I am having a firewall rules
add action=jump chain=input comment=“Jump to RFC SSH Chain” jump-target=
“RFC SSH Chain” log=yes log-prefix=PSD
add action=add-src-to-address-list address-list=“Black List (SSH)”
address-list-timeout=none-dynamic chain=“RFC SSH Chain” comment=
“Transfer repeated attempts from SSH Stage 3 to Black-List”
connection-state=new dst-port=4777 protocol=tcp src-address-list=
“SSH Stage 3”
add action=add-src-to-address-list address-list=“SSH Stage 3”
address-list-timeout=1m chain=“RFC SSH Chain” comment=
“Add succesive attempts to SSH Stage 3” connection-state=new dst-port=4777
protocol=tcp src-address-list=“SSH Stage 2”
add action=add-src-to-address-list address-list=“SSH Stage 2”
address-list-timeout=1m chain=“RFC SSH Chain” comment=
“Add succesive attempts to SSH Stage 2” connection-state=new dst-port=4777
protocol=tcp src-address-list=“SSH Stage 1”
add action=add-src-to-address-list address-list=“SSH Stage 1”
address-list-timeout=1m chain=“RFC SSH Chain” comment=
“Add intial attempt to SSH Stage 1 List” connection-state=new dst-port=4777
protocol=tcp
add action=return chain=“RFC SSH Chain” comment=“Return From RFC SSH Chain”
And when IP will found in address list Black List (SSH) i was set email alert:
:log info message=(“Start Sending Report”);
:local ipList value=“”;
:foreach tmpAddress in=[/ip firewall address-list find where dynamic=yes and list=“Black List (SSH)”] do={
:set $ipList value=([/ip firewall address-list get $tmpAddress value-name=address].“\r\n”.$ipList);
};
/tool e-mail send from=“> test@test.com> " to=”> test1@test.com> " subject=("List report of “.[/system clock get date].” ".[/system clock get time]) body=(“List of auto-blacklisted host:\r\n”.$ipList);
:log info message=(“Sending Report End”);
What is the best way to control this? To have a timeout for delete IP in address list, like 10 days, and run script every 10 days, or ?
Please give me advice. 