Sparrows Suricata - IDS on AsusWRT Merlin

[Jack-Sparr0w]

whitelisted firewall settings that reflect unbound config

I changed the values for whitelisting vpn and etc. does it look alright

%YAML 1.1
---

# Holds variables that would be used by the engine.
vars:

# Holds the address group vars that would be passed in a Signature.
address-groups:
HOME_NET: "[192.168.50.0/16,10.0.0.0/8,127.0.0.0/8,172.16.0.0/12,169.254.0.0/16]"
EXTERNAL_NET: "any"
DNS_SERVERS: "[103.86.96.100,103.86.99.100]"
SMTP_SERVERS: "$HOME_NET"
HTTP_SERVERS: "$HOME_NET"
SQL_SERVERS: "$HOME_NET"
TELNET_SERVERS: "$HOME_NET"
DNP3_SERVER: "$HOME_NET"
DNP3_CLIENT: "$HOME_NET"
MODBUS_SERVER: "$HOME_NET"
MODBUS_CLIENT: "$HOME_NET"
ENIP_SERVER: "$HOME_NET"
ENIP_CLIENT: "$HOME_NET"
FTP_SERVERS: "$HOME_NET"
SSH_SERVERS: "$HOME_NET"
VPN_IP: "[use vpn public ip add hear!!!!!!! and erase message if used or not used]"

# Holds the port group vars that would be passed in a Signature.
port-groups:
FTP_PORTS: "21"
HTTP_PORTS: "80"
ORACLE_PORTS: "1521"
SSH_PORTS: "29100"
SHELLCODE_PORTS: "!80"
DNP3_PORTS: "20000"
FILE_DATA_PORTS: "$HTTP_PORTS,110,143"
VPN_PORTS: "53,443,1194"

 

[heysoundude]

It’s probably best to ask in the thread that indicates how to install suricata on your router… I remember someone got it working a number of years ago (pre covid?) on a prior generation of routers, but this would be better on the more capable ones now…

Your sig doesn’t indicate your hardware or current firmware etc…

 

[Jack-Sparr0w]

To install use:

mkdir /jffs/addons 2>/dev/null;mkdir /jffs/addons/suricata 2>/dev/null; curl --retry 3 "https://raw.githubusercontent.com/juched78/suricata-merlin/master/suricata_manager.sh" -o "/jffs/addons/suricata/suricata_manager.sh" && chmod 755 "/jffs/addons/suricata/suricata_manager.sh" && /jffs/addons/suricata/suricata_manager.sh install


To uninstall use:

/jffs/addons/suricata/suricata_manager.sh uninstall

 

[JGrana]

I seemed to recall @rgnldo a number of years ago had a thread about suricata

Suricata - Suricata - IDS on AsusWRT Merlin

Suricata is a free and open source, mature, fast and robust network threat detection engine. The Suricata engine is capable of real time intrusion detection (IDS), inline intrusion prevention (IPS), network security monitoring (NSM) and offline pcap processing. Suricata inspects the network...

www.snbforums.com

 

[Jack-Sparr0w]

using latest BE router and its all working.

 

[Jack-Sparr0w]

I seemed to recall @rgnldo a number of years ago had a thread about suricata

Suricata - Suricata - IDS on AsusWRT Merlin

Suricata is a free and open source, mature, fast and robust network threat detection engine. The Suricata engine is capable of real time intrusion detection (IDS), inline intrusion prevention (IPS), network security monitoring (NSM) and offline pcap processing. Suricata inspects the network...

www.snbforums.com

same guide i used just changed the values so it works with all other programs

 

[heysoundude]

I seemed to recall @rgnldo a number of years ago had a thread about suricata

Suricata - Suricata - IDS on AsusWRT Merlin

Suricata is a free and open source, mature, fast and robust network threat detection engine. The Suricata engine is capable of real time intrusion detection (IDS), inline intrusion prevention (IPS), network security monitoring (NSM) and offline pcap processing. Suricata inspects the network...

www.snbforums.com

That was it! Thanks for reminding us…

 

[heysoundude]

Given what @kuchkovsky has going on in his script package, this may be a good addition for those on that path:
Thread '[Scripts][2025-12-07] SSD TRIM, IPSet-based Firewall & Tunnel Director, IPv6 Enhancements, WG Port Forwarder, and more'
https://www.snbforums.com/threads/s...nhancements-wg-port-forwarder-and-more.95137/