60 lines
3.9 KiB
Plaintext
60 lines
3.9 KiB
Plaintext
# Manual ARMv7/armhf import. Preferred automated path: scripts/deploy-routeros.sh
|
|
# Not suitable for devices limited to ARM32v5 images.
|
|
|
|
/container/envs/remove [find where list="IDS_ENV"]
|
|
/container/envs/add list=IDS_ENV key=TZSP_BIND value=0.0.0.0
|
|
/container/envs/add list=IDS_ENV key=TZSP_PORT value=37008
|
|
/container/envs/add list=IDS_ENV key=TAP_NAME value=suritap0
|
|
/container/envs/add list=IDS_ENV key=TAP_MTU value=9000
|
|
/container/envs/add list=IDS_ENV key=SURICATA_HOME_NET value="[192.168.0.0/16,10.0.0.0/8,172.16.0.0/12]"
|
|
/container/envs/add list=IDS_ENV key=SURICATA_LOG_MAX_MB value=512
|
|
/container/envs/add list=IDS_ENV key=FORENSIC_PCAP_MODE value=blocks
|
|
/container/envs/add list=IDS_ENV key=FORENSIC_PCAP_WINDOW_SECONDS value=60
|
|
/container/envs/add list=IDS_ENV key=FORENSIC_PCAP_MEMORY_MB value=64
|
|
/container/envs/add list=IDS_ENV key=FORENSIC_PCAP_MAX_FILES value=32
|
|
/container/envs/add list=IDS_ENV key=FORENSIC_PCAP_MAX_TOTAL_MB value=512
|
|
/container/envs/add list=IDS_ENV key=MONITORED_NETWORKS value=192.168.0.0/16,10.0.0.0/8,172.16.0.0/12
|
|
/container/envs/add list=IDS_ENV key=AUTO_BLOCK value=false
|
|
/container/envs/add list=IDS_ENV key=ROUTEROS_URL value=https://172.31.255.1
|
|
/container/envs/add list=IDS_ENV key=ROUTEROS_USER value=suricata-api
|
|
/container/envs/add list=IDS_ENV key=ROUTEROS_PASSWORD value=CHANGE_ME
|
|
/container/envs/add list=IDS_ENV key=ROUTEROS_VERIFY_TLS value=false
|
|
/container/envs/add list=IDS_ENV key=ROUTEROS_ADDRESS_LIST value=IDS-BLOCK
|
|
/container/envs/add list=IDS_ENV key=UPDATE_RULES_ON_START value=false
|
|
/container/envs/add list=IDS_ENV key=SURICATA_PERSIST_LIB_DIR value=/data/lib/suricata
|
|
/container/envs/add list=IDS_ENV key=RULE_UPDATE_INTERVAL_HOURS value=24
|
|
/container/envs/add list=IDS_ENV key=ALERT_RETENTION_DAYS value=14
|
|
/container/envs/add list=IDS_ENV key=REDIS_URL value="redis://127.0.0.1:6379/0"
|
|
/container/envs/add list=IDS_ENV key=REDIS_MANAGED value=true
|
|
/container/envs/add list=IDS_ENV key=REDIS_DATA_DIR value=/data/redis
|
|
/container/envs/add list=IDS_ENV key=REDIS_PORT value=6379
|
|
/container/envs/add list=IDS_ENV key=REDIS_MAXMEMORY_MB value=0
|
|
/container/envs/add list=IDS_ENV key=REDIS_SNAPSHOT_SECONDS value=1800
|
|
/container/envs/add list=IDS_ENV key=TRAFFIC_RETENTION_HOURS value=24
|
|
/container/envs/add list=IDS_ENV key=TRAFFIC_MAX_EVENTS value=0
|
|
/container/envs/add list=IDS_ENV key=TRAFFIC_MEMORY_EVENTS value=0
|
|
/container/envs/add list=IDS_ENV key=WEBSOCKET_QUEUE_SIZE value=512
|
|
/container/envs/add list=IDS_ENV key=LIVE_FLOW_UPDATE_SECONDS value=2.0
|
|
/container/envs/add list=IDS_ENV key=ALERT_MAX_SEVERITY value=2
|
|
/container/envs/add list=IDS_ENV key=ALERT_DEDUP_WINDOW_SECONDS value=300
|
|
/container/envs/add list=IDS_ENV key=ALERT_IGNORE_SIDS value=""
|
|
/container/envs/add list=IDS_ENV key=ALERT_IGNORE_CATEGORIES value=""
|
|
# Set a long ADMIN_PASSWORD to enable authenticated maintenance/rule-management.
|
|
/container/envs/add list=IDS_ENV key=ADMIN_USERNAME value="admin"
|
|
/container/envs/add list=IDS_ENV key=ADMIN_PASSWORD value=""
|
|
# /metrics is IP-restricted by default. Replace/add the Prometheus source IP or CIDR.
|
|
/container/envs/add list=IDS_ENV key=METRICS_ALLOWED_IPS value="127.0.0.1/32,::1/128"
|
|
/container/envs/add list=IDS_ENV key=METRICS_BASIC_AUTH_USERNAME value=""
|
|
/container/envs/add list=IDS_ENV key=METRICS_BASIC_AUTH_PASSWORD value=""
|
|
/container/envs/add list=IDS_ENV key=SESSION_HOURS value=168
|
|
/container/envs/add list=IDS_ENV key=SESSION_COOKIE_SECURE value=false
|
|
/container/envs/add list=IDS_ENV key=ANALYTICS_SNAPSHOT_INTERVAL_SECONDS value=60
|
|
|
|
/container/mounts/remove [find where list="IDS_MOUNTS"]
|
|
/container/mounts/add list=IDS_MOUNTS src=disk1/containers/suricata-data dst=/data
|
|
|
|
/container/add file=routeros-suricata-tzsp-arm.tar interface=veth-ids root-dir=/containers/suricata_0.9.5/root mountlists=IDS_MOUNTS envlist=IDS_ENV name=suricata_0.9.5 start-on-boot=yes logging=yes
|
|
|
|
# Wait until /container/print shows status=stopped, then:
|
|
# /container/start suricata_0.9.5
|