mirror of
https://github.com/eworm-de/routeros-scripts
synced 2024-05-14 08:04:19 +00:00
add 'ipsec-to-dns'
This commit is contained in:
parent
604306f220
commit
862417b8d3
8 changed files with 120 additions and 3 deletions
|
@ -165,6 +165,7 @@ Available Scripts
|
|||
* [Send backup via e-mail](doc/email-backup.md)
|
||||
* [Send GPS position to server](doc/gps-track.md)
|
||||
* [Use WPA2 network with hotspot credentials](doc/hotspot-to-wpa.md)
|
||||
* [Create DNS records for IPSec peers](doc/ipsec-to-dns.md)
|
||||
* [Update configuration on IPv6 prefix change](doc/ipv6-update.md)
|
||||
* [Manage IP addresses with bridge status](doc/ip-addr-bridge.md)
|
||||
* [Run other scripts on DHCP lease](doc/lease-script.md)
|
||||
|
|
|
@ -44,6 +44,7 @@ See also
|
|||
|
||||
* [Collect MAC addresses in wireless access list](collect-wireless-mac.md)
|
||||
* [Comment DHCP leases with info from access list](dhcp-lease-comment.md)
|
||||
* [Create DNS records for IPSec peers](ipsec-to-dns.md)
|
||||
* [Run other scripts on DHCP lease](lease-script.md)
|
||||
|
||||
---
|
||||
|
|
46
doc/ipsec-to-dns.md
Normal file
46
doc/ipsec-to-dns.md
Normal file
|
@ -0,0 +1,46 @@
|
|||
Create DNS records for IPSec peers
|
||||
==================================
|
||||
|
||||
[◀ Go back to main README](../README.md)
|
||||
|
||||
🛈 This script can not be used on its own but requires the base installation.
|
||||
See [main README](../README.md) for details.
|
||||
|
||||
Description
|
||||
-----------
|
||||
|
||||
This script adds (and removes) dns records based on IPSec peers and their
|
||||
dynamic addresses from mode-config.
|
||||
|
||||
Requirements and installation
|
||||
-----------------------------
|
||||
|
||||
Just install the script:
|
||||
|
||||
$ScriptInstallUpdate ipsec-to-dns;
|
||||
|
||||
This script is run from scheduler:
|
||||
|
||||
/ system scheduler add interval=1m name=ipsec-to-dns on-event="/ system script run ipsec-to-dns;" start-time=startup;
|
||||
|
||||
Configuration
|
||||
-------------
|
||||
|
||||
On first run a disabled static dns record acting as marker (with comment
|
||||
"`--- ipsec-to-dns above ---`") is added. Move this entry to define where new
|
||||
entries are to be added.
|
||||
|
||||
The configuration goes to `global-config-overlay`, these are the parameters:
|
||||
|
||||
* `Domain`: the domain used for dns records
|
||||
* `HostNameInZone`: whether or not to add the ipsec/dns server's hostname
|
||||
* `PrefixInZone`: whether or not to add prefix `ipsec`
|
||||
|
||||
See also
|
||||
--------
|
||||
|
||||
* [Create DNS records for DHCP leases](dns-to-dhcp.md)
|
||||
|
||||
---
|
||||
[◀ Go back to main README](../README.md)
|
||||
[▲ Go back to top](#top)
|
|
@ -8,7 +8,7 @@
|
|||
|
||||
# Make sure all configuration properties are up to date and this
|
||||
# value is in sync with value in script 'global-functions'!
|
||||
:global GlobalConfigVersion 50;
|
||||
:global GlobalConfigVersion 51;
|
||||
|
||||
# This is used for DNS and backup file.
|
||||
:global Domain "example.com";
|
||||
|
|
|
@ -8,7 +8,7 @@
|
|||
# Make sure all configuration properties are up to date and this
|
||||
# value is in sync with value in script 'global-functions'!
|
||||
# Comment or remove to disable news and change notifications.
|
||||
:global GlobalConfigVersion 50;
|
||||
:global GlobalConfigVersion 51;
|
||||
|
||||
# Copy configuration from global-config here and modify it.
|
||||
|
||||
|
|
|
@ -54,6 +54,7 @@
|
|||
48="Added support for overriding e-mail and Telegram settings for every script.";
|
||||
49="Dropped '\$EmailBackupTo' & '\$EmailBackupCc' from configuration, use settings override if required.";
|
||||
50="Added support for dynamic address update in 'netwatch-notify'.";
|
||||
51="Added 'ipsec-to-dns' to add DNS records for IPSec peers from mode-config.";
|
||||
};
|
||||
|
||||
# Migration steps to be applied on script updates
|
||||
|
|
|
@ -8,7 +8,7 @@
|
|||
# https://git.eworm.de/cgit/routeros-scripts/about/
|
||||
|
||||
# expected configuration version
|
||||
:global ExpectedConfigVersion 50;
|
||||
:global ExpectedConfigVersion 51;
|
||||
|
||||
# global variables not to be changed by user
|
||||
:global GlobalFunctionsReady false;
|
||||
|
|
68
ipsec-to-dns
Normal file
68
ipsec-to-dns
Normal file
|
@ -0,0 +1,68 @@
|
|||
#!rsc by RouterOS
|
||||
# RouterOS script: ipsec-to-dns
|
||||
# Copyright (c) 2021 Christian Hesse <mail@eworm.de>
|
||||
# https://git.eworm.de/cgit/routeros-scripts/about/COPYING.md
|
||||
#
|
||||
# and add/remove/update DNS entries from IPSec mode-config
|
||||
# https://git.eworm.de/cgit/routeros-scripts/about/doc/ipsec-to-dns.md
|
||||
|
||||
:local 0 "ipsec-to-dns";
|
||||
:global GlobalFunctionsReady;
|
||||
:while ($GlobalFunctionsReady != true) do={ :delay 500ms; }
|
||||
|
||||
:global Domain;
|
||||
:global HostNameInZone;
|
||||
:global Identity;
|
||||
:global PrefixInZone;
|
||||
|
||||
:global CharacterReplace;
|
||||
:global LogPrintExit2;
|
||||
:global IfThenElse;
|
||||
|
||||
:local Zone \
|
||||
([ $IfThenElse ($PrefixInZone = true) "ipsec." ] . \
|
||||
[ $IfThenElse ($HostNameInZone = true) ($Identity . ".") ] . $Domain);
|
||||
:local Ttl 5m;
|
||||
:local CommentPrefix ("managed by " . $0 . " for ");
|
||||
:local CommentString ("--- " . $0 . " above ---");
|
||||
|
||||
:if ([ :len [ / ip dns static find where comment=$CommentString name=- type=NXDOMAIN disabled ] ] = 0) do={
|
||||
/ ip dns static add comment=$CommentString name=- type=NXDOMAIN disabled=yes;
|
||||
$LogPrintExit2 warning $0 ("Added disabled static dns record with comment '" . $CommentString . "'.") false;
|
||||
}
|
||||
:local PlaceBefore ([ / ip dns static find where comment=$CommentString name=- type=NXDOMAIN disabled ]->0);
|
||||
|
||||
:foreach DnsRecord in=[ / ip dns static find where comment ~ $CommentPrefix ] do={
|
||||
:local DnsRecordVal [ / ip dns static get $DnsRecord ];
|
||||
:local PeerId [ $CharacterReplace ($DnsRecordVal->"comment") $CommentPrefix "" ];
|
||||
:if ([ :len [ / ip ipsec active-peers find where id=$PeerId dynamic-address=($DnsRecordVal->"address") ] ] > 0) do={
|
||||
$LogPrintExit2 debug $0 ("Peer " . $PeerId . " (" . $DnsRecordVal->"name" . ") still exists. Not deleting DNS entry.") false;
|
||||
} else={
|
||||
:local Found false;
|
||||
$LogPrintExit2 info $0 ("Peer " . $PeerId . " (" . $DnsRecordVal->"name" . ") has gone, deleting DNS entry.") false;
|
||||
/ ip dns static remove $DnsRecord;
|
||||
}
|
||||
}
|
||||
|
||||
:foreach Peer in=[ / ip ipsec active-peers find where !(dynamic-address=[]) ] do={
|
||||
:local PeerVal [ / ip ipsec active-peers get $Peer ];
|
||||
:local Comment ($CommentPrefix . $PeerVal->"id");
|
||||
:put ($PeerVal->"id");
|
||||
:local HostName [ :pick ($PeerVal->"id") 0 [ :find ($PeerVal->"id" . ".") "." ] ];
|
||||
:put $HostName;
|
||||
|
||||
:local Fqdn ($HostName . "." . $Zone);
|
||||
:local DnsRecord [ / ip dns static find where name=$Fqdn ];
|
||||
:if ([ :len $DnsRecord ] > 0) do={
|
||||
:local DnsIp [ / ip dns static get $DnsRecord address ];
|
||||
:if ($DnsIp = $PeerVal->"dynamic-address") do={
|
||||
$LogPrintExit2 debug $0 ("DNS entry for " . $Fqdn . " does not need updating.") false;
|
||||
} else={
|
||||
$LogPrintExit2 info $0 ("Replacing DNS entry for " . $Fqdn . ", new address is " . $PeerVal->"dynamic-address" . ".") false;
|
||||
/ ip dns static set name=$Fqdn address=($PeerVal->"dynamic-address") ttl=$Ttl comment=$Comment $DnsRecord;
|
||||
}
|
||||
} else={
|
||||
$LogPrintExit2 info $0 ("Adding new DNS entry for " . $Fqdn . ", address is " . $PeerVal->"dynamic-address" . ".") false;
|
||||
/ ip dns static add name=$Fqdn address=($PeerVal->"dynamic-address") ttl=$Ttl comment=$Comment place-before=$PlaceBefore;
|
||||
}
|
||||
}
|
Loading…
Reference in a new issue