MTCSE: MikroTik Certified Security Engineer

MikroTik training is ideal for anyone working with networks, from ISP engineers and corporate administrators to wireless technicians, IT consultants, and security professionals. It equips them to design, secure, and optimize networks using RouterOS and RouterBOARD devices. Students and new IT professionals gain essential foundational skills, while small businesses benefit by learning to manage their own routers effectively. Because MikroTik is widely used for routing, bandwidth control, PPPoE, BGP, MPLS, and WiFi, certified professionals are highly valuable across ISP and enterprise environments.

Title Details
Course + Exam Fee ৳ 4,000
Total Modules 12
Course Duration 16 Hours
Total Session 8
Class Duration 2 Hours

MTCSE: MikroTik Certified Security Engineer - Details Course Outlines

Module 1

Introduction to RouterOS Security

Objective: Understand the RouterOS attack surface and secure-by-design principles.

  • RouterOS security model

  • Types of attacks targeting MikroTik (botnets, brute force, exploits)

  • RouterOS update policies & long-term vs stable channels

  • Hardening management interfaces (WinBox, WebFig, SSH, API)

  • Secure passwords, 2FA, key-based login

  • Lab:

    • Secure a default RouterOS installation

    • Disable weak services and enforce secure access

Module 2

Firewall Fundamentals

Objective: Understand deep firewall architecture & state machine.

  • Connection tracking internals

  • Prerouting, forward, input, output, postrouting

  • RAW table vs filter table distinctions

  • FastTrack – performance vs security considerations

  • Whitelist/blacklist models

  • Lab:

    • Build a clean and efficient firewall from scratch

    • Block common scanning attempts (Nmap, SYN flood)

Module 3

Advanced Firewall Techniques

Objective: Master complex and optimized firewall rule sets.

  • Layer-7 usage and limitations

  • Address-lists (dynamic/static)

  • Port knocking implementation

  • Dynamic defense against brute force attacks

  • ICMP security, DoS mitigation, connection limits

  • Lab:

    • Create automated brute-force blocking using scripts

    • Build advanced filter chains with multiple address lists

Module 4

NAT, Hairpin & Secure Network Address Translation

Objective: Deploy NAT safely without exposing internal services.

  • Source NAT vs Destination NAT best practices

  • Hairpin NAT for internal service access

  • Hardened port-forwarding techniques

  • Preventing open-relay situations

  • Lab:

    • Securely expose a web server using DNAT

    • Apply rate limits to protect NAT’d hosts

Module 5

IPsec Theory & Cryptography Basics

Objective: Understand how IPsec works before building VPNs.

  • IKEv1 and IKEv2

  • Main mode vs aggressive mode

  • Hashes, ciphers, DH groups

  • Phase 1 (ISAKMP) & Phase 2 (IPsec SA)

  • Tunnel mode vs transport mode

  • Lab:

    • Debug IPsec negotiation failures

    • Compare security of different crypto proposals

Module 6

IPsec Site-to-Site VPN

Objective: Build secure inter-office encrypted connections.

  • IKEv2 preferred modern configuration

  • Best practice for SA lifetimes and rekeying

  • Handling NAT-Traversal

  • Dual-WAN redundancy with IPsec

  • Lab:

    • Configure site-to-site IPsec between 2 routerOS systems

    • Implement failover IPsec using recursive routing

Module 7

IPsec Road-Warrior VPN (Remote Access)

Objective: Secure remote worker and mobile access.

  • Mode Config

  • EAP, Certificates, RSA keys

  • Integrating with Windows/macOS/iOS/Android clients

  • User quarantine & conditional access

  • Lab:

    • Build an IKEv2 EAP remote access VPN

    • Restrict access using firewall + address lists

Module 8

Certificates & Public Key Infrastructure (PKI)

Objective: Deploy certificate-based security for VPN & services.

  • Creating CA and issuing certificates

  • Key usage, SAN, expiration

  • TLS for Hotspot, API, WinBox, HTTPS

  • Lab:

    • Build your own CA on RouterOS

    • Deploy certificates in an IPsec remote-access VPN

Module 9

Layer-2 & Wireless Security

Objective: Protect bridging and wireless domains.

  • Bridge filters and protection from L2 attacks

  • DHCP spoofing defense

  • MAC server restrictions

  • WPA3, SAE, Enterprise EAP

  • Wireless client isolation

  • Lab:

    • Secure a wireless network with WPA2-EAP

    • Detect and block rogue DHCP servers

Module 10

Secure Tunnels & Advanced Encryption

  • GRE/IPIP over IPsec

  • EOIP with IPsec

  • WireGuard basics (if RouterOS v7+)

  • Lab:

    • GRE over IPsec tunnel for routing

    • WireGuard secure tunnel deployment

Module 11

Logging, Monitoring & Threat Detection

Objective: Build visibility into network security events.

  • Syslog integration

  • Traffic analysis tools

  • Detecting botnet behaviors

  • SIEM integration basics

  • Lab:

    • Export logs to syslog

    • Trigger alerts for suspect traffic

Module 12

Security Automation & Scripting

Objective: Automatically defend the network.

  • Basic MikroTik scripting language

  • Automated dynamic address lists

  • Scheduled tasks for threat cleanup

  • Lab:

    • Auto-block repeated attackers

    • Auto-renew certificates, rotate IPsec keys