feat(api, web): enhance MikroTik integration and IP hit tracking
- Updated the `evofw-firewall.sh` script to improve the handling of NFT sets, ensuring compatibility with kernel limitations on counters and enhancing logging for better diagnostics. - Introduced a new presence mode for MikroTik, allowing for real-time tracking of IP hits with updated last seen timestamps and packet counts. - Enhanced the API to support the new presence mode, updating the database interactions to reflect the changes in how IP hits are recorded. - Updated the agent detail view to display sync windows for MikroTik, providing clearer insights into blocked IPs and their activity. - Improved documentation to reflect the new features and changes in the MikroTik handling process, ensuring clarity for users and developers. These changes significantly enhance the monitoring capabilities and user experience for agents, particularly those using MikroTik devices.
This commit is contained in:
Denozordec
+20
-10
@@ -57,13 +57,14 @@ Whitelist: nft chain policy drop + allow set. Blacklist: policy accept + deny se
|
||||
|
||||
Linux agent reports optional `ip_hits` in `POST /v1/agent/apply-report`:
|
||||
|
||||
- **nft:** set `deny_v4` with `flags interval; counter;` — per-element packets; collected **before** flush/recreate and on unchanged-hash sync.
|
||||
- **ipset:** `hash:net … counters` — same idea from `ipset list`.
|
||||
- **nft:** tries set `deny_v4` with `flags interval; counter;`. If the kernel rejects counters on interval sets, falls back to plain interval (aggregate Traffic ↓ still works; per-IP empty).
|
||||
- Upgrade path: on install-link re-run, `last_hash` is cleared once so sets can be recreated (chain deleted before set replace).
|
||||
- **ipset:** prefers `hash:net … counters` on create; existing sets without counters are left as-is.
|
||||
- Payload: only entries with `packets > 0`, **top 200** by packets.
|
||||
- Control plane stores cumulative totals in `agent_ip_block_stats` (delta vs last absolute report). `GET /api/v1/agents/:id/blocked-ips`. Reset via `POST …/stats/reset`.
|
||||
- UI: agent detail → **Blocked IPs** (Frame + DataGrid).
|
||||
- Control plane: `agent_ip_block_stats`, `GET /api/v1/agents/:id/blocked-ips`, reset via `POST …/stats/reset`.
|
||||
- UI: agent detail → **Blocked IPs**.
|
||||
|
||||
IPv6 skipped (as in apply). MikroTik: see below — no per-IP in v1.
|
||||
IPv6 skipped.
|
||||
|
||||
## MikroTik (RouterOS 7.21+)
|
||||
|
||||
@@ -78,20 +79,29 @@ IPv6 skipped (as in apply). MikroTik: see below — no per-IP in v1.
|
||||
Install RSC:
|
||||
|
||||
1. Enroll (с `install_link_id` → агент Invited → Pending).
|
||||
2. Создаёт filter-правила `evofw-*` и address-list `EVOFW_DENY` / `EVOFW_ALLOW`.
|
||||
3. Scheduler `evofw-sync` каждую минуту: `GET /v1/agent/policy` (JSON) → rebuild address-list + toggle default. Не использует `/import` огромного `.rsc` (на больших списках часто падает молча).
|
||||
2. Создаёт filter-правила `evofw-*` и address-list `EVOFW_DENY` / `EVOFW_ALLOW` / dynamic **`EVOFW_HITS`**.
|
||||
3. Scheduler `evofw-sync` каждую минуту: `GET /v1/agent/policy` (JSON) → rebuild deny/allow + report (+ `ip_hits` из HITS). Не использует `/import` огромного `.rsc`.
|
||||
|
||||
Лог: `/log print where message~"evofw"`. Ручной sync: `/system script run evofw-sync`.
|
||||
Traffic ↓/↑ в UI — сумма `packets` с filter-правил `evofw-deny-*` / `evofw-allow-*` / `evofw-default-drop-*` (накопительно, пока правила не пересозданы re-install).
|
||||
Traffic ↓/↑ в UI — сумма `packets` с `evofw-deny-drop-*` / `evofw-allow-*` / `evofw-default-drop-*` (накопительно, пока правила не пересозданы re-install).
|
||||
|
||||
**Per-IP / blocked IPs:** на MikroTik **нет**. У `/ip firewall address-list` в ROS 7 нет `packets`/`bytes` на записи — только суммарные counters filter-правил. В карточке агента секция Blocked IPs показывает пояснение.
|
||||
### Per-IP / Blocked IPs (MikroTik)
|
||||
|
||||
Цепочка deny: **hit → drop** (семантика drop/allow/default как раньше):
|
||||
|
||||
1. `evofw-deny-hit-input/forward` — `add-src-to-address-list` → `EVOFW_HITS`, `address-list-timeout=1h` (passthrough).
|
||||
2. `evofw-deny-drop-input/forward` — `drop` по `EVOFW_DENY`.
|
||||
|
||||
В `EVOFW_HITS` попадают реальные src **/32**. Policy rebuild **не** чистит HITS (только DENY/ALLOW). Sync шлёт top-200 в `ip_hits`; CP mode **presence**: `last_seen` каждый report, `packets` = число sync-окон (~минут), пока IP в HITS.
|
||||
|
||||
UI: agent detail → **Blocked IPs** (колонка Sync windows).
|
||||
|
||||
**Default action** задаётся на **агенте** (`default_action: accept | drop`):
|
||||
|
||||
- **accept** — пакет вне deny/allow пропускается
|
||||
- **drop** — пакет вне deny/allow отбрасывается (forward)
|
||||
|
||||
Цепочка всегда: deny-drop → allow-accept → default. Наборы несут только правила deny/allow, без exclusive mode.
|
||||
Цепочка: deny-hit → deny-drop → allow-accept → default. Наборы несут только правила deny/allow, без exclusive mode.
|
||||
|
||||
## Force sync
|
||||
|
||||
|
||||
Reference in New Issue
Block a user