MikroTik Security Engineer with LABS

Implement port knocking on MikroTik to secure login by requiring a defined knock sequence and time-limited access for known IPs, using specific ports.

Learn to secure MikroTik by changing the default admin password, renaming the account, and creating users with assigned privilege groups or custom privileges to control login and permissible actions.

Demonstrates a DHCP starvation attack and prevents it by configuring a Mikrotik switch with bridge firewall, IP firewall, and bridge filters to allow only one MAC address.

Master DHCP snooping on MikroTik by turning ports into a bridge, designating the desktop server port as trusted, and isolating others to block rogue DHCP servers while validating IP assignment.

Explore the packet flow on MikroTik, demystifying backflow charts, and show how packets move through routing and bridges with five practical flow examples to aid QoS setup.

Explore MikroTik packet flow through practical examples, tracing how a packet moves from interfaces through bridges, pre routing, routing decisions, input, forward, and post routing.

Learn how connection tracking drives the MikroTik firewall, why disabling it stops internet access, and how correct lab configurations preserve routing, filtering, and resources.

Explore connection states in MikroTik RouterOS—new, established, related, and invalid—and learn how the firewall and connection tracking permit or drop traffic in a practical lab.

Configure a MikroTik firewall using connection state to allow established, related, and new traffic while dropping invalid packets, and control access via IP and MAC rules.

Demonstrates brute force attacks on MikroTik routers, using a rockyou wordlist and Hydra, and implements a firewall-based prevention with staged login attempts and 30-day IP blocking.

Protect MikroTik networks from ICMP smurf attacks by configuring input ICMP rules to drop broadcast traffic and block ISP ICMP on the Internet interface, then validate with the lab.

Block bogon IP addresses on a MikroTik firewall by creating an address list and applying a forward filter to drop any traffic from those addresses on the internet-facing interface.

Enable port scan detection on the MikroTik firewall, add offending IP addresses to an address list, and drop traffic from those IPs in both input and forward chains.

Configure MikroTik raw firewall to drop icmp before connection tracking using pre-routing and input chains, then compare raw and standard filter rules to identify the active one.

Block UDP DNS flooding from the internet by applying pre-routing firewall rules that drop UDP port 53 on the outside interface, disable remote DNS requests, and limit inside DNS traffic.

Demonstrate dst-nat to translate the destination address to the router's IP for port 80 web traffic, enabling internal users to reach websites while https traffic is unaffected.

Master how to use MikroTik mangle rules to hide your router IP address during traceroute by incrementing TTL and applying pre-routing changes, enabling a secure firewall design.

Explore what vpn is, why you need it, and the types and protocols available on MikroTik, with labs that show how to configure them on the Raptor.

Explore how l2tp ipsec tunneling secures vpn connections on mikrotik devices. Learn about port 1701, 256-bit encryption, site-to-site and client-to-site lab setups, and trade-offs of using ipsec or no ipsec.

Configures a MikroTik L2TP site-to-site VPN between headquarter and branch office, detailing server and client setup, encryption options, and route configuration to access the headquarter server over the VPN.

Configure l2tp/ipsec client to site vpn for remote users, validate connectivity to the headquarters ip, set up the ipsec profile, and use Windows built-in vpn to establish the connection.

Explore SSTP tunneling protocol and its use on port 443 for secure vpn connections. Compare its encryption, configuration ease, and site-to-site or client-to-site deployment against OpenVPN.

Configure a site-to-site scdp vpn between MikroTik headquarter and branch offices without certificates, creating a user secret, enabling scdp, and establishing routes to verify connectivity with extended pings.

Configure a SSTP site-to-site VPN using certificates, creating a certificate authority, server, and client, then sign, trust, export, and deploy them across headquarters and branches.

Configure an SSTP client to a site VPN by setting up a server certificate, exporting and importing client certificates on Windows, creating a VPN connection, and validating connectivity with ping.

Explore the fundamentals of IP and IPsec, including confidentiality, integrity, authentication, and their interplay, and learn how to configure IP on MikroTik devices.

Explore the IPsec protocol suite framework, selecting negotiation methods and algorithms for confidentiality, integrity, and authentication, and learn how to configure IPsec on MikroTik.

Learn how IPsec combines symmetric and asymmetric encryption to establish a secure shared secret between routers via a public-key exchange, then encrypts traffic with the shared secret.

Explore how IPsec authentication secures peer identity using pre-shared keys or certificates. Learn how certificate authorities issue trusted certificates, mitigate man-in-the-middle risks, and configure MikroTik devices for certificate-based authentication.

Explore ipsec negotiation protocols ah vs esp, including phase one and phase two, tunnel versus transport modes, and how authentication, data integrity, and encryption secure vpn data between MikroTik routers.

Introduce the five phases of IPsec negotiation, presenting each phase one by one. Preview a lab that demonstrates configuring IPsec on MikroTik devices.

Explain ipsec ike phase 1 (isakmp tunnel): routers negotiate security association policies, hashing, authentication, diffie-hellman, encryption, and lifetime, exchange keys, and authenticate to form the tunnel.

Explore IPsec IKE phase 1 on MikroTik, comparing main mode and aggressive mode: main uses six messages and encrypts ID, offering more security; aggressive uses three messages and is faster.

Learn how IPsec IKE phase 2 creates a tunnel to protect user data, negotiating IP security associations, choosing IP protocol, encapsulation mode, encryption, authentication, and lifetime.

Learn how ipsec data transfer works with phase one and phase two tunnels, encryption and integrity, esp usage, ikev1 versus ikev2, and a side-to-side vpn lab.

Compare ikev1 and ikev2, highlighting built-in nat traversal, built-in keep-alive, ip authentication options, and different phase one modes, while noting ikev2 uses less bandwidth for efficient connections.

Prepare for the IPsec lab by reviewing IP theory and IKEv1, IKEv2, including main and aggressive modes, then configure IPsec and validate reachability for the IP check.

Configure a MikroTik lab from scratch, upgrading RouterOS, assign ips, set nat masquerade and default routes, create a bridge, and verify connectivity to prepare for ipsec tunnel lab.

Configure a site-to-site ipsec tunnel with ikev1/ikev2, establishing phase one and two via profile one and a pre-shared key, using esp aes-128.

Join MikroTik official trainings with Maher Haddad to become a certified MikroTik engineer by completing labs and passing the exam, with in-person Netherlands or live online options.