Skip to content

Crowdsec and Mikrotik integration#

CfgMgmtCamp Ghent 2026 digest Program Adjacent pick 2–4 February 2026

Abstract

Michal Sochon (independent; platform/DevOps background)

  • Why: Network security at the router: using a MikroTik as a CrowdSec enforcement point (bouncer). It's a small community fork, but the speaker promises real resource-cost numbers and usage graphs — the kind of end-user data most security talks lack.
  • What: The story of forking and integrating cs-mikrotik-bouncer-alt: why it was forked, pros and cons, how much the solution costs in resources on the router, and real usage graphs from a working system (from abstract only).
  • How: CrowdSec (distributed fail2ban-style detection across hosts) signals the MikroTik router to block via a community-maintained bouncer, extending mitigation beyond nginx/nftables/Kubernetes options into edge-router firewalling.
  • Where applicable: Small/SMB and homelab-adjacent scale — MikroTik RouterOS specifically, explicitly unofficial (not affiliated with CrowdSec or MikroTik, "use at your own risk"). The detection-to-enforcement feedback loop pattern is general; the implementation is niche. Come for the resource-consumption numbers, not the roadmap.