mac adress work not guest

Hi,


Thinking about making a script that will need to do the following.

Every 10 minutes check if any new computer with name let say "IBM-"xxxx-xxxx
gets an ip adress in work network range 192.168.0.xx upon detection by my script will automaticaly
block the same mac address with an in ip address in guest network on ip 192.168.200.xx rang for hmm 5 days and after that released

email will be sent when routers senses a new compouter in work network..

The same will happen if a computer connects to guest network the same mac adress will be denied on work network 192.168.0.xx for hmm 5 days

The intetion is to prevent work pc to be able to connect to guest network and avoid all computer on work network get affected by other users that uses the pc to watch movies when they cant in work network.

should one got for ip/dhcp-server/lease and get mac address or how get around, what scares me is cleanup all ip address left over if not expired in hmm 5 days needs to expire and delete..

thank you for all idea

You could write the following lease script on the DHCP servers (sorry that it’s a little bit lengthy):

:local var [/ip dhcp-server lease get [ find server=*second_server* && mac-address=\$leaseActMAC ]]
:if (\$lease-hostname = "desired_hostname" && \$var = nil) do={ [/ip dhcp-server lease add server=*second_server* mac-address=\$leaseActMAC block-access=yes lease-time=5d 00:00:00] }

where you will change second_server with the name of the server on which you’re NOT working at the moment and desired_hostname with the name of the computer keeping the quotation marks.

Hopefully it works as intended and I haven’t messed up the syntax

Thank you for your idea, let me check with your idea…

Hi,

trying to understand your script, your most likely to the point and i try to understand the code:.
The lease time option does not erase the user after x seconds from dhcp-server/lease table and i believe i need to assign an unique ip adress for each entry to block trafic if they would to connect to guest lan instead of staying on the work lan as they always should but does not …

what does the 1st line try to do get mac of DHCP-server in my case DHCP-WIFI, mikrotik only have 3 DHCP servers …
DHCP-LAN 192.168.0.1(WORK NETWORK)
DHCP-VOIP 192.168.2.1
DHCP-WIFI 192.168.200.1 (GUEST NETWORK)

any computer with hostname starting with “IBM-” should be enouth to determine LAN pc and
all computer of that sort have to be in DHCP-LAN and newer be able to connect to DHCP-WIFI after first beeing registred in
DHCP-LAN otherwise the other way around in guest but never to getinot DHCP-LAN for 5 days …

like your idea thou …

i hope i explains myself.

thank you

The first list determines whether there is already an entry for the computer on the other DHCP server so it doesn’t get duplicated. If the variable is empty (nil) and the compiter that is trying to connect is the desired one, a DHCP server blocking lease will be added on the other one. Although there is another (maybe better) way - to add a delay to the script and to then execute a removal of the lease:

:if (\$lease-hostname = "desired_hostname" && \$var = nil) do={ /ip dhcp-server lease add server=*second_server* mac-address=\$leaseActMAC block-access=yes ; :delay 5d 00:00:00 ; /ip dhcp-server lease remove [ find block-access=yes ] }