first commit

2026-08-13 15:58:52 +02:00
commit adfdb0b86c
100 changed files with 6216 additions and 0 deletions
@@ -0,0 +1,20 @@
+# Creates a minimal REST-capable user group and disabled firewall rules.
+# It intentionally does NOT create the user/password.
+
+:if ([:len [/user/group/find where name="ids-rest"]] = 0) do={
+    /user/group/add name=ids-rest policy=read,write,rest-api comment="Suricata IDS REST-only group"
+}
+
+# Create the REST user manually with a strong password and restrict it to the container IP:
+# /user/add name=suricata-api group=ids-rest address=172.31.255.2/32 password="CHANGE_THIS_TO_A_LONG_RANDOM_PASSWORD"
+
+# HTTPS REST requires www-ssl. Do not enable plain HTTP for production.
+# /ip/service/enable www-ssl
+
+# Rules are created DISABLED. Enable only after observation-mode testing.
+:if ([:len [/ip/firewall/filter/find where comment="IDS-BLOCK source"]] = 0) do={
+    /ip/firewall/filter/add chain=forward action=drop src-address-list=IDS-BLOCK disabled=yes comment="IDS-BLOCK source"
+}
+:if ([:len [/ip/firewall/filter/find where comment="IDS-BLOCK destination"]] = 0) do={
+    /ip/firewall/filter/add chain=forward action=drop dst-address-list=IDS-BLOCK disabled=yes comment="IDS-BLOCK destination"
+}