:global WanInOut do={
:if ([len $1]=0) do={:error "example: \$WanInOut <add/remove> <wan interface name> <local lan interface name>";}
:local todo [:tostr $1];
:local wans [:tostr $2];
if ([:len $wans]=0) do={
:foreach idn in=[/interface find where type="pppoe-out" and disabled=no or type="l2tp-out" and disabled=no or type="ppp-out" and disabled=no or type="sstp-out" and disabled=no or type="lte" and disabled=no] do={
if ([:typeof $wans]="nothing") do={
:set $wans ([/interface get value-name=name $idn]);
} else={
:set $wans ($wans.",".[/interface get value-name=name $idn]);
}
}
}
:local lans [:tostr $3];
if ([:len $lans]=0) do={
:foreach idn in=[/interface find where type="bridge" and disabled=no] do={
if ([:typeof $lans]="nothing") do={
:set $lans ([/interface get value-name=name $idn]);
} else={
:set $lans ($lans.",".[/interface get value-name=name $idn]);
}
}
}
:local wanip do={:if ([:len [/ip dhcp-client find where interface=[:tostr $1]]]>0) do={:return [/ip dhcp-client get [find interface=[:tostr $1]] gateway];} else={:return [$1];}}
:local lanip do={ :return [:pick [:tostr [/ip address get [find where interface=[:tostr $1]] value-name=address]] 0 [:find [:tostr [/ip address get [find where interface=[:tostr $1]] value-name=address]] "/"]] }
:local psfw $4;
:local LOG;
:if ($todo="add") do={
:local i 0;
foreach wan in=[:toarray $wans] do={
foreach lan in=[:toarray $lans] do={
# redirect incoming traffic in wan(s) to the local network
:if ([:typeof $psfw]!="nothing") do={
:foreach pfwn in=[:toarray $psfw] do={
:if ([:len [/ip firewall nat find where chain=dstnat and protocol=tcp and dst-port=$pfwn and in-interface=$wan and action=dst-nat and to-addresses=[$lanip $lan] and to-ports=$pfwn]]=0) do={
/ip firewall nat add chain=dstnat protocol=tcp dst-port=$pfwn in-interface=$wan action=dst-nat to-addresses=[$lanip $lan] to-ports=$pfwn comment="redirect incoming traffic from '$wan' to '$lan' ($[$lanip $lan]:$pfwn)"
}
}
} else={
:if ([:len [/ip firewall nat find where chain=dstnat and in-interface=$wan and action=dst-nat and to-addresses=[$lanip $lan]]]=0) do={
/ip firewall nat add chain=dstnat in-interface=$wan action=dst-nat to-addresses=[$lanip $lan] comment="redirect incoming traffic from '$wan' to '$lan' ($[$lanip $lan])"
}
}
# what comes from specific wan, gets out from specific same wan
:if ([:len [/ip firewall mangle find where action=mark-connection and chain=input and in-interface=$wan and new-connection-mark="$wan_conn"]]=0) do={
/ip firewall mangle add action=mark-connection chain=input in-interface=$wan new-connection-mark="$wan_conn" dst-address-type=!local passthrough=yes comment="incoming from '$wan' outgoing to '$wan'"
}
:if ([:len [/ip firewall mangle find where action=mark-routing and chain=output and connection-mark="$wan_conn" and new-routing-mark="$wan_traffic"]]=0) do={
/ip firewall mangle add action=mark-routing chain=output connection-mark="$wan_conn" new-routing-mark="$wan_traffic" passthrough=no comment="outgoing to '$wan' incoming from '$wan'"
}
# forwards from specific wan, gets out from specific same wan
:if ([:len [/ip firewall mangle find where action=mark-connection and chain=forward and in-interface=$wan and new-connection-mark="$wan_pfw"]]=0) do={
/ip firewall mangle add action=mark-connection chain=forward in-interface=$wan connection-state=new new-connection-mark="$wan_pfw" passthrough=no comment="forwards incoming from '$wan' outgoing to '$wan'"
}
:if ([:len [/ip firewall mangle find where chain=prerouting and in-interface=$lan and connection-mark="$wan_conn" and action=mark-routing and new-routing-mark="$wan_traffic"]]=0) do={
/ip firewall mangle add chain=prerouting in-interface=$lan connection-mark="$wan_conn" action=mark-routing new-routing-mark="$wan_traffic" comment="prerouting incoming from '$lan' outgoing to '$wan'"
}
if ([:len [/ip firewall mangle find where chain=prerouting and in-interface=$wan and action=mark-connection and new-connection-mark="$wan_conn"]]=0) do={
/ip firewall mangle add chain=prerouting in-interface=$wan action=mark-connection new-connection-mark="$wan_conn" comment="prerouting incoming from '$wan' outgoing to '$lan'"
}
# routing rules for wans' traffic
:if ([:len [/ip route find where dst-address=0.0.0.0/0 and gateway=[$wanip $wan] and distance=1 and routing-mark="$wan_traffic"]]=0) do={
/ip route add dst-address=0.0.0.0/0 gateway=[$wanip $wan] distance=1 routing-mark="$wan_traffic" comment="routing rules for '$wan' traffic"
}
# redirect outgoing traffic in local network to wan(s)
:if ([:len [/ip firewall nat find where out-interface=$wan and action=masquerade]]=0) do={
/ip firewall nat add out-interface=$wan action=masquerade comment="enable internet access via '$wan'"
}
}
}
:set $i ($i+1);
}
:if ($todo="remove") do={
foreach wan in=[:toarray $wans] do={
foreach lan in=[:toarray $lans] do={
# redirect incoming traffic in wan(s) to the local server
/ip firewall nat remove [/ip firewall nat find where chain=dstnat and protocol=tcp and dst-port=$pfwn and in-interface=$wan and action=dst-nat and to-addresses=[$lanip $lan] and to-ports=$pfwn]
/ip firewall nat remove [/ip firewall nat find where chain=dstnat and in-interface=$wan and action=dst-nat and to-addresses=[$lanip $lan]]
# what comes from specific wan, gets out from specific same wan
/ip firewall mangle remove [/ip firewall mangle find where action=mark-connection and chain=input and in-interface=$wan and new-connection-mark="$wan_conn"]
/ip firewall mangle remove [/ip firewall mangle find where action=mark-routing and chain=output and connection-mark="$wan_conn" and new-routing-mark="$wan_traffic"]
# port forwards from specific wan, gets out from specific same wan
/ip firewall mangle remove [/ip firewall mangle find where action=mark-connection and chain=forward and in-interface=$wan and new-connection-mark="$wan_pfw"]
/ip firewall mangle remove [/ip firewall mangle find where action=mark-routing and chain=prerouting and in-interface=$lan and connection-mark="$wan_pfw" and new-routing-mark="$wan_traffic"]
/ip firewall mangle remove [/ip firewall mangle find where chain=prerouting and in-interface=$lan and connection-mark="$wan_conn" and action=mark-routing and new-routing-mark="$wan_traffic"]
/ip firewall mangle remove [/ip firewall mangle find where chain=prerouting and in-interface=$wan and action=mark-connection and new-connection-mark="$wan_conn"]
# routing rules for wans' traffic
/ip route remove [/ip route find where dst-address=0.0.0.0/0 and gateway=[$wanip $wan] and distance=1 and routing-mark="$wan_traffic"]
}
}
}
}
After run this script you will be able to do in terminal:
TO ADD SPECIFIC WAN FOR INCOMING CONNECTION: $WanInOut add
TO REMOVE SPECIFIC WAN FOR INCOMING CONNECTION: $WanInOut remove
This command will add specific WAN port to get incoming connection to local LAN.
TO ADD ALL AVAILABLE AND ENABLED PPPOE,PPP,L2TP,SSTP,LTE FOR INCOMING CONNECTION TO ALL BRIDGE THAT AVAILABLE AND ENABLED: $WanInOut add
TO REMOVE USE ALL: $WanInOut remove
NOTE: after reboot the command $WanInOut will be removed, To add it again you should run again the script.
Enjoy