Mikrotik RouterOS WAN traffic sniff Suricata IDS

Sat, 21 Jan 2023 00:00:00 +0000

Preface: this is the poor’s man way of hooking up Suricata IDS to ~~Mikrotik~~ any router.
Better ways would be using port mirroring or putting Suricata host directly in front of the router.

My goal was to have all network traffic coming and going from internet mirrored into the suricata virtual machine.
Network schema is the following:
(internet) <-> routeros <-> debian_hypervisor <-> (linux bridge) <-> Suricata_VM

There are few ways of doing this, the one which is in my opinion the lesser evil involves:

RouterOS on nagg.eu

Mikrotik RouterOS WAN traffic sniff Suricata IDS