Hello everyone! I have a little problem. With the help of a nice person, we put together a script that, in principle, does the following: if 192.168.89.* is found in the blacklist, it sends an email about it.
Now my problem is that if there is more than one in the list, the following error message is sent:
invalid internal item number
And here is the script:
{
/system
:local systemName [identity get name]
:local dateBlock [clock get date]
:local timeBlock [clock get time]
:local emlAdd "mail@mail.hu"
:local EmailText ""
:local ipaddress "192.168.89.*"
:local blacklist "brute_forcers_blacklist"
/ip firewall address-list
:foreach i in=[find where list="internal"] do={
:if ([:len [get [find address~$ipaddress list=$blacklist] address]] > 0) do={
:local ipf [get [find where list=$blacklist and address~$ipaddress] address]
:set EmailText ($EmailText."IP $ipf Has been added to the BlackList\r\n")
:put "cause";
:do {
/tool e-mail send to=$emlAdd subject="$systemName Security Notice" \
body="$systemName Security Notice\r\nRunning Time: $dateBlock - $timeBlock\r\n\r\n$EmailText"
} on-error={
:log error "$systemName Security Notice: Failed to send email."
}
}
:put $ipaddress
}
}
find where list=“internal” This is because at first it would have worked from the address list here as well, but unfortunately it didn’t work that way and it would have been more complicated to handle /24 there (at least for me) than 89.*. If there are several addresses in the address list, the error is the same.
What am I messing up?
Thank you in advance for your help!