API tools faq
paste
Miguel-Brbyte

CTLR-INTEGRATION-2.0-NEW

Miguel-Brbyte
Sep 25th, 2020 (edited)
482
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
PowerShell 11.29 KB | None | 0 0
raw download clone embed print report
  1. {
  2. ######## Substituir os VALUE="XXXX" com as informacoes corretas, para a integracao do MK com o Controllr ########
  3. :global name="IPCTLR" value="192.168.142.22";
  4. :global name="IPCTLRPUBLIC" value="192.168.142.22";
  5. :global name="RADIUSNAS" value="198.18.3.1";
  6. :global name="PINCOMING" value="3799";
  7. # Se tiver perfis notifica ira usar CHECK "sim"
  8. :global name="CHECK" value="sim";
  9. #################################################################################################################
  10. :log warning "Iniciando configuracao do Controllr no MK";
  11. :delay 5s;
  12. :log warning "Criando o Radius do Controllr";
  13. :if ([/radius find comment~"####CONTROLLR####"] !="") do={:log warning "ja existe um Radius cadastrado";} else={:log warning "Nao existe nenhum Radius cadastrado"; /radius add address=$IPCTLR comment="####CONTROLLR####" secret=brbyte service=ppp src-address=$RADIUSNAS timeout=3s disabled=no};
  14. :delay 5s;
  15. :log warning "Habilitando o Incoming";
  16. /radius incoming set accept=yes port=$PINCOMING;
  17. :delay 5s;
  18. :log warning "Setando as regras do Filter rules";
  19. :log warning "Removendo regras antigas";
  20. /ip firewall filter {
  21. remove [find comment="CONTROLLR"]
  22. remove [find comment~"CTLR-MSG"]
  23. remove [find comment="Controllr"]};
  24. :log warning "Recriando os filter rules";
  25. /ip firewall filter {
  26. add action=accept chain=forward  comment="CONTROLLR" dst-port=7840 protocol=tcp
  27. add action=drop   chain=forward   comment="CTLR-MSG-ALERT"   disabled=no dst-address-list=!released_ips dst-port=!53 protocol=udp src-address-list="brb-alert-notice"
  28. add action=drop   chain=forward   comment="CTLR-MSG-ALERT"   disabled=no dst-address-list=!released_ips protocol=tcp src-address-list="brb-alert-notice"
  29. add action=drop   chain=forward   comment="CTLR-MSG-BLOCK"   disabled=no dst-address-list=!released_ips dst-port=!53 protocol=udp src-address-list="brb-block-notice"
  30. add action=drop   chain=forward   comment="CTLR-MSG-BLOCK"   disabled=no dst-address-list=!released_ips protocol=tcp src-address-list="brb-block-notice"
  31. add action=drop   chain=forward   comment="CTLR-MSG-CANCEL"  disabled=no dst-address-list=!released_ips dst-port=!53 protocol=udp src-address-list="brb-cancel-notice"
  32. add action=drop   chain=forward   comment="CTLR-MSG-CANCEL"  disabled=no dst-address-list=!released_ips protocol=tcp src-address-list="brb-cancel-notice"
  33. add action=drop   chain=forward   comment="CTLR-MSG-BLOCK"   disabled=no dst-address-list=!released_ips dst-port=!53 protocol=udp src-address-list="brb-block-auth"
  34. add action=drop   chain=forward   comment="CTLR-MSG-BLOCK"   disabled=no dst-address-list=!released_ips protocol=tcp src-address-list="brb-block-auth"
  35. add action=drop   chain=forward   comment="CTLR-MSG-CANCEL"  disabled=no dst-address-list=!released_ips dst-port=!53 protocol=udp src-address-list="brb-cancel-auth"
  36. add action=drop   chain=forward   comment="CTLR-MSG-CANCEL"  disabled=no dst-address-list=!released_ips protocol=tcp src-address-list="brb-cancel-auth"
  37. add action=drop   chain=forward   comment="CTLR-MSG-DISABLE" disabled=no dst-address-list=!released_ips dst-port=!53 protocol=udp src-address-list="brb-disabled"
  38. add action=drop   chain=forward   comment="CTLR-MSG-DISABLE" disabled=no dst-address-list=!released_ips protocol=tcp src-address-list="brb-disabled"};
  39. :delay 5s;
  40. #OBS Essa regra serve para saber qual o IP do seu Controllr, que está vindo com o Comando de desconexao.
  41. :log warning "Regra do radius log";
  42. :log warning "Removendo regra do log antiga";
  43. /ip firewall filter remove [find comment="CTLR-RADIUS-LOG"];
  44. :log warning "Recriando regra do radiuslog";
  45. /ip firewall filter add action=add-src-to-address-list address-list=radius_log address-list-timeout=30m chain=input comment=CTLR-RADIUS-LOG dst-port=3799 protocol=udp;
  46. :log warning "Setando as regras de redirecionamento - NAT para acessar o seu Controllr fora da rede";
  47. :log warning "Removendo redirecionamentos antigos";
  48. /ip firewall nat remove [find comment~"ACESSO"];
  49. :log warning "Recriando os redirecionamentos";
  50. :if ([$IPCTLRPUBLIC] =$IPCTLR) do={:log warning "IP da maquina e igual o ip publico. Nao tem dst-nat"} else={/ip firewall nat {
  51. add action=dst-nat chain=dstnat comment="CTLR-ACESSO-WEB-HTTP"      dst-port=8080 protocol=tcp to-addresses=$IPCTLR to-ports=8080
  52. add action=dst-nat chain=dstnat comment="CTLR-ACESSO-WEB-HTTPS"     dst-port=8443 protocol=tcp to-addresses=$IPCTLR to-ports=8443
  53. add action=dst-nat chain=dstnat comment="CTLR-ACESSO-SSH"           dst-port=2229 protocol=tcp to-addresses=$IPCTLR to-ports=2229
  54. add action=dst-nat chain=dstnat comment="CTLR-ACESSO-SERVICO"       dst-port=8083 protocol=tcp to-addresses=$IPCTLR to-ports=8083
  55. add action=dst-nat chain=dstnat comment="CTLR-ACESSO-HOTSITE-HTTP"  disabled=yes dst-address=$IPCTLRPUBLIC dst-port=80  protocol=tcp to-addresses=$IPCTLR to-ports=80
  56. add action=dst-nat chain=dstnat comment="CTLR-ACESSO-HOTSITE-HTTPS" disabled=yes dst-address=$IPCTLRPUBLIC dst-port=443 protocol=tcp to-addresses=$IPCTLR to-ports=443};
  57. };
  58. #OBS: O redirecionamento para o Hotsite está desabilitado, pois **dst-address** tem que ser o seu IP publico, para poder acessar o Hotsite dentro e fora da rede pelo IP publico.
  59. :delay 5s;
  60. :log warning "Redirecionamento para as telas de pendencias";
  61. :log warning "Removendo redirecionamentos antigos de pendencias";
  62. /ip firewall nat remove [find comment~"CTLR-MSG"];
  63. :log warning "Recriando os redirecionamento de pendencias";
  64. :if ([$CHECK] ="nao") do={:log warning "Nao ira redirecionar";} else={/ip firewall nat{
  65. add action=dst-nat chain=dstnat comment="CTLR-MSG-ALERT-HTTP"        disabled=no  dst-address-list=!released_ips dst-port=80  protocol=tcp src-address-list=brb-alert-notice     to-addresses=$IPCTLR to-ports=8090
  66. add action=dst-nat chain=dstnat comment="CTLR-MSG-ALERT-HTTPS"       disabled=no  dst-address-list=!released_ips dst-port=443 protocol=tcp src-address-list=brb-alert-notice     to-addresses=$IPCTLR to-ports=8490
  67. add action=dst-nat chain=dstnat comment="CTLR-MSG-PENDENCY-HTTP"     disabled=no  dst-address-list=!released_ips dst-port=80  protocol=tcp src-address-list=brb-pendency-notice  to-addresses=$IPCTLR to-ports=8091
  68. add action=dst-nat chain=dstnat comment="CTLR-MSG-PENDENCY-HTTPS"    disabled=no  dst-address-list=!released_ips dst-port=443 protocol=tcp src-address-list=brb-pendency-notice  to-addresses=$IPCTLR to-ports=8491
  69. add action=dst-nat chain=dstnat comment="CTLR-MSG-BLOCK-HTTP"        disabled=no  dst-address-list=!released_ips dst-port=80  protocol=tcp src-address-list=brb-block-notice     to-addresses=$IPCTLR to-ports=8092
  70. add action=dst-nat chain=dstnat comment="CTLR-MSG-BLOCK-HTTPS"       disabled=no  dst-address-list=!released_ips dst-port=443 protocol=tcp src-address-list=brb-block-notice     to-addresses=$IPCTLR to-ports=8492
  71. add action=dst-nat chain=dstnat comment="CTLR-MSG-CANCEL-HTTP"       disabled=no  dst-address-list=!released_ips dst-port=80  protocol=tcp src-address-list=brb-cancel-notice    to-addresses=$IPCTLR to-ports=8093
  72. add action=dst-nat chain=dstnat comment="CTLR-MSG-CANCEL-HTTPS"      disabled=no  dst-address-list=!released_ips dst-port=443 protocol=tcp src-address-list=brb-cancel-notice    to-addresses=$IPCTLR to-ports=8493};
  73. };
  74. :delay 5s;
  75. #OBS essa regra serve para notificar todos os seus clientes, caso tenha alguma manutencao na sua rede ou outra coisa, so habilite ela caso saiba como funciona.
  76. :log warning "Redirecionamento para a tela de aviso";
  77. :log warning "Removendo redirecionamentos de aviso antigos";
  78. /ip firewall nat remove [find comment~"CTLR-AVISO"];
  79. /tool netwatch remove [find comment="CTLR-AVISO"];
  80. :delay 5s;
  81. :log warning "Criando regras mangle";
  82. :log warning "Removendo mangle antigo";
  83. /ip firewall mangle remove [find comment~"CTLR"];
  84. :log  warning "Recriando regras do mangle";
  85. :if ([$CHECK] ="sim") do={:log warning "Ira usar perfis com NOTICE e AUTH"; /ip firewall mangle {
  86. add action=jump chain=prerouting  comment=CTLR-JUMP-ALERT    dst-address-list=!released_ips jump-target=CONTROLLR src-address-list="brb-alert-notice"
  87. add action=jump chain=prerouting  comment=CTLR-JUMP-PENDENCY dst-address-list=!released_ips jump-target=CONTROLLR src-address-list="brb-pendency-notice"
  88. add action=jump chain=prerouting  comment=CTLR-JUMP-BLOCK    dst-address-list=!released_ips jump-target=CONTROLLR src-address-list="brb-block-notice"
  89. add action=jump chain=prerouting  comment=CTLR-JUMP-CANCEL   dst-address-list=!released_ips jump-target=CONTROLLR src-address-list="brb-cancel-notice"
  90. add action=jump chain=prerouting  comment=CTLR-JUMP-ALERT    dst-address-list=!released_ips jump-target=CONTROLLR src-address-list="brb-alert-auth"
  91. add action=jump chain=prerouting  comment=CTLR-JUMP-PENDENCY dst-address-list=!released_ips jump-target=CONTROLLR src-address-list="brb-pendency-auth"
  92. add action=jump chain=prerouting  comment=CTLR-JUMP-BLOCK    dst-address-list=!released_ips jump-target=CONTROLLR src-address-list="brb-block-auth"
  93. add action=jump chain=prerouting  comment=CTLR-JUMP-CANCEL   dst-address-list=!released_ips jump-target=CONTROLLR src-address-list="brb-cancel-auth"
  94. add action=jump chain=prerouting  comment=CTLR-JUMP-DISABLE  dst-address-list=!released_ips jump-target=CONTROLLR src-address-list="brb-disabled"
  95. add action=accept chain=CONTROLLR comment=CTLR-CHAIN-ACCEPT};
  96. } else={:log warning "Nao usa dois perfis"; /ip firewall mangle {
  97. add action=jump chain=prerouting  comment=CTLR-JUMP-ALERT     dst-address-list=!released_ips jump-target=CONTROLLR src-address-list="brb-alert-notice"
  98. add action=jump chain=prerouting  comment=CTLR-JUMP-PENDENCY  dst-address-list=!released_ips jump-target=CONTROLLR src-address-list="brb-pendency-auth"
  99. add action=jump chain=prerouting  comment=CTLR-JUMP-BLOCK     dst-address-list=!released_ips jump-target=CONTROLLR src-address-list="brb-block-auth"
  100. add action=jump chain=prerouting  comment=CTLR-JUMP-CANCEL    dst-address-list=!released_ips jump-target=CONTROLLR src-address-list="brb-cancel-auth"
  101. add action=jump chain=prerouting  comment=CTLR-JUMP-DISABLE   dst-address-list=!released_ips jump-target=CONTROLLR src-address-list="brb-disabled"
  102. add action=accept chain=CONTROLLR comment=CTLR-CHAIN-ACCEPT};
  103. };
  104. :delay 5s;
  105. :log warning "Criando address list";
  106. :log warning "Removendo released_ips antigos";
  107. /ip firewall address-list remove [find list=released_ips];
  108. :if ([$IPCTLRPUBLIC] =$IPCTLR) do={:log warning "IP da maquina e igual o ip publico"; /ip firewall address-list {
  109. add address=$IPCTLR       list=released_ips
  110. add address=8.8.8.8       list=released_ips
  111. add address=8.8.4.4       list=released_ips};
  112. } else={/ip firewall address-list {
  113. add address=$IPCTLR       list=released_ips
  114. add address=8.8.8.8       list=released_ips
  115. add address=8.8.4.4       list=released_ips
  116. add address=$IPCTLRPUBLIC list=released_ips};
  117. };
  118. :delay 5s;
  119. :log warning "Configurando Scheduler - Agendador";
  120. /system scheduler {
  121. remove [find name="Pendency"]
  122. remove [find name~"CTLR-MSG"]
  123. add interval=2m name="CTLR-MSG-PENDENCY" on-event="/ip firewall address-list set list=\"brb-pendency-auth\" [find where list=\"brb-pendency-notice\"]" policy=ftp,reboot,read,write,policy,test,password,sniff,sensitive start-time=startup};
  124. :delay 5s;
  125. :log warning "Habilitando a porta API do MK";
  126. /ip service set api address="" disabled=no port=8728;
  127. :delay 5s;
  128. :log warning "Setando o Interim Update";
  129. /ppp aaa set interim-update=1m use-radius=yes;
  130. :delay 5s;
  131. :log warning "Configuracoes setadas com sucesso";
  132. }
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!