MikroTikda host nomlari bilan firewall qoidalarini yaratish

⏱ O‘qish vaqti: 14 daqiqa

RouterOSda firewall filter qoidalarini IP manzillar o‘rniga host nomlari bilan belgilashni xohlaysiz, lekin har bir paket uchun DNS so‘rovini bajarish amaliy emas. Ushbu maqola DNS natijalarini address‑listga saqlash va skript yordamida ularni muntazam yangilash usulini ko‘rsatadi.

Talablar

• RouterOS v6.36 yoki undan past versiya
• Administrator huquqi
• DNS serverga kirish imkoniyati

Sozlash bosqichlari

1. Address‑listga placeholder yozuvlarni qo‘shish

Avvalo, comment maydoniga host nomini, list maydoniga host_ prefiksi bilan tavsifni, address maydoniga vaqtincha 0.0.0.0 ni kiriting. Bu yozuvlar keyinchalik skript tomonidan yangilanadi.

Misol uchun, quyidagi buyruqlarni bajarish kifoya:

/ip firewall address-list add address=0.0.0.0 comment=www.mikrotik.com list=host_mikrotik /ip firewall address-list add address=0.0.0.0 comment=forum.mikrotik.com list=host_mikrotik

The problem
You would like to create firewall filter rules which refer to host names rather than IP addresses. This may be, for example, because the host name is dynamic such as would be created by a dyndns service. For several very good reasons, it is not possible to put host names directly into firewall rules. For example, the following doesn't work:

/ip firewall filter add chain=ouput dst-address=www.mikrotik.com action=accept
Whilst at first glance, it would seem like a good idea to allow this configuration, the additional traffic and load which would be created if the router had to resolve (in this case) 'www.mikrotik.com' for every single packet passing through shows that in reality it is simply not practical.

The solution

Note: Applies only for RouterOS versions up to version v6.36.
It is possible to implement host name based firewall rules with a little lateral thinking. If one considers that DNS resolutions are cached (in theory for as short a time as the record's TTL, but in reality for the amount of time the resolver's sysadmin has permitted), there is very little point in resolving the host name for every single packet.

For this reason, we can quite easily write a script which does the resolving and stores the values somewhere they can be used by the filter rules. This script can be run as regularly as required.

The best place to store the host names and associated IP addresses is the address list as this allows these addresses to be used from within the filter rules directly. The use of address lists also allows a greater degree of flexibility than would be available if the filter rules were updated individually. The address list feature allows the storage of three values - a comment, the list name and the IP address. The following example assumes the fields are used as follows:

comment - The host name to use
list name - Starting with 'host_' and ending with any description
address - The IP address (either 0.0.0.0 when the entry is created or the result of the resolution if not)
The reason the comment is used for the host name rather than the list name is that using a description in the list name easily allows multiple host names to be grouped together. So, for example, entries may be added as follows:

/ip firewall address-list add address=0.0.0.0 comment=www.mikrotik.com list=host_mikrotik
/ip firewall address-list add address=0.0.0.0 comment=forum.mikrotik.com list=host_mikrotik
/ip firewall address-list add address=0.0.0.0 comment=wiki.mikrotik.com list=host_mikrotik
and a firewall rule as follows:

/ip firewall filter add chain=ouput dst-address-list=host_mikrotik action=accept
This allows all outbound traffic to any of the IP addresses defined in the address list 'host_mikrotik'.

As things stand, nothing will be achieved by this rule since the IP addresses allowed are all '0.0.0.0'. We need to write a script which parses all the address list entries and resolves the ones which need resolving.

 /system script add \
   name=resolvehostnames policy=write,read \
   source="# define variables\r\
   :local list\r\
   :local comment\r\
   :local newip\r\
   :local oldip\r\
   \r\
   # Loop through each entry in the address list.\r\
   :foreach i in=[/ip firewall address-list find] do={\r\
   \r\
   # Get the first five characters of the list name\r\
     :set list [:pick [/ip firewall address-list get \$i list] 0 5]\r\
   \r\
   # If they're 'host_', then we've got a match - process it\r\
     :if (\$list = \"host_\") do={\r\
   \r\
   # Get the comment for this address list item (this is the host name to u\
   se)\r\
       :set comment [/ip firewall address-list get \$i comment]\r\
       :set oldip [/ip firewall address-list get \$i address]\r\
   \r\
   # Resolve it and set the address list entry accordingly.\r\
       : if (\$newip != \$oldip) do={:set newip [:resolve \$comment]\r\
       /ip firewall address-list set \$i address=\$newip}\r\
       }\r\
     }"
Once the script is in place, it can be scheduled. Try every hour to see if that gives you what you need:

/system scheduler add \
   comment="" disabled=no interval=1h name=updatehostnames on-event=resolvehostnames \
   start-date=jan/01/1970 start-time=00:00:00
Caveat
The script uses a RouterOS function 'resolve'. Unfortunately (as at 3.25), if the hostname being resolved doesn't exist or if the resolvers fail for whatever reason, the script returns error message and stops immediately. It is not possible to trap this error message to code around it. Extreme care must therefore be taken that host names are correctly entered (and do not include any leading or trailing spaces).

Also, note that for obvious reasons, this may not work for host names which resolve to multiple IP addresses.

Credit: wiki.mikrotik.com

2. Hostname‑ni IP ga aylantiruvchi skript yaratish

Skript :foreach sikli orqali host_ prefiksli address‑list elementlarini ko‘rib chiqadi, comment maydonidagi host nomini DNS‑dan hal qiladi va natijaviy IP manzilni address maydoniga yozadi. Skript har safar bajarilganda address‑list yangilanadi, shuning uchun firewall qoidalari doimiy ravishda to‘g‘ri IP’ni ishlatadi.

Skriptni /system script add buyrug‘i bilan qo‘shish va ichiga kodni joylashtirish kifoya; kod to‘liq blokda berilgan (CODE 1).

The problem
You would like to create firewall filter rules which refer to host names rather than IP addresses. This may be, for example, because the host name is dynamic such as would be created by a dyndns service. For several very good reasons, it is not possible to put host names directly into firewall rules. For example, the following doesn't work:

/ip firewall filter add chain=ouput dst-address=www.mikrotik.com action=accept
Whilst at first glance, it would seem like a good idea to allow this configuration, the additional traffic and load which would be created if the router had to resolve (in this case) 'www.mikrotik.com' for every single packet passing through shows that in reality it is simply not practical.

The solution

Note: Applies only for RouterOS versions up to version v6.36.
It is possible to implement host name based firewall rules with a little lateral thinking. If one considers that DNS resolutions are cached (in theory for as short a time as the record's TTL, but in reality for the amount of time the resolver's sysadmin has permitted), there is very little point in resolving the host name for every single packet.

For this reason, we can quite easily write a script which does the resolving and stores the values somewhere they can be used by the filter rules. This script can be run as regularly as required.

The best place to store the host names and associated IP addresses is the address list as this allows these addresses to be used from within the filter rules directly. The use of address lists also allows a greater degree of flexibility than would be available if the filter rules were updated individually. The address list feature allows the storage of three values - a comment, the list name and the IP address. The following example assumes the fields are used as follows:

comment - The host name to use
list name - Starting with 'host_' and ending with any description
address - The IP address (either 0.0.0.0 when the entry is created or the result of the resolution if not)
The reason the comment is used for the host name rather than the list name is that using a description in the list name easily allows multiple host names to be grouped together. So, for example, entries may be added as follows:

/ip firewall address-list add address=0.0.0.0 comment=www.mikrotik.com list=host_mikrotik
/ip firewall address-list add address=0.0.0.0 comment=forum.mikrotik.com list=host_mikrotik
/ip firewall address-list add address=0.0.0.0 comment=wiki.mikrotik.com list=host_mikrotik
and a firewall rule as follows:

/ip firewall filter add chain=ouput dst-address-list=host_mikrotik action=accept
This allows all outbound traffic to any of the IP addresses defined in the address list 'host_mikrotik'.

As things stand, nothing will be achieved by this rule since the IP addresses allowed are all '0.0.0.0'. We need to write a script which parses all the address list entries and resolves the ones which need resolving.

 /system script add \
   name=resolvehostnames policy=write,read \
   source="# define variables\r\
   :local list\r\
   :local comment\r\
   :local newip\r\
   :local oldip\r\
   \r\
   # Loop through each entry in the address list.\r\
   :foreach i in=[/ip firewall address-list find] do={\r\
   \r\
   # Get the first five characters of the list name\r\
     :set list [:pick [/ip firewall address-list get \$i list] 0 5]\r\
   \r\
   # If they're 'host_', then we've got a match - process it\r\
     :if (\$list = \"host_\") do={\r\
   \r\
   # Get the comment for this address list item (this is the host name to u\
   se)\r\
       :set comment [/ip firewall address-list get \$i comment]\r\
       :set oldip [/ip firewall address-list get \$i address]\r\
   \r\
   # Resolve it and set the address list entry accordingly.\r\
       : if (\$newip != \$oldip) do={:set newip [:resolve \$comment]\r\
       /ip firewall address-list set \$i address=\$newip}\r\
       }\r\
     }"
Once the script is in place, it can be scheduled. Try every hour to see if that gives you what you need:

/system scheduler add \
   comment="" disabled=no interval=1h name=updatehostnames on-event=resolvehostnames \
   start-date=jan/01/1970 start-time=00:00:00
Caveat
The script uses a RouterOS function 'resolve'. Unfortunately (as at 3.25), if the hostname being resolved doesn't exist or if the resolvers fail for whatever reason, the script returns error message and stops immediately. It is not possible to trap this error message to code around it. Extreme care must therefore be taken that host names are correctly entered (and do not include any leading or trailing spaces).

Also, note that for obvious reasons, this may not work for host names which resolve to multiple IP addresses.

Credit: wiki.mikrotik.com

3. Skriptni muntazam ishga tushirish

Skriptni har 5‑10 daqiqada avtomatik bajarilishi uchun scheduler qo‘shing. Intervalni DNS‑ning TTL qiymatiga mos ravishda sozlang, shunda host manzili o‘zgarganda address‑list ham yangilanadi.

4. Firewall qoidalarida address‑listdan foydalanish

Endi dst-address-list parametrini host_mikrotik ga yo‘naltirgan filter qoidalarini yaratish mumkin. Skript yangilangan IP manzillarni address‑listga yozib boradi, shuning uchun qoidalar har doim to‘g‘ri ishlaydi.

Tekshirish

Skript ishga tushgandan so‘ng list=host_mikrotik bo‘lgan address‑list elementlarini tekshiring; address maydonida 0.0.0.0 o‘rnida haqiqiy IP manzillar ko‘rinadi. Bu natija skriptning muvaffaqiyatli DNS‑ni hal qilganini tasdiqlaydi.

The problem
You would like to create firewall filter rules which refer to host names rather than IP addresses. This may be, for example, because the host name is dynamic such as would be created by a dyndns service. For several very good reasons, it is not possible to put host names directly into firewall rules. For example, the following doesn't work:

/ip firewall filter add chain=ouput dst-address=www.mikrotik.com action=accept
Whilst at first glance, it would seem like a good idea to allow this configuration, the additional traffic and load which would be created if the router had to resolve (in this case) 'www.mikrotik.com' for every single packet passing through shows that in reality it is simply not practical.

The solution

Note: Applies only for RouterOS versions up to version v6.36.
It is possible to implement host name based firewall rules with a little lateral thinking. If one considers that DNS resolutions are cached (in theory for as short a time as the record's TTL, but in reality for the amount of time the resolver's sysadmin has permitted), there is very little point in resolving the host name for every single packet.

For this reason, we can quite easily write a script which does the resolving and stores the values somewhere they can be used by the filter rules. This script can be run as regularly as required.

The best place to store the host names and associated IP addresses is the address list as this allows these addresses to be used from within the filter rules directly. The use of address lists also allows a greater degree of flexibility than would be available if the filter rules were updated individually. The address list feature allows the storage of three values - a comment, the list name and the IP address. The following example assumes the fields are used as follows:

comment - The host name to use
list name - Starting with 'host_' and ending with any description
address - The IP address (either 0.0.0.0 when the entry is created or the result of the resolution if not)
The reason the comment is used for the host name rather than the list name is that using a description in the list name easily allows multiple host names to be grouped together. So, for example, entries may be added as follows:

/ip firewall address-list add address=0.0.0.0 comment=www.mikrotik.com list=host_mikrotik
/ip firewall address-list add address=0.0.0.0 comment=forum.mikrotik.com list=host_mikrotik
/ip firewall address-list add address=0.0.0.0 comment=wiki.mikrotik.com list=host_mikrotik
and a firewall rule as follows:

/ip firewall filter add chain=ouput dst-address-list=host_mikrotik action=accept
This allows all outbound traffic to any of the IP addresses defined in the address list 'host_mikrotik'.

As things stand, nothing will be achieved by this rule since the IP addresses allowed are all '0.0.0.0'. We need to write a script which parses all the address list entries and resolves the ones which need resolving.

 /system script add \
   name=resolvehostnames policy=write,read \
   source="# define variables\r\
   :local list\r\
   :local comment\r\
   :local newip\r\
   :local oldip\r\
   \r\
   # Loop through each entry in the address list.\r\
   :foreach i in=[/ip firewall address-list find] do={\r\
   \r\
   # Get the first five characters of the list name\r\
     :set list [:pick [/ip firewall address-list get \$i list] 0 5]\r\
   \r\
   # If they're 'host_', then we've got a match - process it\r\
     :if (\$list = \"host_\") do={\r\
   \r\
   # Get the comment for this address list item (this is the host name to u\
   se)\r\
       :set comment [/ip firewall address-list get \$i comment]\r\
       :set oldip [/ip firewall address-list get \$i address]\r\
   \r\
   # Resolve it and set the address list entry accordingly.\r\
       : if (\$newip != \$oldip) do={:set newip [:resolve \$comment]\r\
       /ip firewall address-list set \$i address=\$newip}\r\
       }\r\
     }"
Once the script is in place, it can be scheduled. Try every hour to see if that gives you what you need:

/system scheduler add \
   comment="" disabled=no interval=1h name=updatehostnames on-event=resolvehostnames \
   start-date=jan/01/1970 start-time=00:00:00
Caveat
The script uses a RouterOS function 'resolve'. Unfortunately (as at 3.25), if the hostname being resolved doesn't exist or if the resolvers fail for whatever reason, the script returns error message and stops immediately. It is not possible to trap this error message to code around it. Extreme care must therefore be taken that host names are correctly entered (and do not include any leading or trailing spaces).

Also, note that for obvious reasons, this may not work for host names which resolve to multiple IP addresses.

Credit: wiki.mikrotik.com

Xulosa

Ushbu usul bilan dinamik host nomlari asosida firewall qoidalarini yaratish oson bo‘ladi, DNS‑ning kechikishlari va paketga har safar so‘rov yuborish muammosi bartaraf etiladi. Skriptni kerakli intervalda yangilab turish kifoya.

Manba: Use Host Names In Firewall Rules — mikrotiktool.github.io