zwitschi/intrusion-detection
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

docs: adding mikrotik data

Browse Source 
updating README.md for data folder
This commit is contained in:
zwitschi committed 2026-08-05 19:43:39 +02:00
1 parent 23907179c9
commit c5024e3cd1
5 files changed
+4200 -2
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

data/README.md
+6 -2
View File
@@ -5,7 +5,11 @@ This directory contains data files used by the `allucanget-ids` Intrusion Detect
## Data files
- [whois cache](./whois_cache.json): Local cache of WHOIS queries to reduce network requests and improve performance. The cache is automatically updated when new IP addresses are queried.
- [Openfactory Geofeed](./openfactory/geofeed.csv): Contains Openfactory IP addresses and associated geolocation data from `https://openfactory.net/geofeed.csv`. Used for identifying and whitelisting traffic from known Openfactory sources.
- [Cloudflare IPv4 list](./cloudflare/ips-v4.txt): Contains a list of Cloudflare IPv4 addresses from `https://www.cloudflare.com/ips-v4`, used for whitelisting traffic from Cloudflare services.
- [Cloudflare IPv6 list](./cloudflare/ips-v6.txt): Contains a list of Cloudflare IPv6 addresses from `https://www.cloudflare.com/ips-v6`, used for whitelisting traffic from Cloudflare services.
- [PaloAlto Scanner IP list](./paloalto/scanner-ips.txt): List of known PaloAlto scanner IP addresses from `https://docs-cortex.paloaltonetworks.com/r/1/Cortex-Xpanse/Scanning-activity`, used for whitelisting traffic from PaloAlto scanners.
- [MikroTik RouterOS IPv4 Firewall rules](./mikrotik/firewall_ipv4.json): Current MikroTik RouterOS IPv4 firewall rules.
- [MikroTik RouterOS IPv6 Firewall rules](./mikrotik/firewall_ipv6.json): Current MikroTik RouterOS IPv6 firewall rules.
- [MikroTik RouterOS IPv4 address list](./mikrotik/address_list_ipv4.json): Current MikroTik RouterOS IPv4 address list.
- [MikroTik RouterOS IPv6 address list](./mikrotik/address_list_ipv6.json): Current MikroTik RouterOS IPv6 address list.
- [Openfactory Geofeed](./openfactory/geofeed.csv): Contains Openfactory IP addresses and associated geolocation data from `https://openfactory.net/geofeed.csv`. Used for identifying and whitelisting traffic from known Openfactory sources.
- [PaloAlto Scanner IP list](./paloalto/scanner-ips.txt): List of known PaloAlto scanner IP addresses from `https://docs-cortex.paloaltonetworks.com/r/1/Cortex-Xpanse/Scanning-activity`, used for whitelisting traffic from PaloAlto scanners. !NOTE: This list can not be scraped easily (Javascript-based), so it is maintained manually and may be outdated. Please verify the list against the official source if needed.
data/mikrotik/address_list_ipv4.json
+3530
View File
File diff suppressed because it is too large. Load diff
data/mikrotik/address_list_ipv6.json
+347
View File
@@ -0,0 +1,347 @@
[
{
"address": "::/128",
"comment": "defconf:",
"creation-time": "2025-11-21",
"dynamic": "no",
"list": "bad_ipv6"
},
{
"address": "::1/128",
"comment": "defconf:",
"creation-time": "2025-11-21",
"dynamic": "no",
"list": "bad_ipv6"
},
{
"address": "fec0::/10",
"comment": "defconf:",
"creation-time": "2025-11-21",
"dynamic": "no",
"list": "bad_ipv6"
},
{
"address": "::ffff:0.0.0.0/96",
"comment": "defconf:",
"creation-time": "2025-11-21",
"dynamic": "no",
"list": "bad_ipv6"
},
{
"address": "::/96",
"comment": "defconf:",
"creation-time": "2025-11-21",
"dynamic": "no",
"list": "bad_ipv6"
},
{
"address": "100::/64",
"comment": "defconf:",
"creation-time": "2025-11-21",
"dynamic": "no",
"list": "bad_ipv6"
},
{
"address": "2001:db8::/32",
"comment": "defconf:",
"creation-time": "2025-11-21",
"dynamic": "no",
"list": "bad_ipv6"
},
{
"address": "2001:10::/28",
"comment": "defconf:",
"creation-time": "2025-11-21",
"dynamic": "no",
"list": "bad_ipv6"
},
{
"address": "3ffe::/16",
"comment": "defconf:",
"creation-time": "2025-11-21",
"dynamic": "no",
"list": "bad_ipv6"
},
{
"address": "2a0e:8f04::/32",
"creation-time": "2026-08-03",
"dynamic": "no",
"list": "Openfactory"
},
{
"address": "2a0e:8f05::/32",
"creation-time": "2026-08-03",
"dynamic": "no",
"list": "Openfactory"
},
{
"address": "2a0e:8f06::/32",
"creation-time": "2026-08-03",
"dynamic": "no",
"list": "Openfactory"
},
{
"address": "2a0e:8f07::/32",
"creation-time": "2026-08-03",
"dynamic": "no",
"list": "Openfactory"
},
{
"address": "2a00:6340::/32",
"creation-time": "2026-08-03",
"dynamic": "no",
"list": "Openfactory"
},
{
"address": "2a00:6340:2080::/48",
"creation-time": "2026-08-03",
"dynamic": "no",
"list": "Openfactory"
},
{
"address": "2001:67c:2648::/48",
"creation-time": "2026-08-03",
"dynamic": "no",
"list": "Openfactory"
},
{
"address": "2a00:6340:2044:200::/56",
"creation-time": "2026-08-03",
"dynamic": "no",
"list": "Openfactory"
},
{
"address": "2a00:6340:2044:600::/56",
"creation-time": "2026-08-03",
"dynamic": "no",
"list": "Openfactory"
},
{
"address": "2a00:6340:2044:800::/56",
"creation-time": "2026-08-03",
"dynamic": "no",
"list": "Openfactory"
},
{
"address": "2400:cb00::/32",
"creation-time": "2026-08-03",
"dynamic": "no",
"list": "Cloudflare"
},
{
"address": "2606:4700::/32",
"creation-time": "2026-08-03",
"dynamic": "no",
"list": "Cloudflare"
},
{
"address": "2803:f800::/32",
"creation-time": "2026-08-03",
"dynamic": "no",
"list": "Cloudflare"
},
{
"address": "2405:b500::/32",
"creation-time": "2026-08-03",
"dynamic": "no",
"list": "Cloudflare"
},
{
"address": "2405:8100::/32",
"creation-time": "2026-08-03",
"dynamic": "no",
"list": "Cloudflare"
},
{
"address": "2a06:98c0::/29",
"creation-time": "2026-08-03",
"dynamic": "no",
"list": "Cloudflare"
},
{
"address": "2c0f:f248::/32",
"creation-time": "2026-08-03",
"dynamic": "no",
"list": "Cloudflare"
},
{
"address": "2604:a940:300:5b6::/64",
"creation-time": "2026-08-03",
"dynamic": "no",
"list": "PaloAlto"
},
{
"address": "2604:a940:301:225::/64",
"creation-time": "2026-08-03",
"dynamic": "no",
"list": "PaloAlto"
},
{
"address": "2604:a940:302:118::/64",
"creation-time": "2026-08-03",
"dynamic": "no",
"list": "PaloAlto"
},
{
"address": "2001:4ca0:108:42::24/128",
"creation-time": "2026-08-03",
"dynamic": "no",
"list": "Blocked"
},
{
"address": "2400:8901::2000:62ff:fe9a:e1c2/128",
"creation-time": "2026-08-03",
"dynamic": "no",
"list": "Blocked"
},
{
"address": "2600:3000::/32",
"creation-time": "2026-08-03",
"dynamic": "no",
"list": "Blocked"
},
{
"address": "2600:3c09::2000:5cff:fe99:c802/128",
"creation-time": "2026-08-03",
"dynamic": "no",
"list": "Blocked"
},
{
"address": "2600:3c15::2000:53ff:fe31:8c0b/128",
"creation-time": "2026-08-03",
"dynamic": "no",
"list": "Blocked"
},
{
"address": "2602:fa59:10:a3a::1/128",
"creation-time": "2026-08-03",
"dynamic": "no",
"list": "Blocked"
},
{
"address": "2a01:2a8:a0dd:1::1012/128",
"creation-time": "2026-08-03",
"dynamic": "no",
"list": "Blocked"
},
{
"address": "2a04:4e40:e000:0:d09:97ab:43b1:a59a/128",
"creation-time": "2026-08-03",
"dynamic": "no",
"list": "Blocked"
},
{
"address": "2a04:c300::/29",
"creation-time": "2026-08-03",
"dynamic": "no",
"list": "Blocked"
},
{
"address": "2a09:bac5:9443:3af::5e:4d/128",
"creation-time": "2026-08-03",
"dynamic": "no",
"list": "Blocked"
},
{
"address": "2a09:bac5:9443:3af::5e:88/128",
"creation-time": "2026-08-03",
"dynamic": "no",
"list": "Blocked"
},
{
"address": "2a0a:4cc0:2000:8528:c4e8:3ff:febb:3ee9/128",
"creation-time": "2026-08-03",
"dynamic": "no",
"list": "Blocked"
},
{
"address": "2001:ba0:24c:a500::1/128",
"creation-time": "2026-08-03",
"dynamic": "no",
"list": "Blocked"
},
{
"address": "2406:da18:525:0:a23e:e8f6:3ea1:4c2c/128",
"creation-time": "2026-08-03",
"dynamic": "no",
"list": "Blocked"
},
{
"address": "2600:3c15::2000:9cff:fef0:8ad6/128",
"creation-time": "2026-08-03",
"dynamic": "no",
"list": "Blocked"
},
{
"address": "2602:fa59::/40",
"creation-time": "2026-08-03",
"dynamic": "no",
"list": "Blocked"
},
{
"address": "2a00:6340:2008:ec80:64cc:9116:beb2:1931/128",
"creation-time": "2026-08-03",
"dynamic": "no",
"list": "Blocked"
},
{
"address": "2a00:6340:2008:ec80:be24:11ff:fe3b:4058/128",
"creation-time": "2026-08-03",
"dynamic": "no",
"list": "Blocked"
},
{
"address": "2a00:6340:2008:ec80:be24:11ff:fe82:2775/128",
"creation-time": "2026-08-03",
"dynamic": "no",
"list": "Blocked"
},
{
"address": "2a01:4f8:c014:7f9e::1/128",
"creation-time": "2026-08-03",
"dynamic": "no",
"list": "Blocked"
},
{
"address": "2a04:4e40:4400:0:537:cdd2:7250:95db/128",
"creation-time": "2026-08-03",
"dynamic": "no",
"list": "Blocked"
},
{
"address": "2a04:4e40:e000::/48",
"creation-time": "2026-08-03",
"dynamic": "no",
"list": "Blocked"
},
{
"address": "2a05:4140:3::37cd/128",
"creation-time": "2026-08-03",
"dynamic": "no",
"list": "Blocked"
},
{
"address": "2a06:a880:5:7fb3::1/128",
"creation-time": "2026-08-03",
"dynamic": "no",
"list": "Blocked"
},
{
"address": "2a09:bac1:76c0:460::5e:6a/128",
"creation-time": "2026-08-03",
"dynamic": "no",
"list": "Blocked"
},
{
"address": "2a09:bac5::/32",
"creation-time": "2026-08-03",
"dynamic": "no",
"list": "Blocked"
},
{
"address": "2a13:adc0::2ed:89ff:fe58:19c5/128",
"creation-time": "2026-08-03",
"dynamic": "no",
"list": "Blocked"
}
]
data/mikrotik/firewall_ipv4.json
+135
View File
@@ -0,0 +1,135 @@
[
{
"action": "passthrough",
"chain": "forward",
"comment": "special"
},
{
"action": "fasttrack-connection",
"chain": "forward",
"comment": "defconf:",
"connection-state": "established,related",
"hw-offload": "yes",
"log": "no",
"log-prefix": ""
},
{
"action": "accept",
"chain": "forward",
"comment": "defconf:",
"connection-state": "established,related",
"log": "no",
"log-prefix": ""
},
{
"action": "drop",
"chain": "forward",
"comment": "defconf:",
"connection-state": "invalid",
"log": "no",
"log-prefix": ""
},
{
"action": "accept",
"chain": "forward",
"comment": "Allow",
"connection-nat-state": "dstnat"
},
{
"action": "accept",
"chain": "forward",
"comment": "allow",
"connection-state": "new",
"dst-address": "192.168.88.25",
"dst-port": "6667",
"log": "no",
"log-prefix": "",
"protocol": "tcp"
},
{
"action": "drop",
"chain": "forward",
"comment": "defconf:",
"connection-nat-state": "!dstnat",
"connection-state": "new",
"in-interface-list": "WAN",
"log": "no",
"log-prefix": ""
},
{
"action": "accept",
"chain": "input",
"log": "no",
"log-prefix": "",
"protocol": "icmp"
},
{
"action": "accept",
"chain": "input",
"connection-state": "established",
"log": "no",
"log-prefix": ""
},
{
"action": "accept",
"chain": "input",
"comment": "allow",
"dst-port": "500",
"protocol": "udp"
},
{
"action": "drop",
"chain": "input",
"comment": "Block",
"dst-port": "80,443",
"in-interface-list": "WAN",
"protocol": "tcp"
},
{
"action": "accept",
"chain": "input",
"comment": "Allow",
"dst-port": "80,443",
"in-interface-list": "LAN",
"protocol": "tcp",
"src-address": "192.168.88.0/24"
},
{
"action": "accept",
"chain": "input",
"comment": "ids",
"src-address-list": "Openfactory"
},
{
"action": "accept",
"chain": "input",
"comment": "ids",
"src-address-list": "Cloudflare"
},
{
"action": "accept",
"chain": "input",
"comment": "ids",
"src-address-list": "PaloAlto"
},
{
"action": "drop",
"chain": "input",
"comment": "ids",
"src-address-list": "Blocked"
},
{
"action": "drop",
"chain": "forward",
"comment": "ids",
"src-address-list": "Blocked"
},
{
"action": "drop",
"chain": "input",
"comment": "drop",
"in-interface": "pppoe-out1",
"log": "no",
"log-prefix": ""
}
]
data/mikrotik/firewall_ipv6.json
+182
View File
@@ -0,0 +1,182 @@
[
{
"action": "accept",
"chain": "input",
"comment": "defconf:",
"connection-state": "established,related,untracked"
},
{
"action": "drop",
"chain": "input",
"comment": "defconf:",
"connection-state": "invalid"
},
{
"action": "accept",
"chain": "input",
"comment": "defconf:",
"protocol": "icmpv6"
},
{
"action": "accept",
"chain": "input",
"comment": "defconf:",
"port": "33434-33534",
"protocol": "udp"
},
{
"action": "accept",
"chain": "input",
"comment": "defconf:",
"dst-port": "546",
"protocol": "udp",
"src-address": "fe80::/10"
},
{
"action": "accept",
"chain": "input",
"comment": "defconf:",
"dst-port": "500,4500",
"protocol": "udp"
},
{
"action": "accept",
"chain": "input",
"comment": "defconf:",
"protocol": "ipsec-ah"
},
{
"action": "accept",
"chain": "input",
"comment": "defconf:",
"protocol": "ipsec-esp"
},
{
"action": "accept",
"chain": "input",
"comment": "defconf:",
"ipsec-policy": "in,ipsec"
},
{
"action": "drop",
"chain": "input",
"comment": "defconf:",
"in-interface-list": "!LAN"
},
{
"action": "accept",
"chain": "forward",
"comment": "defconf:",
"connection-state": "established,related,untracked"
},
{
"action": "drop",
"chain": "forward",
"comment": "defconf:",
"connection-state": "invalid"
},
{
"action": "drop",
"chain": "forward",
"comment": "defconf:",
"src-address-list": "bad_ipv6"
},
{
"action": "drop",
"chain": "forward",
"comment": "defconf:",
"dst-address-list": "bad_ipv6"
},
{
"action": "drop",
"chain": "forward",
"comment": "defconf:",
"hop-limit": "equal:1",
"protocol": "icmpv6"
},
{
"action": "accept",
"chain": "forward",
"comment": "defconf:",
"protocol": "icmpv6"
},
{
"action": "accept",
"chain": "forward",
"comment": "defconf:",
"protocol": "139"
},
{
"action": "accept",
"chain": "forward",
"comment": "defconf:",
"dst-port": "500,4500",
"protocol": "udp"
},
{
"action": "accept",
"chain": "forward",
"comment": "defconf:",
"protocol": "ipsec-ah"
},
{
"action": "accept",
"chain": "forward",
"comment": "defconf:",
"protocol": "ipsec-esp"
},
{
"action": "accept",
"chain": "forward",
"comment": "defconf:",
"ipsec-policy": "in,ipsec"
},
{
"action": "drop",
"chain": "forward",
"comment": "defconf:",
"in-interface-list": "!LAN"
},
{
"action": "accept",
"chain": "forward",
"comment": "Allow",
"protocol": "icmpv6"
},
{
"action": "accept",
"chain": "input",
"comment": "Allow",
"protocol": "icmpv6"
},
{
"action": "accept",
"chain": "input",
"comment": "ids",
"src-address-list": "Openfactory"
},
{
"action": "accept",
"chain": "input",
"comment": "ids",
"src-address-list": "Cloudflare"
},
{
"action": "accept",
"chain": "input",
"comment": "ids",
"src-address-list": "PaloAlto"
},
{
"action": "drop",
"chain": "input",
"comment": "ids",
"src-address-list": "Blocked"
},
{
"action": "drop",
"chain": "forward",
"comment": "ids",
"src-address-list": "Blocked"
}
]