From 34d11c0e298e0b9b5b9ff5332c77d5cbad5878bc Mon Sep 17 00:00:00 2001 From: Lutz Finsterle Date: Sun, 28 Jun 2026 16:17:59 +0200 Subject: [PATCH] Add CrowdSec MikroTik bouncer (edge firewall drop) - New crowdsec-mikrotik-bouncer service: mirrors CrowdSec decisions into a RouterOS address-list on the AX3 for WAN edge-dropping (covers all ports, incl. VPN/SSH), complementing the L7 Traefik bouncer. - Connects over api-ssl/TLS using an OpenBAO-issued cert; trusts the OpenBAO root+intermediate via SSL_CERT_FILE (crowdsec/famfi-ca-bundle.pem). - Secrets (MIKROTIK_PASS, LAPI key) kept in root-only .mikrotik.env, git-ignored. Co-Authored-By: Claude Opus 4.8 --- .gitignore | 2 ++ crowdsec/famfi-ca-bundle.pem | 64 ++++++++++++++++++++++++++++++++++++ docker-compose.yml | 28 ++++++++++++++++ 3 files changed, 94 insertions(+) create mode 100644 .gitignore create mode 100644 crowdsec/famfi-ca-bundle.pem diff --git a/.gitignore b/.gitignore new file mode 100644 index 0000000..0b0834b --- /dev/null +++ b/.gitignore @@ -0,0 +1,2 @@ +.mikrotik.env +cred.adm diff --git a/crowdsec/famfi-ca-bundle.pem b/crowdsec/famfi-ca-bundle.pem new file mode 100644 index 0000000..4caceae --- /dev/null +++ b/crowdsec/famfi-ca-bundle.pem @@ -0,0 +1,64 @@ +-----BEGIN CERTIFICATE----- +MIIFPTCCAyWgAwIBAgIUDlqH3oDZSYz6DCiHV8a23qxaeXAwDQYJKoZIhvcNAQEL +BQAwJjEkMCIGA1UEAxMbZmFtZmkuaG9tZSBJbnRlcm5hbCBSb290IENBMB4XDTI2 +MDYyODExNTgzOVoXDTM2MDYyNTExNTkwN1owJjEkMCIGA1UEAxMbZmFtZmkuaG9t +ZSBJbnRlcm5hbCBSb290IENBMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKC +AgEA56+K6oFpJHmJ8b5RVJ3WeaMA12zKWXJCsHZN2xY654m2dioNj81g/ZluT5am +pNN6vGB15UXjYw4qyFFqlP7bPrZ34ud8G3uH24ryGOhWm5xOjPHSItLrfhHwUmZs +0eA2Aami0o5R5NMxGspe13xtuKAcq6DuFPtl0w1b1VgzbqPv2ouCX3HEF8q1c7Gh +PtpxJSpcb8PxoX7sgLBu45+cNGibkiBzplWtliGhe5s6MrkyhEkoLxSvH3GjD9ao +cZH6VKtwVHJIqAvylk84VXGO2Ycqsmuc33nsoWcUUGsa6NL8+d0J8s/2yTM1p4Kw +JqtBFybHbaVn1K9wkcTef6KTLAI8Nd88j/m3B3mWUcQr7H05MbyJS5HoOOvZdRiF +OvnGqu5yjZlZ4Ne74YTUxAnlz3sEJcgRtokWxfSAVLs+u3Uwva7D7XqeuJ1GJXKG +IOeaXXdULGVUZyYblBFigDWzTF22rMpyJSjNxK0uVIHqcakKKfpcq+7ehS7A+bNI +4gbDwRca0fbX+HMurNya1r5agQqsFZnpchVINuBGYITI8TQyyq6/kd8GqYP+KUYs +sAj7TlVfnhAfLg2ADHRBCoc5u3Fj0Pc6bvoI6ANgVBtTFP2ysP5wBjFXqXk58h7s +MikwtQyzdRvDkiJLQSG0UoGofybJvhKHEQ5oQwP2MioOd/MCAwEAAaNjMGEwDgYD +VR0PAQH/BAQDAgEGMA8GA1UdEwEB/wQFMAMBAf8wHQYDVR0OBBYEFKQhX4TGAuhu +QC3DedmQwhXkfpoZMB8GA1UdIwQYMBaAFKQhX4TGAuhuQC3DedmQwhXkfpoZMA0G +CSqGSIb3DQEBCwUAA4ICAQBaJG9aYgIxflz0KmEdJmKtjaCvjX7E7onZ9qM7jFqr +Rjtl0zJZG1oQ8sDmM4T5fNbORpqLtcYD/Sn2grzZja+yxJFx5/a/jxfkBWwvDiGT +hS2UuKmVZ1k1thA2PlzzjOyBh2KFP7BpjYdUIiU09K/hZrvrSS7/Vn3g6jbpiTMT +WtxBbRgt4AdjG/rYLQPNr/yygerllcPAzMr8i7ROuvj8rddi6yCyef2MT1ayF7/w +J2ufdbLIosYb9qanp50PpS/rWMC4vAVVFlaYEBBACQIo7N0v9learskdNpPw4vBY +30gXn0kN15QeuYYPkqwBNVJVuXKsz/+T/WAI9Vxj8EdsxrslbflVy+7VzNn1os+R +GTGbwdXlnK0ie3QHXISB6uKWQz6H91F9HVnzB6uypkMH9iFOdXC7tgqOjdl/ov2T +MHYxHqXJ6NNvvWHjqIQCCft6i8AglIsP4xIj/CdpOZabkxnqabD82TXW6oQ6qPpV +muUv8z3yqQRKHIpxgnXUOlN954L0iBIg1DkilWpAPGeA3DHZ/CkOAIxJmdkLmOu3 +4KFzvkh4D8YBzXZqsI6gBhJhriEHiNNyu6Idsah65k2+aPY5nqfYVao5t5+nXJtL +88xi+NZUqD/79YvLoT6kBHFQbn+Gii6uOM2A/5IcdFd+xcTDh7vk86QKWxBMUQbX +3g== +-----END CERTIFICATE----- +-----BEGIN CERTIFICATE----- +MIIFuDCCA6CgAwIBAgIUKopHIWXraxIVdgdtl5r6X4nKl1EwDQYJKoZIhvcNAQEL +BQAwJjEkMCIGA1UEAxMbZmFtZmkuaG9tZSBJbnRlcm5hbCBSb290IENBMB4XDTI2 +MDYyODExNTg0NFoXDTMxMDYyNzExNTkxNFowJTEjMCEGA1UEAxMaZmFtZmkuaG9t +ZSBJbnRlcm1lZGlhdGUgQ0EwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoIC +AQC51pfmO0+x5IdyGiS5tDewGf9lA861HHRLHtVmsLvDiy40tYt94Ka+7XHNVVs3 +LvLksZsbbqF7H+EgKKWtT5y1sDNv3ZoTw46tDelQoBfi0eeQAAnxqa9Erv9L5vct +e+tW20f8r9ouCZGpq+PgXz+V6wvcai4J5Fjb4+WkDVetR7tOERhaGzIhqqOAE8rT +LUhFIBArWDBhyrldQ883i/M7S6eGetBOEvHC/KzVWzHFl7WWX53UEsMtst+PAPS3 +D8/TYgY6H5OE7v5+PYIEfOxzNFioYiR8w3ZxqE8rvUkE+38GhMxOlQ4OBkh3lZnX +kSgw3ZlRQtA+FVlHl1+0dhm3dxvhl5Ha/li8zuRCtAhpFnzgIbb6sfrhgUNbt0BE +g6GnhWXEm3rXPMAlT0yPaVJ0hkLBx8itTeEcOskqC6Jjh9KqweoMRd3Q3JteB+OF +5JB9exyrt1VhV37hfaLhBg+CIqrhJDIUt+RsUsp9QDLCl0sbprkCE6ulXzQcXEIL +b0ZuyrGigZzTraQudp2lPyEAjkMAQlosrBPPkHIixJthWULiVv6TBzTM9Y52Hldk +1Fq+icB7vgtMB0ytLQu586sTkxXl6jfh6rgsAId87UgvG2aTWuPLHe3Nj3iyU6pr +JUYtj+hTofBvqG07GThRKZtdZCKTossWZ1k39Z40NkDUOQIDAQABo4HeMIHbMA4G +A1UdDwEB/wQEAwIBBjAPBgNVHRMBAf8EBTADAQH/MB0GA1UdDgQWBBRsZN8iNGnB +1UsB3jfJuId6zRXSTjAfBgNVHSMEGDAWgBSkIV+ExgLobkAtw3nZkMIV5H6aGTBA +BggrBgEFBQcBAQQ0MDIwMAYIKwYBBQUHMAKGJGh0dHBzOi8vb3BlbmJhby5mYW1m +aS5ob21lL3YxL3BraS9jYTA2BgNVHR8ELzAtMCugKaAnhiVodHRwczovL29wZW5i +YW8uZmFtZmkuaG9tZS92MS9wa2kvY3JsMA0GCSqGSIb3DQEBCwUAA4ICAQCdkrBf +4dlIDQJlkoBTjF3kyVfS6/04w8gCArUeJ6WqvfWmrk8dGnPeTUK+wt2V2uUFqf0+ +OqjvmUs3BjmZ0ChAX2ebye1lL3K1E2uo6cSlpvXU/KgBDuaKc7VBT6EhjWFkS/PW +4ZCrT/H/8Njs3YZV8zJcK+574RQb5V5hBBJppUVTqxSnutUzTb2xXQnQS9R3MJUw +hU3HwCsev0Ca4VfOr0oXsIf9MJY6ZZFIcgkwCHqvrhUAjLMrdXP7WV18LcZ10H6x +horynQ87uLwqA7eZWpEStJMCb6gTg+KH1Oj1Wf2hATDDjwYM+9pfGFvex40fQiBL +gID4WnywK2dA32ummBrFiXVsvFl/KGEaGP6wd6w/7CJmp4Gry+iWZr7ujkRtJI5m +R9f6NOops2vZT7vuWdQPSQBh0GoBTQ0TJLKMrmJgKCizLjo8r9e92gsUbfpxkigf +7mAokYaUI9Zsq322gMblqRQNGkfeaNEL/kHa/a53oLq5hPJwssXdUM34vagczaX2 +HbTnXGmktQnA5r7f4MTNBr+rH2LuWLCfTNzsqDd5O0bdCW/YQg9R5teoyACTuANv +slOYmoYHr+tHQHy/O7tbc1CigJe/U/n95nQX9DsmRCiAasVU8UMhgg9BWrJPAhsL +s0CYZkxpsD2esLud37OflUyVJqhWOBvjldsviQ== +-----END CERTIFICATE----- diff --git a/docker-compose.yml b/docker-compose.yml index 8e738ef..e373859 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -51,6 +51,34 @@ services: ports: - "192.168.0.142:6060:6060" # Prometheus-Metriken (CrowdSec) fuer 192.168.0.23 + # MikroTik-Bouncer: spiegelt CrowdSec-Decisions in eine RouterOS-Firewall- + # Address-List ("crowdsec") auf der AX3 -> Edge-Drop (alle Ports, auch VPN/SSH). + # Verbindet sich per RouterOS-API ueber TLS (api-ssl 8729). Der Hostname + # mt-az.famfi.home (extra_hosts -> 192.168.0.2) muss zum Cert-SAN passen; + # das OpenBAO-Root+Intermediate-Bundle wird via SSL_CERT_FILE vertraut. + crowdsec-mikrotik-bouncer: + image: ghcr.io/funkolab/cs-mikrotik-bouncer:latest + container_name: crowdsec-mikrotik-bouncer + restart: unless-stopped + depends_on: + - crowdsec + networks: + - proxy + extra_hosts: + - "mt-az.famfi.home:192.168.0.2" + environment: + CROWDSEC_URL: "http://crowdsec:8080/" + MIKROTIK_HOST: "mt-az.famfi.home:8729" + MIKROTIK_USER: "apics" + MIKROTIK_TLS: "true" + MIKROTIK_IPV6: "false" + LOG_LEVEL: "1" + SSL_CERT_FILE: "/etc/ssl/famfi-ca.pem" # trust OpenBAO CA for the RouterOS api-ssl cert + env_file: + - .mikrotik.env # MIKROTIK_PASS + CROWDSEC_BOUNCER_API_KEY (root-only, git-ignored) + volumes: + - ./crowdsec/famfi-ca-bundle.pem:/etc/ssl/famfi-ca.pem:ro + networks: proxy: driver: bridge