first commit

2026-08-13 15:58:52 +02:00
commit adfdb0b86c
100 changed files with 6216 additions and 0 deletions
@@ -0,0 +1,18 @@
+# Creates an isolated /30 network for the IDS container.
+# Defaults: RouterOS 172.31.255.1, container 172.31.255.2.
+
+:if ([:len [/interface/bridge/find where name="br-ids"]] = 0) do={
+    /interface/bridge/add name=br-ids comment="Suricata IDS container bridge"
+}
+:if ([:len [/ip/address/find where interface="br-ids" and address="172.31.255.1/30"]] = 0) do={
+    /ip/address/add address=172.31.255.1/30 interface=br-ids comment="Suricata IDS gateway"
+}
+:if ([:len [/interface/veth/find where name="veth-ids"]] = 0) do={
+    /interface/veth/add name=veth-ids address=172.31.255.2/30 gateway=172.31.255.1 comment="Suricata IDS container"
+}
+:if ([:len [/interface/bridge/port/find where bridge="br-ids" and interface="veth-ids"]] = 0) do={
+    /interface/bridge/port/add bridge=br-ids interface=veth-ids
+}
+:if ([:len [/ip/firewall/nat/find where comment="Suricata IDS outbound NAT"]] = 0) do={
+    /ip/firewall/nat/add chain=srcnat src-address=172.31.255.0/30 action=masquerade comment="Suricata IDS outbound NAT"
+}
@@ -0,0 +1,9 @@
+# Configure RouterOS Packet Sniffer to stream VLAN 100 via TZSP.
+# This script DOES NOT start the sniffer. Review first, then run /tool/sniffer/start.
+
+/tool/sniffer/set filter-vlan=100 filter-direction=any filter-stream=yes only-headers=no streaming-enabled=yes streaming-server=172.31.255.2 streaming-port=37008
+
+# Start manually after the container is healthy:
+# /tool/sniffer/start
+# Stop with:
+# /tool/sniffer/stop
@@ -0,0 +1,20 @@
+# Creates a minimal REST-capable user group and disabled firewall rules.
+# It intentionally does NOT create the user/password.
+
+:if ([:len [/user/group/find where name="ids-rest"]] = 0) do={
+    /user/group/add name=ids-rest policy=read,write,rest-api comment="Suricata IDS REST-only group"
+}
+
+# Create the REST user manually with a strong password and restrict it to the container IP:
+# /user/add name=suricata-api group=ids-rest address=172.31.255.2/32 password="CHANGE_THIS_TO_A_LONG_RANDOM_PASSWORD"
+
+# HTTPS REST requires www-ssl. Do not enable plain HTTP for production.
+# /ip/service/enable www-ssl
+
+# Rules are created DISABLED. Enable only after observation-mode testing.
+:if ([:len [/ip/firewall/filter/find where comment="IDS-BLOCK source"]] = 0) do={
+    /ip/firewall/filter/add chain=forward action=drop src-address-list=IDS-BLOCK disabled=yes comment="IDS-BLOCK source"
+}
+:if ([:len [/ip/firewall/filter/find where comment="IDS-BLOCK destination"]] = 0) do={
+    /ip/firewall/filter/add chain=forward action=drop dst-address-list=IDS-BLOCK disabled=yes comment="IDS-BLOCK destination"
+}
@@ -0,0 +1,27 @@
+# Manual AMD64/x86_64 import. Preferred automated path: scripts/deploy-routeros.sh
+# Assumes image is already uploaded as disk1/routeros-suricata-tzsp-amd64.tar.
+
+/container/envs/remove [find where list="IDS_ENV"]
+/container/envs/add list=IDS_ENV key=TZSP_BIND value=0.0.0.0
+/container/envs/add list=IDS_ENV key=TZSP_PORT value=37008
+/container/envs/add list=IDS_ENV key=TAP_NAME value=suritap0
+/container/envs/add list=IDS_ENV key=TAP_MTU value=9000
+/container/envs/add list=IDS_ENV key=SURICATA_HOME_NET value="[192.168.0.0/16,10.0.0.0/8,172.16.0.0/12]"
+/container/envs/add list=IDS_ENV key=MONITORED_NETWORKS value=192.168.100.0/24
+/container/envs/add list=IDS_ENV key=AUTO_BLOCK value=false
+/container/envs/add list=IDS_ENV key=ROUTEROS_URL value=https://172.31.255.1
+/container/envs/add list=IDS_ENV key=ROUTEROS_USER value=suricata-api
+/container/envs/add list=IDS_ENV key=ROUTEROS_PASSWORD value=CHANGE_ME
+/container/envs/add list=IDS_ENV key=ROUTEROS_VERIFY_TLS value=false
+/container/envs/add list=IDS_ENV key=ROUTEROS_ADDRESS_LIST value=IDS-BLOCK
+/container/envs/add list=IDS_ENV key=UPDATE_RULES_ON_START value=false
+
+/container/mounts/remove [find where list="IDS_MOUNTS"]
+/container/mounts/add list=IDS_MOUNTS src=disk1/containers/suricata-ids-data dst=/data
+/container/mounts/add list=IDS_MOUNTS src=disk1/containers/suricata-ids-logs dst=/var/log/suricata
+/container/mounts/add list=IDS_MOUNTS src=disk1/containers/suricata-ids-rules dst=/var/lib/suricata
+
+/container/add file=disk1/routeros-suricata-tzsp-amd64.tar interface=veth-ids root-dir=disk1/containers/suricata-ids-root mountlists=IDS_MOUNTS envlist=IDS_ENV name=suricata-ids start-on-boot=yes logging=yes
+
+# Wait until /container/print shows status=stopped, then:
+# /container/start suricata-ids
@@ -0,0 +1,27 @@
+# Manual ARMv7/armhf import. Preferred automated path: scripts/deploy-routeros.sh
+# Not suitable for devices limited to ARM32v5 images.
+
+/container/envs/remove [find where list="IDS_ENV"]
+/container/envs/add list=IDS_ENV key=TZSP_BIND value=0.0.0.0
+/container/envs/add list=IDS_ENV key=TZSP_PORT value=37008
+/container/envs/add list=IDS_ENV key=TAP_NAME value=suritap0
+/container/envs/add list=IDS_ENV key=TAP_MTU value=9000
+/container/envs/add list=IDS_ENV key=SURICATA_HOME_NET value="[192.168.0.0/16,10.0.0.0/8,172.16.0.0/12]"
+/container/envs/add list=IDS_ENV key=MONITORED_NETWORKS value=192.168.100.0/24
+/container/envs/add list=IDS_ENV key=AUTO_BLOCK value=false
+/container/envs/add list=IDS_ENV key=ROUTEROS_URL value=https://172.31.255.1
+/container/envs/add list=IDS_ENV key=ROUTEROS_USER value=suricata-api
+/container/envs/add list=IDS_ENV key=ROUTEROS_PASSWORD value=CHANGE_ME
+/container/envs/add list=IDS_ENV key=ROUTEROS_VERIFY_TLS value=false
+/container/envs/add list=IDS_ENV key=ROUTEROS_ADDRESS_LIST value=IDS-BLOCK
+/container/envs/add list=IDS_ENV key=UPDATE_RULES_ON_START value=false
+
+/container/mounts/remove [find where list="IDS_MOUNTS"]
+/container/mounts/add list=IDS_MOUNTS src=disk1/containers/suricata-ids-data dst=/data
+/container/mounts/add list=IDS_MOUNTS src=disk1/containers/suricata-ids-logs dst=/var/log/suricata
+/container/mounts/add list=IDS_MOUNTS src=disk1/containers/suricata-ids-rules dst=/var/lib/suricata
+
+/container/add file=disk1/routeros-suricata-tzsp-arm.tar interface=veth-ids root-dir=disk1/containers/suricata-ids-root mountlists=IDS_MOUNTS envlist=IDS_ENV name=suricata-ids start-on-boot=yes logging=yes
+
+# Wait until /container/print shows status=stopped, then:
+# /container/start suricata-ids
@@ -0,0 +1,28 @@
+# Manual ARM64 import. Preferred automated path: scripts/deploy-routeros.sh
+# Assumes image is already uploaded as disk1/routeros-suricata-tzsp-arm64.tar
+# and routeros/01-container-network.rsc has been applied.
+
+/container/envs/remove [find where list="IDS_ENV"]
+/container/envs/add list=IDS_ENV key=TZSP_BIND value=0.0.0.0
+/container/envs/add list=IDS_ENV key=TZSP_PORT value=37008
+/container/envs/add list=IDS_ENV key=TAP_NAME value=suritap0
+/container/envs/add list=IDS_ENV key=TAP_MTU value=9000
+/container/envs/add list=IDS_ENV key=SURICATA_HOME_NET value="[192.168.0.0/16,10.0.0.0/8,172.16.0.0/12]"
+/container/envs/add list=IDS_ENV key=MONITORED_NETWORKS value=192.168.100.0/24
+/container/envs/add list=IDS_ENV key=AUTO_BLOCK value=false
+/container/envs/add list=IDS_ENV key=ROUTEROS_URL value=https://172.31.255.1
+/container/envs/add list=IDS_ENV key=ROUTEROS_USER value=suricata-api
+/container/envs/add list=IDS_ENV key=ROUTEROS_PASSWORD value=CHANGE_ME
+/container/envs/add list=IDS_ENV key=ROUTEROS_VERIFY_TLS value=false
+/container/envs/add list=IDS_ENV key=ROUTEROS_ADDRESS_LIST value=IDS-BLOCK
+/container/envs/add list=IDS_ENV key=UPDATE_RULES_ON_START value=false
+
+/container/mounts/remove [find where list="IDS_MOUNTS"]
+/container/mounts/add list=IDS_MOUNTS src=disk1/containers/suricata-ids-data dst=/data
+/container/mounts/add list=IDS_MOUNTS src=disk1/containers/suricata-ids-logs dst=/var/log/suricata
+/container/mounts/add list=IDS_MOUNTS src=disk1/containers/suricata-ids-rules dst=/var/lib/suricata
+
+/container/add file=disk1/routeros-suricata-tzsp-arm64.tar interface=veth-ids root-dir=disk1/containers/suricata-ids-root mountlists=IDS_MOUNTS envlist=IDS_ENV name=suricata-ids start-on-boot=yes logging=yes
+
+# Wait until /container/print shows status=stopped, then:
+# /container/start suricata-ids
@@ -0,0 +1,19 @@
+# RouterOS v7.22+ custom App template.
+# Replace the image with a registry path you control. Manual .tar import is the recommended path for this project.
+name: routeros-suricata-tzsp
+descr: TZSP receiver with Suricata IDS and local dashboard
+category: monitoring
+default-credentials: none
+services:
+  ids:
+    image: docker.io/CHANGE_ME/routeros-suricata-tzsp:latest
+    ports:
+      - 8080:8080:tcp
+      - 37008:37008:udp
+    devices:
+      - /dev/net/tun:/dev/net/tun
+    environment:
+      TZSP_PORT: "37008"
+      TAP_NAME: suritap0
+      AUTO_BLOCK: "false"
+      MONITORED_NETWORKS: 192.168.100.0/24
@@ -0,0 +1,22 @@
+# Stops/removes deployment objects but intentionally leaves persistent data/log
+# directories on the external disk. Review before importing.
+
+/tool/sniffer/stop
+:if ([:len [/container/find where name="suricata-ids"]] > 0) do={
+    :local cid [/container/find where name="suricata-ids"]
+    :if ([/container/get $cid status] = "running") do={
+        /container/stop $cid
+        :delay 3s
+    }
+    /container/remove $cid
+}
+/container/envs/remove [find where list="IDS_ENV"]
+/container/mounts/remove [find where list="IDS_MOUNTS"]
+/ip/firewall/filter/remove [find where comment="IDS-BLOCK source"]
+/ip/firewall/filter/remove [find where comment="IDS-BLOCK destination"]
+/ip/firewall/nat/remove [find where comment="Suricata IDS outbound NAT"]
+/interface/bridge/port/remove [find where bridge="br-ids" and interface="veth-ids"]
+/interface/veth/remove [find where name="veth-ids"]
+/ip/address/remove [find where interface="br-ids" and address="172.31.255.1/30"]
+/interface/bridge/remove [find where name="br-ids"]
+# ids-rest group/user and disk1/containers/suricata-ids-* are intentionally not removed.