52 lines
1.4 KiB
Bash
52 lines
1.4 KiB
Bash
# Connection from your Linux/macOS build host to RouterOS.
|
|
ROUTER_HOST=192.168.88.1
|
|
ROUTER_USER=admin
|
|
ROUTER_PORT=22
|
|
# Optional private key. Empty means use normal ssh/scp authentication.
|
|
ROUTER_IDENTITY_FILE=
|
|
|
|
# auto = detect RouterOS architecture through SSH.
|
|
# Supported image targets: arm64, amd64/x86_64, arm (armv7/armhf only).
|
|
ROUTER_ARCH=auto
|
|
|
|
# RouterOS external storage. Containers should not live on internal flash.
|
|
ROUTER_DISK=disk1
|
|
# SCP-visible path. Normally the same as ROUTER_DISK. Change to /disk1 if your client requires it.
|
|
ROUTER_SCP_DIR=disk1
|
|
|
|
CONTAINER_NAME=suricata-ids
|
|
CONTAINER_IP=172.31.255.2/30
|
|
CONTAINER_GATEWAY=172.31.255.1
|
|
CONTAINER_SUBNET=172.31.255.0/30
|
|
CONTAINER_BRIDGE=br-ids
|
|
CONTAINER_VETH=veth-ids
|
|
|
|
# Packet Sniffer -> TZSP
|
|
VLAN_ID=100
|
|
TZSP_PORT=37008
|
|
CONFIGURE_SNIFFER=true
|
|
START_SNIFFER=true
|
|
|
|
# Suricata/app
|
|
SURICATA_HOME_NET=[192.168.0.0/16,10.0.0.0/8,172.16.0.0/12]
|
|
MONITORED_NETWORKS=192.168.100.0/24
|
|
AUTO_BLOCK=false
|
|
AUTO_BLOCK_MAX_SEVERITY=1
|
|
BLOCK_TIMEOUT=1h
|
|
UPDATE_RULES_ON_START=false
|
|
|
|
# RouterOS REST. Not required for observation-only testing.
|
|
CREATE_REST_USER=false
|
|
ENABLE_WWW_SSL=false
|
|
ROUTEROS_REST_USER=suricata-api
|
|
ROUTEROS_REST_PASSWORD=CHANGE_ME
|
|
ROUTEROS_VERIFY_TLS=false
|
|
ROUTEROS_ADDRESS_LIST=IDS-BLOCK
|
|
|
|
# Re-deploy behavior. Persistent /data and Suricata logs are mounted separately.
|
|
REPLACE_EXISTING=true
|
|
KEEP_REMOTE_TAR=true
|
|
|
|
# Optional build engine: docker or podman. Empty = auto-detect.
|
|
ENGINE=
|