Module to connect Suricata / Barnyard2 to MikroTik for IPS on an eventual alert.
PHP Shell
Switch branches/tags
Nothing to show
Clone or download
Fetching latest commit…
Cannot retrieve the latest commit at this time.


IPS-MikroTik-Suricata is module which connect to Suricata's DB (MySql) using Barnyard2. This module search for custom alerts and when found it, take an IPS action and connect to MikroTik RouterOS via API to add the  Attack's Source IP address and block it (add IP to address list).

Inspired on post from Tom Fisk:


3 March 17: v1.3

* The new schema.sql now support trigger to add the alert. So now is depreceated the daemon mikrotik-ips-daemon_db.php
* Update the instalation file.


* Suricata,Baynyard2 running
* IP and login for router MikroTik RouterOS

** Features

* Detect an Alert from Suricata and connect to RouterOS to block de Attack source IP Address
* Notification:
		* Email
		* Telegram (API Bot)


Once we have Suricata working and running on our network, the next step is the instalation of IPS-MikroTik-Suricata:

We have 5 main files


File with the config of DB and Router's Login


Daemon which connect to MySql DB and detect the pattern of alerts and save to DB for block it (DEPRECEATED)


Daemon which take the alert and connect with MikroTik via API and add the IP address to a list (ip firewall address-list) to block IP


Daemon to maintance and clean the DB.


File for install and configuration. Create the table with the correct schema and Check the connection via API with MikroTik.

To install, Clone the repository and copy to /opt/ips-mikrotik-suricata

cd /opt

git clone

cd ips-mikrotik-suricata

-- to Config

* Edit the file config.php  with DB and API Logins

* Create the DB schema 

mysql -u username -p snorby < schema.sql

* To check the DB Connection and API Login:

php -f mikrotik-ips-install.php

* To run, just set the permision 

chmod 777 /opt/ips-mikrotik-suricata/ 

* Edit the file with the correct path and run it



How work it

For run Suricata, you need to redirect the traffic from MikroTik RouterOS to Suricata server, to do it just use Packet Sniffer or  Mangle Send To TZSP Action.