24 lines
1.1 KiB
Plaintext
24 lines
1.1 KiB
Plaintext
# Stops/removes deployment objects but intentionally leaves persistent data/log
|
|
# directories on the external disk. Review before importing.
|
|
|
|
/tool/sniffer/stop
|
|
/ip/firewall/mangle/remove [find where comment="MikroSuricata TZSP IPv4"]
|
|
:if ([:len [/container/find where name="suricata-ids"]] > 0) do={
|
|
:local cid [/container/find where name="suricata-ids"]
|
|
:if ([/container/get $cid status] = "running") do={
|
|
/container/stop $cid
|
|
:delay 3s
|
|
}
|
|
/container/remove $cid
|
|
}
|
|
/container/envs/remove [find where list="IDS_ENV"]
|
|
/container/mounts/remove [find where list="IDS_MOUNTS"]
|
|
/ip/firewall/filter/remove [find where comment="IDS-BLOCK source"]
|
|
/ip/firewall/filter/remove [find where comment="IDS-BLOCK destination"]
|
|
/ip/firewall/nat/remove [find where comment="Suricata IDS outbound NAT"]
|
|
/interface/bridge/port/remove [find where bridge="br-ids" and interface="veth-ids"]
|
|
/interface/veth/remove [find where name="veth-ids"]
|
|
/ip/address/remove [find where interface="br-ids" and address="172.31.255.1/30"]
|
|
/interface/bridge/remove [find where name="br-ids"]
|
|
# ids-rest group/user and disk1/containers/suricata-ids-* are intentionally not removed.
|