Skip to content

Pending Tasks — Network & Monitoring

Last updated: 2026-07-04 Source: FPT→MikroTik migration + ElastiFlow + monitoring session

Security Sensor Pipeline

Plan: plans/260704-1645-security-sensor-pipeline/plan.md

Task 1: ros-security-exporter (CRITICAL)

Python script on unraid, runs every 30s via cron.

Metrics to produce:

  • ros_firewall_drop_rate{rule} — derived from mktxp_firewall_filter_total rate
  • ros_connections{state,proto} — connection tracking breakdown
  • ros_zone_traffic_bytes{zone,dir} — IoT vs LAN vs servers traffic
  • ros_queue_dropped{tier} — QoS drops per tier (congestion indicator)
  • ros_netflow_export_rate — detect collector disconnect
  • ros_vpn_status{provider} — Gluetun health

Push to: http://100.68.251.84:8428/api/v1/import/prometheus (Tailscale IP) Query mik-main: http://192.168.100.1/rest/ auth lucndm:minhluc1

Task 2: VM alert rules → ntfy (HIGH)

vmalert hoặc Grafana Unified Alerting.

Alert rules:

  • rate(mktxp_firewall_filter_total{name=~".*drop-wan.*"}[5m]) > 10 → ros-critical (urgent)
  • mktxp_queue_tree_queued_bytes_total > 0 → ros-warning (high)
  • mktxp_ip_connections_total > 1000 → ros-warning
  • ros_netflow_export_rate == 0 for 5m → ros-critical (collector down)
  • changes(ros_vpn_status[10m]) > 3 → ros-warning (VPN flap)

ntfy endpoint: https://ntfy.minhluc.info/ros-critical auth lucndm:minhluc1 Anonymous read: granted on ros-alerts, rosalerts topics

Task 3: Grafana security dashboard (HIGH)

Datasource: VictoriaMetrics (uid=mimir, url=100.68.251.84:8428)

Panels:

  1. WAN Threat Rate: rate(mktxp_firewall_filter_total{name=~".*drop.*"}[5m]) * 60
  2. Connection Count: mktxp_ip_connections_total + threshold line
  3. QoS Tier Utilization: rate(mktxp_queue_tree_rates_total[5m]) * 8 stacked
  4. Zone Traffic: rate(ros_zone_traffic_bytes[5m]) * 8
  5. QoS Drops: mktxp_queue_tree_dropped_total

Data links: each panel → https://192.168.100.59:5601/app/dashboards#/view/<id>?_g=(time:(from:${__from},to:${__to}))

Task 4: Zone definitions (MEDIUM)

mik-main address-lists:

/ip firewall address-list
add list=iot address=192.168.100.50-192.168.100.56
add list=servers address=192.168.100.10-192.168.100.32
add list=lan-dynamic address=192.168.100.100-192.168.100.199

Task 5: Grafana → OpenSearch drill-down (MEDIUM)

Dashboard data links with ${__from} / ${__to} time range variables. Click alert → jump to ElastiFlow Threats dashboard with same time window.

Task 6: VPN health metric (NICE)

Gluetun container healthcheck → push ros_vpn_status{provider="gluetun"} 1/0 to VM.

Config Sync (unraid changes not in repo)

Task 7: Caddy ntfy route

Changed on unraid: 192.168.100.228:9282 → 192.168.100.31:9282 File: stacks/networking/caddy/conf/tunnel-routes.caddyfile (inside Caddy container) Repo file: needs equivalent update

Task 8: mktxp config

Changed on unraid: hostname = 10.10.4.1 → 192.168.100.1, credentials lucndm/minhluc1 Path: /mnt/user/appdata/otel-collector/configs/mktxp/mktxp.conf

Task 9: OpenSearch compose

Changed on unraid: heap 512m → 2g, added opensearch-dashboards container Repo: stacks/database/opensearch/compose.yaml — already updated

Task 10: ElastiFlow compose

Created on unraid at /mnt/user/appdata/elastiflow/compose.yaml (standalone) Repo: stacks/monitoring/elastiflow/compose.yaml — already exists

Deferred / Minor

Task 11: Password mik-main

minhluc1 leaked in chat history. User deferred. Winbox: /password → new strong password.

Task 12: Grafana MikroTik dashboard

Import dashboard ID 17346 (mktxp MikroTik) via Grafana UI. URL: http://192.168.100.59:3002 → + Import → 17346

Task 13: btest service

Cannot disable via REST (device-mode x86 CHR). Need Winbox: /system/device-mode/update bandwidth-test=no → reboot.

Key References

  • mik-main REST: http://192.168.100.1/rest/ auth lucndm:minhluc1
  • VM endpoint: http://100.68.251.84:8428 (Tailscale)
  • OpenSearch: http://192.168.100.59:9200 (LAN)
  • OpenSearch Dashboards: http://192.168.100.59:5601
  • ntfy: https://ntfy.minhluc.info auth lucndm:minhluc1
  • Grafana: http://192.168.100.59:3002 datasource uid=mimir
  • ElastiFlow flow-collector: unraid, UDP 9995, network_mode: host
  • Lessons: docs/agents/lessons/routeros-network-operations.md