In work I've Chateau LTE12. LTE is backup connection. I've script which check main ISP and if it failover LTE starts - it works until 7 Aug when upgrade firmware from 7.20 or 7.21 (I don't remember) to 7.23. At 7 Aug people from my work phoned to me, that they cannot work remotely (via plink). I restarted router and still don't work, change main ISP to LTE and script change to main (main works OK). Quick reading on internet - Ros has CVE and ... we had "security breach", ssh not work because someone change who can access via ssh (172.xxx, 10.xxx and 196.xxx). Removed this and now they can work remotely. I upgraded firmware to 7.23.x stable, this upgrade flagged router. Script no fully working because status is flagged or something else changed with upgrade?
Script:
:local adrHost "1.1.1.1";
:local WANPort "WANPort";
:local iloscProb 20;
:local warunek 15;
:local statusMainISP [/ip route get [find comment=GlownyISP] disabled];
:local statusBackupISP [/ip route get [find comment=Zapasowy] disabled];
:local iloscOdpowiedzi;
:set iloscOdpowiedzi [/ping $adrHost interface=$WANPort count=20];
#sprawdzamy warunek gdy 25% nie przeszło
:if ($iloscOdpowiedzi<$warunek) do={
:if (!$statusMainISP) do={
/ip route disable [find comment=GlownyISP];
};
:if ($statusBackupISP) do={
/ip route enable [find comment=Zapasowy];
};
/log info "Wyłączono główne połączenie, ilość odpowiedzi = $iloscOdpowiedzi (<$warunek) - test przez $WANPort";
};
#inaczej jest ok
:if ($iloscOdpowiedzi>=$warunek) do={
:if ($statusMainISP) do={
/ip route enable [find comment=GlownyISP];
};
:if (!$statusBackupISP) do={
/ip route disable [find comment=Zapasowy];
};
/log info "Przywrócono główne połączenie, ilość odpowiedzi = $iloscOdpowiedzi (>=$warunek) - test przez $WANPort";
};
WANPort is port where main ISP. I testing more ping then 4 because sometimes first 4 is OK and rest not.
BackupISP (comment=Zapasowy) is LTE.
Until upgrade script work OK, after if ISP is LTE this /ping $adrHost interface=$WANPort count=20] always return 0.
In short:
Compromised device;
export outside the device the file obtaied with /export show-sensitive file=mybackup;
REMOVE SIM;
perform a Netinstall;
clear the flagged status;
import back the mybackup.rsc "line by line" with notepad or similar, so you can check exactly what you restore;
do not use .backup;
disable all management services vs the WAN, and do not open services vs Internet for no reason;
Insert back the SIM.
Yesterday I do your list. Script still not work. It change from MainISP to BackupISP but not from Backup to Main. I think MT change something in newer ROs.
I still need working script (in September out LTE limit reach 0 because script not work)
The main problem is that new version flagged your router a compromised so you HAVE to resrot the problem as the first step as @rextended wrote. Period.
The next step is to check why script does not work but it could be corellated to the upgrade but may be not.
Do not focus on a script that is not crucial comparing to some "enemies" inside your router.
The script, if it is exactly as you pasted it on the forum, is incorrect,
it is missing a } at the end...
Also, cleaning up the script wouldn't hurt,
there are too many semicolons and other parts that are unnecessary or unclear,
especially if it's written in a language other than English.
:local adrHost "1.1.1.1"
:local WANPort "WANPort"
:local iloscProb 20
:local warunek 15
:local MainISP "GlownyISP"
:local BackupISP "Zapasowy"
:local iloscOdpowiedzi [:ping $adrHost interface=$WANPort count=$iloscProb]
/ip route
:if ($iloscOdpowiedzi < $warunek) do={
# sprawdzamy warunek gdy 25% nie przeszlo
disable [find where comment=$MainISP and disabled=no ]
enable [find where comment=$BackupISP and disabled=yes]
:log info "Wylaczono glówne polaczenie, ilosc odpowiedzi = $iloscOdpowiedzi (<$warunek) - test przez $WANPort"
} else={
# inaczej jest ok
enable [find where comment=$MainISP and disabled=yes]
disable [find where comment=$BackupISP and disabled=no ]
}
