-
Notifications
You must be signed in to change notification settings - Fork 22
/
README.EN
93 lines (48 loc) · 2.33 KB
/
README.EN
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
IPS-MikroTik-Suricata is module which connect to Suricata's DB (MySql) using Barnyard2. This module search for custom alerts and when found it, take an IPS action and connect to MikroTik RouterOS via API to add the Attack's Source IP address and block it (add IP to address list).
Inspired on post from Tom Fisk: http://forum.mikrotik.com/viewtopic.php?t=111727
# New Version
Suricata2MikroTik eve.json version: https://github.com/elmaxid/Suricata2MikroTik
Changelog:
3 March 17: v1.3
* The new schema.sql now support trigger to add the alert. So now is depreceated the daemon mikrotik-ips-daemon_db.php
* Update the instalation file.
Requeriment:
* Suricata,Baynyard2 running
* IP and login for router MikroTik RouterOS
* GIT
** Features
* Detect an Alert from Suricata and connect to RouterOS to block de Attack source IP Address
* Notification:
* Email
* Telegram (API Bot)
Instalation
Once we have Suricata working and running on our network, the next step is the instalation of IPS-MikroTik-Suricata:
We have 5 main files
config.php:
File with the config of DB and Router's Login
mikrotik-ips-daemon_db.php:
Daemon which connect to MySql DB and detect the pattern of alerts and save to DB for block it (DEPRECEATED)
mikrotik-ips-cron.php:
Daemon which take the alert and connect with MikroTik via API and add the IP address to a list (ip firewall address-list) to block IP
mikrotik-ips-clean.php:
Daemon to maintance and clean the DB.
mikrotik-ips-install.php
File for install and configuration. Create the table with the correct schema and Check the connection via API with MikroTik.
--
To install, Clone the repository and copy to /opt/ips-mikrotik-suricata
cd /opt
git clone https://github.com/elmaxid/ips-mikrotik-suricata.git
cd ips-mikrotik-suricata
-- to Config
* Edit the file config.php with DB and API Logins
* Create the DB schema
mysql -u username -p snorby < schema.sql
* To check the DB Connection and API Login:
php -f mikrotik-ips-install.php
* To run, just set the permision
chmod 777 /opt/ips-mikrotik-suricata/ips_start.sh
* Edit the file ip_start.sh with the correct path and run it
/opt/ips-mikrotik-suricata/./ips_start.sh
----
How work it
For run Suricata, you need to redirect the traffic from MikroTik RouterOS to Suricata server, to do it just use Packet Sniffer or Mangle Send To TZSP Action.