8 Commits
Author SHA1 Message Date
junvandCopilot 11fa2ad673 routermon: replace ISP column with Target Service badge in WAN table
- Remove ISP column (always empty with local MMDB — no ISP data)
- Add Target Service column with color-coded badges (SSH/RDP/VNC/SMB=red,
  HTTP/HTTPS=blue, MySQL/PostgreSQL/Redis/MongoDB=purple, SMTP/POP3/IMAP=green,
  DNS=yellow, FTP=orange)
- Restore inline service label in Dst Port cell (e.g. '22 SSH')
- Expand port mapping: 21 ports covered (FTP, Telnet, SMTP, DNS, POP3,
  IMAP, SMB, MSSQL, MySQL, RDP, PostgreSQL, VNC, Redis, HTTP-alt,
  HTTPS-alt, Elasticsearch, MongoDB)

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
2026-04-16 17:06:55 +10:00
junvandCopilot 60dd5aeffb routermon: break chunk loop early when circuit breaker fires
Stop sending further API requests mid-batch once the backoff is
triggered, saving remaining missing IPs as empty placeholders
immediately instead of waiting for them to timeout one-by-one.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
2026-04-16 16:35:00 +10:00
junvandCopilot dde1c6640c routermon: add circuit breaker for ip-api.com geo lookups
After _GEO_MISS_THRESHOLD (2) consecutive large all-empty API responses,
assume ip-api.com is unreachable and enter a 5-minute backoff.
During backoff all missing IPs are immediately saved as empty IPGeoCache
placeholders so they are not re-queued. Resets automatically when the
backoff expires and any result is returned.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
2026-04-16 16:24:33 +10:00
junvandCopilot cfca2c2ed7 routermon: add WAN geo map + fix batch geo enrichment
- Add WanGeoStatsView (api/wan/geo/) returning country choropleth +
  bubble data for WAN source IPs using IPGeoCache lat/lon
- Add wanGeoMap (420px) in dashboard between ports chart and live table:
  red colour scale by country, rose bubbles sized by attempt count,
  top-5 country legend
- Rewrite _geo_worker_loop to drain up to 200 queue items per cycle,
  bulk DB cache check, batch API calls (100 IPs per request) instead
  of 1 request per IP — fixes ip-api.com timeout pile-up under scan
  volumes
- Add _geo_skip in-memory set: IPs that return no geo data get an
  empty IPGeoCache placeholder saved to DB so they are never retried;
  skip set also prevents re-queuing known-empty IPs during flush
- Remove _fetch_geo / _enrich_dns_geo / _enrich_wan_geo helpers
  (logic consolidated into the new batch worker)

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
2026-04-16 16:13:30 +10:00
junvandCopilot 430ca18b41 routermon: add WAN incoming traffic monitoring
- Add WanEvent model (src_ip, protocol, dst_port, src_port, geo fields)
  with migration 0003_wanevent

- Extend parser to handle kernel:/iptables WAN_IN: syslog lines
  - Generalise _RE_SYSLOG to accept 'kernel' process name (no pid)
  - Parse KEY=value tokens from iptables log (robust vs monolithic regex)
  - Reject private source IPs silently

- Receiver: bulk-create WanEvent rows in _flush(); replace per-flush
  geo threads with a single bounded geo-enrichment worker (_geo_queue,
  max 500) to safely handle high-volume port scans

- Tasks: batch-delete WanEvent rows (<=3 day retention cap); batch-delete
  DnsQuery rows to avoid long SQLite locks

- Views: WanLivePartialView (filterable HTMX table), WanChartDataView
  (timeline JSON); dashboard context adds wan_total_24h,
  top_attacked_ports_json, top_wan_sources

- Templates:
  - _live_wan.html: live event table with color-coded protocol,
    clickable IP/port filters, well-known port labels
  - dashboard.html: WAN section with 24h counter, timeline chart,
    top attacked ports bar chart, top source IPs table, live event stream
  - settings.html: Step 5 guide for /jffs/scripts/firewall-start with
    rate-limited iptables LOG rules (INPUT + FORWARD chains, 60/min limit)

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
2026-04-16 15:34:39 +10:00
junvandCopilot 611305b0ab fix(routermon): fix receiver startup, logging config, and JS template escaping
- Remove SO_REUSEADDR from UDP socket so only one gunicorn worker binds
  port 5514 (second worker intentionally gets EADDRINUSE and skips)
- Add print() fallback for bind confirmation/errors so startup is visible
  even when Django logging config is not fully set up
- Fix duplicate LOGGING dict in settings.py: second assignment was
  overriding the first and removing the root logger handler, silently
  swallowing all routermon/core startup logs
- Add sys.stderr fallback in core/apps.py ready() for startup exceptions
- Fix JS SyntaxError: {{ top_domains_json }} needs |safe filter since
  Django auto-escapes quotes to &quot; inside script tags

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
2026-04-16 14:58:39 +10:00
junv 3409fc8045 fix build 2026-04-16 14:12:21 +10:00
junv 5b1df2ee5e Add router monitor 2026-04-16 14:01:43 +10:00