mirror of
https://github.com/eworm-de/routeros-scripts
synced 2024-05-14 08:04:19 +00:00
Merge branch 'fw-addr-lists' into next
This commit is contained in:
commit
20d1ad17d7
4 changed files with 80 additions and 16 deletions
|
@ -56,8 +56,12 @@ available in my repository and downloaded automatically. Import it manually
|
||||||
(menu `/certificate/`) if missing.
|
(menu `/certificate/`) if missing.
|
||||||
|
|
||||||
Create firewall rules to process the packets that are related to addresses
|
Create firewall rules to process the packets that are related to addresses
|
||||||
from address-lists. This rejects the packets from and to ip addresses listed
|
from address-lists.
|
||||||
in address-list `block`.
|
|
||||||
|
### IPv4 rules
|
||||||
|
|
||||||
|
This rejects the packets from and to IPv4 addresses listed in
|
||||||
|
address-list `block`.
|
||||||
|
|
||||||
/ip/firewall/filter/add chain=input src-address-list=block action=reject reject-with=icmp-admin-prohibited;
|
/ip/firewall/filter/add chain=input src-address-list=block action=reject reject-with=icmp-admin-prohibited;
|
||||||
/ip/firewall/filter/add chain=forward src-address-list=block action=reject reject-with=icmp-admin-prohibited;
|
/ip/firewall/filter/add chain=forward src-address-list=block action=reject reject-with=icmp-admin-prohibited;
|
||||||
|
@ -85,6 +89,33 @@ Alternatively handle the packets in firewall's raw section if you prefer:
|
||||||
> ⚠️ **Warning**: Just again... The order of firewall rules is important. Make
|
> ⚠️ **Warning**: Just again... The order of firewall rules is important. Make
|
||||||
> sure they actually take effect as expected!
|
> sure they actually take effect as expected!
|
||||||
|
|
||||||
|
### IPv6 rules
|
||||||
|
|
||||||
|
These are the same rules, but for IPv6.
|
||||||
|
|
||||||
|
Reject packets in address-list `block`:
|
||||||
|
|
||||||
|
/ipv6/firewall/filter/add chain=input src-address-list=block action=reject reject-with=icmp-admin-prohibited;
|
||||||
|
/ipv6/firewall/filter/add chain=forward src-address-list=block action=reject reject-with=icmp-admin-prohibited;
|
||||||
|
/ipv6/firewall/filter/add chain=forward dst-address-list=block action=reject reject-with=icmp-admin-prohibited;
|
||||||
|
/ipv6/firewall/filter/add chain=output dst-address-list=block action=reject reject-with=icmp-admin-prohibited;
|
||||||
|
|
||||||
|
Allow packets in address-list `allow`:
|
||||||
|
|
||||||
|
/ipv6/firewall/filter/add chain=input src-address-list=allow action=accept;
|
||||||
|
/ipv6/firewall/filter/add chain=forward src-address-list=allow action=accept;
|
||||||
|
/ipv6/firewall/filter/add chain=forward dst-address-list=allow action=accept;
|
||||||
|
/ipv6/firewall/filter/add chain=output dst-address-list=allow action=accept;
|
||||||
|
|
||||||
|
Drop packets in firewall's raw section:
|
||||||
|
|
||||||
|
/ipv6/firewall/raw/add chain=prerouting src-address-list=block action=drop;
|
||||||
|
/ipv6/firewall/raw/add chain=prerouting dst-address-list=block action=drop;
|
||||||
|
/ipv6/firewall/raw/add chain=output dst-address-list=block action=drop;
|
||||||
|
|
||||||
|
> ⚠️ **Warning**: Just again... The order of firewall rules is important. Make
|
||||||
|
> sure they actually take effect as expected!
|
||||||
|
|
||||||
---
|
---
|
||||||
[⬅️ Go back to main README](../README.md)
|
[⬅️ Go back to main README](../README.md)
|
||||||
[⬆️ Go back to top](#top)
|
[⬆️ Go back to top](#top)
|
||||||
|
|
|
@ -24,7 +24,7 @@
|
||||||
:global WaitFullyConnected;
|
:global WaitFullyConnected;
|
||||||
|
|
||||||
:local FindDelim do={
|
:local FindDelim do={
|
||||||
:local ValidChars "0123456789./ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz-";
|
:local ValidChars "0123456789.:/ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz-";
|
||||||
:for I from=0 to=[ :len $1 ] do={
|
:for I from=0 to=[ :len $1 ] do={
|
||||||
:if ([ :typeof [ :find $ValidChars [ :pick ($1 . " ") $I ] ] ] != "num") do={
|
:if ([ :typeof [ :find $ValidChars [ :pick ($1 . " ") $I ] ] ] != "num") do={
|
||||||
:return $I;
|
:return $I;
|
||||||
|
@ -38,10 +38,11 @@ $WaitFullyConnected;
|
||||||
:local ListComment ("managed by " . $0);
|
:local ListComment ("managed by " . $0);
|
||||||
|
|
||||||
:foreach FwListName,FwList in=$FwAddrLists do={
|
:foreach FwListName,FwList in=$FwAddrLists do={
|
||||||
:local Addresses ({});
|
|
||||||
:local CntAdd 0;
|
:local CntAdd 0;
|
||||||
:local CntRenew 0;
|
:local CntRenew 0;
|
||||||
:local CntRemove 0;
|
:local CntRemove 0;
|
||||||
|
:local IPv4Addresses ({});
|
||||||
|
:local IPv6Addresses ({});
|
||||||
:local Failure false;
|
:local Failure false;
|
||||||
|
|
||||||
:foreach List in=$FwList do={
|
:foreach List in=$FwList do={
|
||||||
|
@ -85,7 +86,11 @@ $WaitFullyConnected;
|
||||||
:local Address ([ :pick $Line 0 [ $FindDelim $Line ] ] . ($List->"cidr"));
|
:local Address ([ :pick $Line 0 [ $FindDelim $Line ] ] . ($List->"cidr"));
|
||||||
:if ($Address ~ "^[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}(/[0-9]{1,2})?\$" || \
|
:if ($Address ~ "^[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}(/[0-9]{1,2})?\$" || \
|
||||||
$Address ~ "^[\\.a-zA-Z0-9-]+\\.[a-zA-Z]{2,}\$") do={
|
$Address ~ "^[\\.a-zA-Z0-9-]+\\.[a-zA-Z]{2,}\$") do={
|
||||||
:set ($Addresses->$Address) $TimeOut;
|
:set ($IPv4Addresses->$Address) $TimeOut;
|
||||||
|
}
|
||||||
|
:if ($Address ~ "^[0-9a-zA-Z]*:[0-9a-zA-Z:\\.]+(/[0-9]{1,3})?\$" || \
|
||||||
|
$Address ~ "^[\\.a-zA-Z0-9-]+\\.[a-zA-Z]{2,}\$") do={
|
||||||
|
:set ($IPv6Addresses->$Address) $TimeOut;
|
||||||
}
|
}
|
||||||
:set Data [ :pick $Data ([ :len $Line ] + 1) [ :len $Data ] ];
|
:set Data [ :pick $Data ([ :len $Line ] + 1) [ :len $Data ] ];
|
||||||
}
|
}
|
||||||
|
@ -93,28 +98,55 @@ $WaitFullyConnected;
|
||||||
|
|
||||||
:foreach Entry in=[ /ip/firewall/address-list/find where list=$FwListName comment=$ListComment ] do={
|
:foreach Entry in=[ /ip/firewall/address-list/find where list=$FwListName comment=$ListComment ] do={
|
||||||
:local Address [ /ip/firewall/address-list/get $Entry address ];
|
:local Address [ /ip/firewall/address-list/get $Entry address ];
|
||||||
:if ([ :typeof ($Addresses->$Address) ] = "time") do={
|
:if ([ :typeof ($IPv4Addresses->$Address) ] = "time") do={
|
||||||
$LogPrintExit2 debug $0 ("Renewing for " . ($Addresses->$Address) . ": " . $Address) false;
|
$LogPrintExit2 debug $0 ("Renewing IPv4 address for " . ($IPv4Addresses->$Address) . ": " . $Address) false;
|
||||||
/ip/firewall/address-list/set $Entry timeout=($Addresses->$Address);
|
/ip/firewall/address-list/set $Entry timeout=($IPv4Addresses->$Address);
|
||||||
:set ($Addresses->$Address);
|
:set ($IPv4Addresses->$Address);
|
||||||
:set CntRenew ($CntRenew + 1);
|
:set CntRenew ($CntRenew + 1);
|
||||||
} else={
|
} else={
|
||||||
:if ($Failure = false) do={
|
:if ($Failure = false) do={
|
||||||
$LogPrintExit2 debug $0 ("Removing: " . $Address) false;
|
$LogPrintExit2 debug $0 ("Removing IPv4 address: " . $Address) false;
|
||||||
/ip/firewall/address-list/remove $Entry;
|
/ip/firewall/address-list/remove $Entry;
|
||||||
:set CntRemove ($CntRemove + 1);
|
:set CntRemove ($CntRemove + 1);
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
:foreach Address,Ignore in=$Addresses do={
|
:foreach Entry in=[ /ipv6/firewall/address-list/find where list=$FwListName comment=$ListComment ] do={
|
||||||
$LogPrintExit2 debug $0 ("Adding for " . ($Addresses->$Address) . ": " . $Address) false;
|
:local Address [ /ipv6/firewall/address-list/get $Entry address ];
|
||||||
|
:if ([ :typeof ($IPv6Addresses->$Address) ] = "time") do={
|
||||||
|
$LogPrintExit2 debug $0 ("Renewing IPv6 address for " . ($IPv6Addresses->$Address) . ": " . $Address) false;
|
||||||
|
/ipv6/firewall/address-list/set $Entry timeout=($IPv6Addresses->$Address);
|
||||||
|
:set ($IPv6Addresses->$Address);
|
||||||
|
:set CntRenew ($CntRenew + 1);
|
||||||
|
} else={
|
||||||
|
:if ($Failure = false) do={
|
||||||
|
$LogPrintExit2 debug $0 ("Removing: " . $Address) false;
|
||||||
|
/ipv6/firewall/address-list/remove $Entry;
|
||||||
|
:set CntRemove ($CntRemove + 1);
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
:foreach Address,Timeout in=$IPv4Addresses do={
|
||||||
|
$LogPrintExit2 debug $0 ("Adding IPv4 address for " . $Timeout . ": " . $Address) false;
|
||||||
:do {
|
:do {
|
||||||
/ip/firewall/address-list/add list=$FwListName comment=$ListComment address=$Address timeout=($Addresses->$Address);
|
/ip/firewall/address-list/add list=$FwListName comment=$ListComment address=$Address timeout=$Timeout;
|
||||||
:set ($Addresses->$Address);
|
:set ($IPv4Addresses->$Address);
|
||||||
:set CntAdd ($CntAdd + 1);
|
:set CntAdd ($CntAdd + 1);
|
||||||
} on-error={
|
} on-error={
|
||||||
$LogPrintExit2 warning $0 ("Failed to add address " . $Address . " to list '" . $FwListName . "'.") false;
|
$LogPrintExit2 warning $0 ("Failed to add IPv4 address " . $Address . " to list '" . $FwListName . "'.") false;
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
:foreach Address,Timeout in=$IPv6Addresses do={
|
||||||
|
$LogPrintExit2 debug $0 ("Adding IPv6 address for " . $Timeout . ": " . $Address) false;
|
||||||
|
:do {
|
||||||
|
/ipv6/firewall/address-list/add list=$FwListName comment=$ListComment address=$Address timeout=$Timeout;
|
||||||
|
:set ($IPv6Addresses->$Address);
|
||||||
|
:set CntAdd ($CntAdd + 1);
|
||||||
|
} on-error={
|
||||||
|
$LogPrintExit2 warning $0 ("Failed to add IPv6 address " . $Address . " to list '" . $FwListName . "'.") false;
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|
|
@ -12,7 +12,7 @@
|
||||||
:local 0 [ :jobname ];
|
:local 0 [ :jobname ];
|
||||||
|
|
||||||
# expected configuration version
|
# expected configuration version
|
||||||
:global ExpectedConfigVersion 118;
|
:global ExpectedConfigVersion 119;
|
||||||
|
|
||||||
# global variables not to be changed by user
|
# global variables not to be changed by user
|
||||||
:global GlobalFunctionsReady false;
|
:global GlobalFunctionsReady false;
|
||||||
|
|
|
@ -43,6 +43,7 @@
|
||||||
[ $IfThenElse ($Resource->"total-hdd-space" < 16000000) ("Your " . $Resource->"board-name" . " is specifically affected! ") \
|
[ $IfThenElse ($Resource->"total-hdd-space" < 16000000) ("Your " . $Resource->"board-name" . " is specifically affected! ") \
|
||||||
[ $IfThenElse ($Resource->"free-hdd-space" > 4000000) ("(Your " . $Resource->"board-name" . " does not suffer this issue.) ") ] ] . \
|
[ $IfThenElse ($Resource->"free-hdd-space" > 4000000) ("(Your " . $Resource->"board-name" . " does not suffer this issue.) ") ] ] . \
|
||||||
"Huge configuration and lots of scripts give an extra risk. Take care!");
|
"Huge configuration and lots of scripts give an extra risk. Take care!");
|
||||||
|
119="Added support for IPv6 to script 'fw-addr-lists'.";
|
||||||
};
|
};
|
||||||
|
|
||||||
# Migration steps to be applied on script updates
|
# Migration steps to be applied on script updates
|
||||||
|
|
Loading…
Reference in a new issue