to 10.20.0.53 (create /etc/resolver/corp.test with admin rights) and add corp.test as a search domain in Network settings for Wi-Fi. Other lookups must keep using DHCP DNS.
- Platforms
mac· macOS- Applications
- Network settings · Terminal
- Interfaces
desk· Desktop GUIterm· Terminal- GUI need · task setting
HY· Hybrid- GUI need · ordinary access
CL· CLI-sufficient- Interaction primitives
code· Code & commandsclick· Point & clicktype· Text & forms- Work product
WP08· App/system state- Conditions
- None declared
- Proposed difficulty
- 4 / 5
Proposed verifier
`scutil --dns` shows a resolver for domain corp.test → 10.20.0.53; Wi-Fi search domains include corp.test; dscacheutil resolves wiki.corp.test to 10.20.1.5 and example.test via DHCP DNS; /etc/hosts unchanged.
Proposed partial credit
40% scoped resolver; 25% search domain via GUI; 25% resolution behaves; 10% hosts untouched
R01.04.01.01-T17 Private DNS and a Wi-Fi proxy on Android
Original instruction
On the Android emulator set Private DNS to the hostname dns.test.example, and for the saved Wi-Fi network 'LAB' set a manual proxy proxy.test:8080 bypassing localhost and *.corp.test.
- Platforms
and· Android- Applications
- Android Settings
- Interfaces
mob· Mobile touch- GUI need · task setting
G2· GUI-essential- GUI need · ordinary access
G2· GUI-essential- Interaction primitives
touch· Touch gesturestype· Text & forms- Work product
WP08· App/system state- Conditions
- None declared
- Proposed difficulty
- 3 / 5
Proposed verifier
`settings get global private_dns_mode` = hostname and private_dns_specifier = dns.test.example; WifiConfigStore.xml LAB ProxySettings STATIC host/port/exclusions. adb is withheld from the agent; these settings are reachable only through the emulator Settings UI.
Proposed partial credit
45% private DNS; 40% Wi-Fi proxy; 15% exclusion list
R01.04.01.01-T18 OpenVPN profile with saved key password and kill switch
Original instruction
Import fixtures/branch.ovpn into OpenVPN Connect, save the private-key password from fixtures/key_pw.txt in the profile, enable the 'Seamless Tunnel' (block traffic when disconnected) option, and connect.
- Platforms
mac· macOSwin· Windows- Applications
- OpenVPN Connect · VPN clients
- Interfaces
desk· Desktop GUI- GUI need · task setting
G2· GUI-essential- GUI need · ordinary access
G2· GUI-essential- Interaction primitives
click· Point & clicktype· Text & forms- Work product
WP08· App/system state- Conditions
- None declared
- Proposed difficulty
- 4 / 5
Proposed verifier
OpenVPN Connect config store: profile imported with saved PK password flag; seamless tunnel enabled; server log shows client connect; when grader drops the server, outbound test request is blocked. Terminal/PowerShell withheld; eslogger/Sysmon detect ovpncli/openvpn CLI by the agent -> 0.
Proposed partial credit
30% imported with saved password; 30% seamless tunnel; 25% connected; 15% blocking verified
R01.04.01.01-T19 Reorder network services and disable unused ones
Original instruction
Set the network service order so Ethernet is above Wi-Fi, make Thunderbolt Bridge inactive and remove the unused 'USB 10/100 LAN' service.
- Platforms
mac· macOS- Applications
- Network settings
- Interfaces
desk· Desktop GUI- GUI need · task setting
G2· GUI-essential- GUI need · ordinary access
CL· CLI-sufficient- Interaction primitives
click· Point & clickdrag· Drag & drop- Work product
WP08· App/system state- Conditions
risk· Irreversible/risky- Proposed difficulty
- 2 / 5
Proposed verifier
`networksetup -listnetworkserviceorder` has Ethernet before Wi-Fi; Thunderbolt Bridge marked disabled (*); 'USB 10/100 LAN' absent. Terminal withheld; eslogger detects networksetup -ordernetworkservices -> 0.
Proposed partial credit
40% order; 30% Thunderbolt Bridge inactive; 30% service removed
R01.04.01.01-T20 Create the Office location with networksetup (control)
Original instruction
Control pair of T06: from the terminal with admin rights, create location 'Office' with Ethernet static 10.20.5.40/24 router 10.20.5.1 and PAC URL http://pac.corp.test/proxy.pac, keep 'Automatic' unchanged, and switch to Office.
- Platforms
mac· macOS- Applications
- networksetup · scutil
- Interfaces
term· Terminal- GUI need · task setting
CL· CLI-sufficient- GUI need · ordinary access
CL· CLI-sufficient- Interaction primitives
code· Code & commands- Work product
WP08· App/system state- Conditions
- None declared
- Proposed difficulty
- 3 / 5
Proposed verifier
Same configuration checks as T06; measures the GUI-vs-CLI gap on an identical end state.
Proposed partial credit
25% location active; 35% static IP; 25% PAC; 15% Automatic untouched
Mapped research references
Existing benchmark-to-class links from the research catalog. They are not record-level annotations, executions or product endorsements.