Keamanan Jaringan IoT: Firewall, VPN & Enkripsi Data

#!/bin/bash
# ============================================
# Firewall IoT Gateway — iptables rules
# ============================================

# Flush rules lama
iptables -F
iptables -X
iptables -t nat -F
iptables -t mangle -F

# Default policy: tolak semua yang masuk, izinkan yang keluar
iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -P OUTPUT ACCEPT

# Izinkan loopback interface (komunikasi internal)
iptables -A INPUT -i lo -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPT

# Izinkan koneksi yang sudah established dan related
iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
iptables -A OUTPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT

# Proteksi terhadap SYN flood attack
iptables -A INPUT -p tcp --syn -m limit --limit 1/s --limit-burst 3 -j ACCEPT
iptables -A INPUT -p tcp --syn -j DROP

# Proteksi terhadap ICMP flood (ping flood)
iptables -A INPUT -p icmp --icmp-type echo-request -m limit --limit 1/s --limit-burst 4 -j ACCEPT
iptables -A INPUT -p icmp --icmp-type echo-request -j DROP

# Izinkan SSH dari jaringan lokal saja (port 22)
iptables -A INPUT -p tcp --dport 22 -s 192.168.1.0/24 -j ACCEPT

# Izinkan MQTT hanya dari localhost (port 1883)
iptables -A INPUT -p tcp --dport 1883 -s 127.0.0.1 -j ACCEPT

# Izinkan HTTPS untuk dashboard (port 443) dari jaringan lokal
iptables -A INPUT -p tcp --dport 443 -s 192.168.1.0/24 -j ACCEPT

# Izinkan NTP untuk sinkronisasi waktu (port 123/UDP)
iptables -A INPUT -p udp --dport 123 -j ACCEPT

# Log paket yang ditolak (untuk debugging)
iptables -A INPUT -m limit --limit 5/min -j LOG --log-prefix "IPT-DROP: " --log-level 4

# Blokir semua traffic dari IP yang mencurigakan
# iptables -A INPUT -s 203.0.113.50 -j DROP

# Simpan rules agar persisten setelah reboot
# apt install iptables-persistent
# netfilter-persistent save
      

#!/usr/sbin/nft -f
# ============================================
# Firewall IoT Gateway — nftables rules
# ============================================

flush ruleset

table inet filter {

    # Set untuk IP yang diblokir
    set blocked_ips {
        type ipv4_addr
        flags interval
        elements = {
            # 203.0.113.50,   # IP mencurigakan
            # 198.51.100.0/24 # Range jaringan berbahaya
        }
    }

    # Set untuk IoT sensor devices
    set iot_sensors {
        type ipv4_addr
        flags interval
        elements = {
            192.168.10.0/24   # Sensor subnet
            192.168.20.0/24   # Kamera subnet
        }
    }

    chain input {
        type filter hook input priority 0; policy drop;

        # Izinkan loopback
        iif "lo" accept

        # Drop IP yang masuk daftar blokir
        ip saddr @blocked_ips counter drop

        # Izinkan koneksi yang sudah established
        ct state established,related accept
        ct state invalid counter drop

        # Proteksi SYN flood
        tcp flags & (syn) ct state new limit rate 2/second accept
        tcp flags & (syn) ct state new counter drop

        # Proteksi ICMP flood
        icmp type echo-request limit rate 2/second accept
        icmp type echo-request counter drop

        # SSH dari jaringan lokal
        tcp dport 22 ip saddr 192.168.1.0/24 accept

        # MQTT hanya dari sensor subnet
        tcp dport 1883 ip saddr @iot_sensors accept

        # Dashboard web (HTTPS) dari LAN
        tcp dport 443 ip saddr 192.168.1.0/24 accept

        # NTP untuk sinkronisasi waktu
        udp dport 123 accept

        # Log semua yang ditolak (maks 5/menit)
        limit rate 5/minute log prefix "NFT-DROP: " level warn

        # Counter untuk semua traffic yang ditolak
        counter comment "total-dropped"
    }

    chain forward {
        type filter hook forward priority 0; policy drop;

        # Izinkan forwarding dari IoT subnet ke internet
        # (untuk perangkat yang perlu update firmware)
        iif "iot-lan" oif "eth0" ct state new accept
        ct state established,related accept
    }

    chain output {
        type filter hook output priority 0; policy accept;
    }
}
      

# ============================================
# WireGuard Setup di IoT Gateway (Server)
# ============================================

# Install WireGuard
sudo apt update && sudo apt install wireguard

# Generate kunci server
wg genkey | tee /etc/wireguard/server_private.key | wg pubkey > /etc/wireguard/server_public.key
chmod 600 /etc/wireguard/server_private.key

# Buat file konfigurasi server
cat > /etc/wireguard/wg0.conf << 'EOF'
[Interface]
PrivateKey = <SERVER_PRIVATE_KEY>
Address = 10.100.0.1/24
ListenPort = 51820
PostUp = iptables -A FORWARD -i wg0 -j ACCEPT; iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
PostDown = iptables -D FORWARD -i wg0 -j ACCEPT; iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE

# Client: Sensor Node (ESP32 via WireGuard)
[Peer]
PublicKey = <SENSOR_PUBLIC_KEY>
AllowedIPs = 10.100.0.2/32

# Client: Raspberry Pi Remote Monitor
[Peer]
PublicKey = <MONITOR_PUBLIC_KEY>
AllowedIPs = 10.100.0.3/32
EOF

# Aktifkan IP forwarding
echo "net.ipv4.ip_forward=1" >> /etc/sysctl.conf
sysctl -p

# Jalankan WireGuard
wg-quick up wg0
systemctl enable wg-quick@wg0
      

# ============================================
# WireGuard Setup di Client IoT Device
# ============================================

# Generate kunci client
wg genkey | tee /etc/wireguard/client_private.key | wg pubkey > /etc/wireguard/client_public.key

# Konfigurasi client
cat > /etc/wireguard/wg0.conf << 'EOF'
[Interface]
PrivateKey = <CLIENT_PRIVATE_KEY>
Address = 10.100.0.2/24
DNS = 1.1.1.1

[Peer]
PublicKey = <SERVER_PUBLIC_KEY>
Endpoint = iot-gateway.example.com:51820
AllowedIPs = 10.100.0.0/24, 192.168.1.0/24
PersistentKeepalive = 25
EOF

# Jalankan koneksi VPN
wg-quick up wg0
      

# ============================================
# OpenVPN Server — IoT Gateway
# ============================================

# Install dependencies
sudo apt install openvpn easy-rsa

# Inisialisasi PKI
make-cadir ~/openvpn-ca
cd ~/openvpn-ca
./easyrsa init-pki
./easyrsa build-ca nopass
./easyrsa gen-req iot-server nopass
./easyrsa sign-req server iot-server

# Generate TLS auth key
openvpn --genkey secret pki/ta.key

# Generate kunci Diffie-Hellman
openssl dhparam -out pki/dh.pem 2048

# Copy file ke direktori OpenVPN
cp pki/ca.crt pki/issued/iot-server.crt pki/private/iot-server.key pki/ta.key pki/dh.pem /etc/openvpn/

# Jalankan OpenVPN server
openvpn --config /etc/openvpn/server.conf --daemon
      

# ============================================
# TLS/SSL Client untuk IoT — Python
# ============================================

import ssl
import socket
import paho.mqtt.client as mqtt

def create_iot_ssl_context():
    """Membuat SSL context yang aman untuk IoT device."""
    context = ssl.SSLContext(ssl.PROTOCOL_TLS_CLIENT)

    # Gunakan hanya TLS 1.2 dan 1.3 (tolak versi lama yang lemah)
    context.minimum_version = ssl.TLSVersion.TLSv1_2

    # Load CA certificate untuk verifikasi server
    context.load_verify_locations('/etc/ssl/certs/ca-certificates.crt')

    # Verifikasi sertifikat server wajib aktif
    context.verify_mode = ssl.CERT_REQUIRED

    # Load sertifikat client (mutual TLS / mTLS)
    context.load_cert_chain(
        certfile='/etc/iot/certs/device.crt',
        keyfile='/etc/iot/certs/device.key'
    )

    # Cipher suite yang aman saja
    context.set_ciphers(
        'ECDHE+AESGCM:ECDHE+CHACHA20:DHE+AESGCM:DHE+CHACHA20'
    )

    return context

# Konfigurasi MQTT over TLS
client = mqtt.Client(client_id="sensor-suhu-001")
client.tls_set_context(create_iot_ssl_context())
client.tls_insecure_set(False)  # Selalu verifikasi sertifikat

client.username_pw_set("sensor-001", password="token-rahasia-123")
client.connect("mqtt.example.com", port=8883, keepalive=60)

# Publish data sensor terenkripsi
import json, time
while True:
    data = {
        "device_id": "sensor-suhu-001",
        "temperature": 28.5,
        "humidity": 65.2,
        "timestamp": int(time.time())
    }
    client.publish("iot/suhu/data", json.dumps(data), qos=1)
    time.sleep(10)
      

# ============================================
# AES-256-GCM untuk Enkripsi Data IoT
# ============================================

from cryptography.hazmat.primitives.ciphers.aead import AESGCM
from cryptography.hazmat.primitives import hashes
from cryptography.hazmat.primitives.kdf.pbkdf2 import PBKDF2HMAC
import os
import base64
import json

class IoTDataEncryptor:
    """Enkripsi data sensor IoT menggunakan AES-256-GCM."""

    def __init__(self, master_key: str, salt: bytes = None):
        if salt is None:
            salt = os.urandom(16)

        # Derive encryption key dari master password
        kdf = PBKDF2HMAC(
            algorithm=hashes.SHA256(),
            length=32,           # 256-bit key
            salt=salt,
            iterations=480000    # OWASP recommended minimum
        )
        key = kdf.derive(master_key.encode())
        self.aesgcm = AESGCM(key)
        self.salt = salt

    def encrypt_sensor_data(self, data: dict) -> dict:
        """Enkripsi data sensor dengan nonce unik."""
        nonce = os.urandom(12)  # 96-bit nonce untuk GCM
        plaintext = json.dumps(data).encode('utf-8')

        # Enkripsi + autentikasi
        ciphertext = self.aesgcm.encrypt(nonce, plaintext, None)

        return {
            "nonce": base64.b64encode(nonce).decode(),
            "ciphertext": base64.b64encode(ciphertext).decode(),
            "salt": base64.b64encode(self.salt).decode()
        }

    def decrypt_sensor_data(self, encrypted: dict) -> dict:
        """Dekripsi data sensor dan verifikasi integritas."""
        nonce = base64.b64decode(encrypted["nonce"])
        ciphertext = base64.b64decode(encrypted["ciphertext"])

        # Dekripsi + verifikasi autentikasi
        plaintext = self.aesgcm.decrypt(nonce, ciphertext, None)
        return json.loads(plaintext.decode('utf-8'))


# Contoh penggunaan
encryptor = IoTDataEncryptor(master_key="r4h4s1a_k3y_i0t_2026!")

# Data asli dari sensor
sensor_reading = {
    "device_id": "sensor-kelembaban-003",
    "soil_moisture": 42.7,
    "temperature": 26.3,
    "battery_pct": 78
}

# Enkripsi
encrypted = encryptor.encrypt_sensor_data(sensor_reading)
print(f"Encrypted: {json.dumps(encrypted, indent=2)}")

# Dekripsi
decrypted = encryptor.decrypt_sensor_data(encrypted)
print(f"Decrypted: {json.dumps(decrypted, indent=2)}")
      

# ============================================
# HashiCorp Vault untuk IoT Secrets Management
# ============================================

# Start Vault server (development mode untuk testing)
vault server -dev -dev-root-token-id="iot-root-token"

# Export Vault address
export VAULT_ADDR='http://127.0.0.1:8200'

# Enable KV secrets engine v2
vault secrets enable -path=iot kv-v2

# Simpan kredensial MQTT
vault kv put iot/mqtt/production \
    host="mqtt.example.com" \
    port=8883 \
    username="iot-broker-user" \
    password="sup3r_s3cr3t_p@ss!" \
    ca_cert="@/etc/iot/certs/ca.pem"

# Simpan kredensial database sensor
vault kv put iot/database/sensors \
    host="db.internal.iothub.local" \
    port=5432 \
    username="sensor_writer" \
    password="db_p@ssw0rd_2026" \
    dbname="iot_sensor_data"

# Baca secrets (dari aplikasi Python/Node.js)
vault kv get -field=password iot/mqtt/production
      

# ============================================
# OAuth2 Client Credentials untuk IoT Device
# ============================================

import requests
import json
import time

class IoTOAuth2Client:
    """OAuth2 client untuk autentikasi device-to-service."""

    def __init__(self, client_id, client_secret, token_url):
        self.client_id = client_id
        self.client_secret = client_secret
        self.token_url = token_url
        self._token = None
        self._token_expiry = 0

    def get_access_token(self) -> str:
        """Dapatkan access token dengan auto-refresh."""
        if self._token and time.time() < self._token_expiry - 60:
            return self._token

        response = requests.post(self.token_url, data={
            "grant_type": "client_credentials",
            "client_id": self.client_id,
            "client_secret": self.client_secret,
            "scope": "iot:read iot:write telemetry:publish"
        })

        if response.status_code == 200:
            data = response.json()
            self._token = data["access_token"]
            self._token_expiry = time.time() + data["expires_in"]
            return self._token
        else:
            raise Exception(f"OAuth2 token error: {response.status_code}")

    def publish_telemetry(self, endpoint, payload):
        """Kirim data telemetri dengan OAuth2 token."""
        token = self.get_access_token()
        headers = {
            "Authorization": f"Bearer {token}",
            "Content-Type": "application/json"
        }
        return requests.post(endpoint, json=payload, headers=headers)


# Penggunaan
client = IoTOAuth2Client(
    client_id="iot-sensor-fleet-001",
    client_secret="client_secret_rahasia",
    token_url="https://auth.example.com/oauth/token"
)

result = client.publish_telemetry(
    "https://api.example.com/iot/telemetry",
    {"device_id": "sensor-001", "value": 42.5}
)
      

# ============================================
# JWT Authentication untuk IoT API
# ============================================

import jwt
import datetime
from functools import wraps
from flask import Flask, request, jsonify

app = Flask(__name__)
SECRET_KEY = "jwt-secret-key-yang-sangat-panjang-dan-aman"
ALGORITHM = "HS256"

# ============================================
# Token Generation (dilakukan saat device provisioning)
# ============================================

def generate_device_token(device_id: str, role: str = "sensor") -> str:
    """Buat JWT token untuk perangkat IoT."""
    payload = {
        "sub": device_id,              # Subject: ID perangkat
        "role": role,                   # Role: sensor, actuator, admin
        "iat": datetime.datetime.utcnow(),
        "exp": datetime.datetime.utcnow() + datetime.timedelta(days=30),
        "iss": "iot-gateway",          # Issuer
        "permissions": {
            "publish": ["telemetry", "status"],
            "subscribe": ["commands"]
        }
    }
    return jwt.encode(payload, SECRET_KEY, algorithm=ALGORITHM)


def verify_device_token(f):
    """Decorator untuk verifikasi JWT pada endpoint API."""
    @wraps(f)
    def decorated(*args, **kwargs):
        token = request.headers.get("Authorization", "").replace("Bearer ", "")

        if not token:
            return jsonify({"error": "Token tidak ditemukan"}), 401

        try:
            payload = jwt.decode(token, SECRET_KEY, algorithms=[ALGORITHM])
            request.device_id = payload["sub"]
            request.device_role = payload["role"]
        except jwt.ExpiredSignatureError:
            return jsonify({"error": "Token sudah kadaluarsa"}), 401
        except jwt.InvalidTokenError:
            return jsonify({"error": "Token tidak valid"}), 401

        return f(*args, **kwargs)
    return decorated


# ============================================
# Contoh Endpoint API IoT
# ============================================

@app.route("/api/telemetry", methods=["POST"])
@verify_device_token
def receive_telemetry():
    """Endpoint menerima data telemetri dari sensor."""
    data = request.json
    device_id = request.device_id

    # Simpan data ke database
    # db.save(device_id, data)

    return jsonify({
        "status": "received",
        "device_id": device_id,
        "timestamp": datetime.datetime.utcnow().isoformat()
    }), 201


@app.route("/api/commands/", methods=["POST"])
@verify_device_token
def send_command(device_id):
    """Endpoint mengirim perintah ke actuator."""
    if request.device_role != "admin":
        return jsonify({"error": "Akses ditolak"}), 403

    command = request.json
    return jsonify({"status": "sent", "command": command}), 200


# Generate token untuk device provisioning
token = generate_device_token("sensor-suhu-001", role="sensor")
print(f"Device Token: {token}")
      

# ============================================
# API Key Management untuk IoT
# ============================================

import secrets
import hashlib
import time
from datetime import datetime, timedelta

class APIKeyManager:
    """Manajemen API keys untuk perangkat IoT."""

    def __init__(self):
        self.keys_store = {}  # Dalam produksi: gunakan database terenkripsi

    def generate_key(self, device_id: str, scopes: list, expiry_days: int = 90) -> dict:
        """Generate API key baru untuk perangkat IoT."""
        raw_key = f"iot_{secrets.token_hex(32)}"
        key_hash = hashlib.sha256(raw_key.encode()).hexdigest()

        self.keys_store[key_hash] = {
            "device_id": device_id,
            "scopes": scopes,
            "created_at": datetime.utcnow(),
            "expires_at": datetime.utcnow() + timedelta(days=expiry_days),
            "is_active": True
        }

        return {
            "api_key": raw_key,       # Hanya ditampilkan SEKALI
            "key_prefix": raw_key[:12] + "...",
            "device_id": device_id,
            "scopes": scopes,
            "expires_at": self.keys_store[key_hash]["expires_at"].isoformat()
        }

    def validate_key(self, api_key: str, required_scope: str = None) -> dict:
        """Validasi API key dan cek expiry."""
        key_hash = hashlib.sha256(api_key.encode()).hexdigest()

        if key_hash not in self.keys_store:
            return {"valid": False, "error": "Key tidak ditemukan"}

        key_data = self.keys_store[key_hash]

        if not key_data["is_active"]:
            return {"valid": False, "error": "Key sudah dinonaktifkan"}

        if datetime.utcnow() > key_data["expires_at"]:
            return {"valid": False, "error": "Key sudah kadaluarsa"}

        if required_scope and required_scope not in key_data["scopes"]:
            return {"valid": False, "error": f"Akses '{required_scope}' tidak diizinkan"}

        return {"valid": True, "device_id": key_data["device_id"]}

    def revoke_key(self, api_key: str):
        """Nonaktifkan API key."""
        key_hash = hashlib.sha256(api_key.encode()).hexdigest()
        if key_hash in self.keys_store:
            self.keys_store[key_hash]["is_active"] = False


# Contoh penggunaan
manager = APIKeyManager()
key_info = manager.generate_key(
    device_id="actuator-pompa-001",
    scopes=["telemetry:read", "command:write"],
    expiry_days=90
)
print(f"API Key (simpan ini!): {key_info['api_key']}")
      

# ============================================
# VLAN Segmentation untuk IoT Network
# ============================================

# Buat VLAN interface di MikroTik
/interface vlan
add name=vlan10-iot-sensors vlan-id=10 interface=bridge comment="IoT Sensors"
add name=vlan20-cameras vlan-id=20 interface=bridge comment="IoT Cameras"
add name=vlan30-trusted vlan-id=30 interface=bridge comment="Trusted LAN"
add name=vlan40-mgmt vlan-id=40 interface=bridge comment="Management"

# Tambahkan IP address ke masing-masing VLAN
/ip address
add address=10.10.10.1/24 interface=vlan10-iot-sensors comment="Gateway VLAN10"
add address=10.10.20.1/24 interface=vlan20-cameras comment="Gateway VLAN20"
add address=192.168.1.1/24 interface=vlan30-trusted comment="Gateway VLAN30"
add address=10.10.40.1/24 interface=vlan40-mgmt comment="Gateway VLAN40"

# DHCP Server untuk setiap VLAN
/ip dhcp-server
add name=dhcp-iot interface=vlan10-iot-sensors address-pool=iot-pool
add name=dhcp-cam interface=vlan20-cameras address-pool=cam-pool

/ip dhcp-server network
add address=10.10.10.0/24 gateway=10.10.10.1 dns-server=10.10.10.1
add address=10.10.20.0/24 gateway=10.10.20.1 dns-server=10.10.20.1

# Firewall rules untuk isolasi antar VLAN
/ip firewall filter

# VLAN 10 (IoT Sensors): hanya boleh akses MQTT broker, NTP, dan DNS
add chain=forward src-address=10.10.10.0/24 dst-address=10.10.10.1 \
    protocol=tcp dst-port=1883 action=accept comment="IoT→MQTT Allow"
add chain=forward src-address=10.10.10.0/24 protocol=udp dst-port=53 action=accept \
    comment="IoT→DNS Allow"
add chain=forward src-address=10.10.10.0/24 protocol=udp dst-port=123 action=accept \
    comment="IoT→NTP Allow"

# VLAN 10: Boleh akses internet untuk firmware update (terbatas)
add chain=forward src-address=10.10.10.0/24 dst-address=104.16.0.0/12 \
    protocol=tcp dst-port=443 action=accept comment="IoT→Cloud Update"

# VLAN 10: BLOKIR semua akses ke VLAN lain
add chain=forward src-address=10.10.10.0/24 dst-address=10.10.20.0/24 action=drop \
    comment="IoT→Cam Block"
add chain=forward src-address=10.10.10.0/24 dst-address=192.168.1.0/24 action=drop \
    comment="IoT→Trusted Block"

# VLAN 20 (Cameras): isolasi total dari LAN
add chain=forward src-address=10.10.20.0/24 dst-address=192.168.1.0/24 action=drop \
    comment="Cam→Trusted Block"

# VLAN 40 (Management): hanya bisa diakses dari VLAN 30
add chain=forward src-address=!192.168.1.0/24 dst-address=10.10.40.0/24 action=drop \
    comment="Block Mgmt from non-trusted"
      

# ============================================
# Microsegmentation untuk Perangkat IoT
# ============================================

# Definisikan IP set untuk setiap kategori device
ipset create iot-sensors hash:ip hashsize 1024
ipset add iot-sensors 10.10.10.10   # Sensor suhu
ipset add iot-sensors 10.10.10.11   # Sensor kelembaban
ipset add iot-sensors 10.10.10.12   # Sensor cahaya

ipset create iot-actuators hash:ip hashsize 256
ipset add iot-actuators 10.10.10.50  # Relay pompa
ipset add iot-actuators 10.10.10.51  # Solenoid valve

ipset create iot-critical hash:ip hashsize 64
ipset add iot-critical 10.10.10.100  # Safety controller

# Microsegmentation rules:
# Sensor hanya boleh PUBLISH ke MQTT broker
iptables -A FORWARD -m set --match-set iot-sensors src \
    -d 10.10.10.1 -p tcp --dport 1883 -j ACCEPT
iptables -A FORWARD -m set --match-set iot-sensors src \
    -m set ! --match-set iot-critical dst -j DROP

# Actuator hanya boleh SUBSCRIBE dari MQTT, tidak boleh inisiasi koneksi
iptables -A FORWARD -m set --match-set iot-actuators src \
    -d 10.10.10.1 -p tcp --dport 1883 -j ACCEPT
iptables -A FORWARD -m set --match-set iot-actuators src -j DROP

# Critical devices: diizinkan komunikasi penuh di dalam subnet
iptables -A FORWARD -m set --match-set iot-critical src \
    -m set --match-set iot-critical dst -j ACCEPT

echo "Microsegmentation rules applied successfully."
      

# ============================================
# Snort IDS untuk Monitoring IoT Traffic
# ============================================

# Install Snort
sudo apt install snort

# Konfigurasi Snort untuk jaringan IoT
# Edit /etc/snort/snort.conf

# Set network variables
# var HOME_NET 10.10.10.0/24,10.10.20.0/24
# var EXTERNAL_NET !$HOME_NET

# Aktifkan rule categories yang relevan
# include $RULE_PATH/local.rules
# include $RULE_PATH/attack-responses.rules
# include $RULE_PATH/exploit.rules
# include $RULE_PATH/icmp-info.rules
# include $RULE_PATH/malware-backdoor.rules
# include $RULE_PATH/protocol-dns.rules
# include $RULE_PATH/protocol-services.rules

# Custom rules untuk IoT
# cat >> /etc/snort/rules/local.rules << 'RULES'
# alert tcp any any -> $HOME_NET 1883 (msg:"MQTT Brute Force Attempt"; \
#     flags:S,12; threshold:type threshold, track by_src, count 10, \
#     seconds 60; sid:1000001; rev:1;)
#
# alert udp any any -> $HOME_NET any (msg:"Potential IoT Deauth Attack"; \
#     dsize:0; sid:1000002; rev:1;)
#
# alert tcp any any -> $HOME_NET 22 (msg:"SSH Brute Force IoT Gateway"; \
#     flags:S,12; threshold:type threshold, track by_src, count 5, \
#     seconds 30; sid:1000003; rev:1;)
# RULES

# Jalankan Snort dalam mode IDS
snort -c /etc/snorm/snort.conf -i eth1 -A alert_fast -l /var/log/snort/
      

# ============================================
# Suricata IDS/IPS — IoT Network Monitoring
# File: /etc/suricata/suricata.yaml
# ============================================

vars:
  address-groups:
    HOME_NET: "[10.10.10.0/24,10.10.20.0/24,192.168.1.0/24]"
    EXTERNAL_NET: "!$HOME_NET"
    MQTT_SERVER: "[10.10.10.1]"
    IOT_CAMERAS: "[10.10.20.0/24]"

  port-groups:
    MQTT_PORTS: "[1883,8883]"
    SSH_PORTS: "[22]"

# Network Interface Configuration
af-packet:
  - interface: eth1
    cluster-id: 99
    cluster-type: cluster_flow
    defrag: yes
    use-mmap: yes
    threads: 4

# Rule Management
default-log-dir: /var/log/suricata/

outputs:
  - fast:
      enabled: yes
      filename: fast.log
  - eve-log:
      enabled: yes
      filename: eve.json
      types:
        - alert
        - http
        - dns
        - tls
        - files
        - ssh
  - stats:
      enabled: yes
      filename: stats.log
      interval: 30

# Detection Engine
detect:
  profile: medium
  sgh-mpm-context: auto

# IoT-specific rules (dalam file terpisah)
# include: /etc/suricata/rules/iot-local.rules
      

# ============================================
# Custom Suricata Rules untuk IoT
# File: /etc/suricata/rules/iot-local.rules
# ============================================

# Deteksi port scanning ke jaringan IoT
alert tcp $EXTERNAL_NET any -> $HOME_NET any \
    (msg:"IoT NETWORK Scan Detected"; \
    flags:S,12; \
    threshold:type threshold, track by_src, count 20, seconds 60; \
    classtype:attempted-recon; \
    sid:1000101; rev:1;)

# Deteksi percobaan brute force MQTT
alert tcp any any -> $MQTT_SERVER $MQTT_PORTS \
    (msg:"MQTT Brute Force Attempt"; \
    flags:S,12; \
    threshold:type threshold, track by_src, count 10, seconds 30; \
    classtype:attempted-admin; \
    sid:1000102; rev:1;)

# Deteksi data exfiltration dari sensor
alert tcp $HOME_NET any -> $EXTERNAL_NET any \
    (msg:"Possible IoT Data Exfiltration"; \
    dsize:>1000; \
    flow:to_server,established; \
    threshold:type threshold, track by_src, count 5, seconds 60; \
    classtype:attempted-data-leak; \
    sid:1000103; rev:1;)

# Deteksi komunikasi ke IP command & control (C2)
alert ip $HOME_NET any -> $EXTERNAL_NET any \
    (msg:"IoT Device communicating with known C2 server"; \
    ip.dst:; \
    classtype:trojan-activity; \
    sid:1000104; rev:1;)

# Deteksi aktivitas DNS tunneling (sering digunakan di IoT malware)
alert dns any any -> any any \
    (msg:"DNS Tunneling attempt from IoT device"; \
    dns.query; \
    pcre:"/^[a-zA-Z0-9]{60,}\./"; \
    classtype:attempted-dos; \
    sid:1000105; rev:1;)