remote script execute via ssh

RouterOS Scripting
1

hello,

could anyone help me automate the process of allowing acces based on mac/ip pairs?
basically i use these commands for each client (and they work :slight_smile: ):

/ip firewall filter add chain=input in-interface=lan src-mac-address=xx:xx:xx:xx:xx:xx action=jump jump-target=client1 place-before=14
/ip firewall filter add chain=client1 src-address=10.7.10.9 action=accept
/ip firewall filter add chain=client1 action=drop

(the “place-before=14” is to insert it after the 13th firewall rule that denies acces to various ports)
what i need is a way to use command line arguments or something…
for example, if i had bash i would use:

/ip firewall filter add chain=input in-interface=lan src-mac-address=$3 action=jump jump-target=$1 place-before=14
/ip firewall filter add chain=$1 src-address=$2 action=accept
/ip firewall filter add chain=$1 action=drop

and save it as client_add.sh , so when i type:

ssh _router_ip_ "sh client_add.sh client1 10.7.10.9 xx:xx:xx:xx:xx:xx"

it would work.
how can i do something like this in routeros?

hope i made sense to anyone. :smiley: thanx in advance.

2

You cannot pass parameters to system scripts.

I think the easiest solution is to make use of the fact that files ending in “auto.rsc” (so test.auto.rsc, for example) uploaded via FTP (not via any other method) get automatically executed directly after upload. Write a shell script wrapper that takes your parameters, creates the correct script and uploads it via FTP.

Edit: if you really want to do this via SSH - and I can absolutely see why that would be desirable - the easiest way I can think of is to construct the same script via a bash wrapper that takes parameters, uploads it via SFTP and then runs ‘ssh user@ip “/import uploaded_scriptname; /file remove uploaded_scriptname;”’.

3

or jsut have client_add.sh run the mikrotik commands directly. bash will expand the variables and ssh will run them on the router.

4

psuedo code:

#!/bin/sh

ssh user@router_ip “/ip firewall filter add chain=input in-interface=lan src-mac-address=$3 action=jump jump-target=$1 place-before=14; /ip firewall filter add chain=$1 src-address=$2 action=accept; /ip firewall filter add chain=$1 action=drop”

then call that script:

sh client_add.sh client1 10.7.10.9 xx:xx:xx:xx:xx:xx

5

now why didn’t i think of that… :confused: thanks a lot :smiley:

6

using bash to do all the work seems more simple, but thanks for the ideea anyway :slight_smile:

7

Where do I enter my password? Does it pop up a prompt when you run the script?

8

It pops up a prompt when you run that command just like it does for any other SSH connection you build.

You can also set up certificates instead and do away with the need for a password (beyond unlocking your keychain, if you use that functionality).

9

Tested and confirmed. Thanks!