  junvandCopilot
|
430ca18b41
|
routermon: add WAN incoming traffic monitoring
- Add WanEvent model (src_ip, protocol, dst_port, src_port, geo fields)
with migration 0003_wanevent
- Extend parser to handle kernel:/iptables WAN_IN: syslog lines
- Generalise _RE_SYSLOG to accept 'kernel' process name (no pid)
- Parse KEY=value tokens from iptables log (robust vs monolithic regex)
- Reject private source IPs silently
- Receiver: bulk-create WanEvent rows in _flush(); replace per-flush
geo threads with a single bounded geo-enrichment worker (_geo_queue,
max 500) to safely handle high-volume port scans
- Tasks: batch-delete WanEvent rows (<=3 day retention cap); batch-delete
DnsQuery rows to avoid long SQLite locks
- Views: WanLivePartialView (filterable HTMX table), WanChartDataView
(timeline JSON); dashboard context adds wan_total_24h,
top_attacked_ports_json, top_wan_sources
- Templates:
- _live_wan.html: live event table with color-coded protocol,
clickable IP/port filters, well-known port labels
- dashboard.html: WAN section with 24h counter, timeline chart,
top attacked ports bar chart, top source IPs table, live event stream
- settings.html: Step 5 guide for /jffs/scripts/firewall-start with
rate-limited iptables LOG rules (INPUT + FORWARD chains, 60/min limit)
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
|
2026-04-16 15:34:39 +10:00 |
|