When a user tries IPSEC, but does not have correct credential, a message like this will be logged “negotiation failed”
This script take the IP from this attempt and add it to a block list to prevent multiple login attempt. (Blocked out)
script name: Find_IPSEC_negotian_failed
# Created Jotne 2019 v1.1
# 1.1 made sure "negotiation failed" is at end of line and it contains IP
#
# This script add ip of user who failed IPSEC negotiation to a block list for 24hour
# Schedule the script to run every 5 min
# It should run on all routerOS version
# Find all "negotiation failed" error last 5 min
:local loglist [:toarray [/log find time>([/system clock get time] - 5m) (message~"negotiation failed.\$" || message~"src_ip")]]
# for all error do
:foreach i in=$loglist do={
# find message
:local logMessage [/log get $i message]
# find ip
:local ip [:pick $logMessage 0 [:find $logMessage " "]]
# Add ip to accesslist
/ip firewall address-list add address=$ip list=IPSEC timeout=24h
# Send a message to the log
:log info message="script=IPSEC_failed src_ip=$ip"
}
Create a scheduler that do run the script Find_IPSEC_negotian_failed every 5 min:
First part can not be copy/pasted directly to cli.
You ned from Web or Winbox, create a script, then copy/past the first part to the script.
Here is a version you can copy/past from cli (much harder do read and understand)
/system script add dont-require-permissions=no name=Find_IPSEC_negotian_failed owner=jotne policy=\
ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon source="# Created Jotne 2019 v1.0\r\
\n#\r\
\n# This script add ip of user who failed IPSEC negotiation to a block list for 24hour\r\
\n# Schedule the script to run every 5 min\r\
\n# It should run on all routerOS version\r\
\n\r\
\n# Find all \"negotiation failed\" error last 5 min\r\
\n:local loglist [:toarray [/log find time>([/system clock get time] - 5m) message~\"negotiation failed\"]]\r\
\n\r\
\n# for all error do\r\
\n:foreach i in=\$loglist do={\r\
\n\r\
\n# find message\r\
\n\t:local logMessage [/log get \$i message]\r\
\n# find ip\r\
\n\t:local ip [:pick \$logMessage 0 [:find \$logMessage \" \"]]\r\
\n\r\
\n# Add ip to accesslist\t\r\
\n\t/ip firewall address-list add address=\$ip list=IPSEC timeout=24h\r\
\n# Send a message to the log\t\r\
\n\t:log info message=\"script=IPSEC_failed src_ip=\$ip\"\r\
\n\t}\r\
\n"
I was trying to copy your original post in to the script windows and not CLI.
Adding it Via CLI worked better. It ran and gave me a FW entry this time, but it does not pull the IP from the log entry. Here is the log add from the script:
script=IPSEC_failed src_ip=phase1
That is the beginning of the line in the log that contains the “negotiation failed” bit.
Try to run the script from cli
Output is to cli not to log in this version. Also changed to last 24h
[
# Find all "negotiation failed" error last 5 min
:local loglist [:toarray [/log find time>([/system clock get time] - 24h) message~"negotiation failed"]]
# for all error do
:foreach i in=$loglist do={
# find message
:local logMessage [/log get $i message]
# find ip
:local ip [:pick $logMessage 0 [:find $logMessage " "]]
# Add ip to accesslist
/ip firewall address-list add address=$ip list=IPSEC timeout=24h
# Send a message to the log
:put "script=IPSEC_failed src_ip=$ip"
}
]
dynamically created a FW address-list rule named IPSEC with and address of phase1. Timeout is correct.
Terminal L1: script=IPSEC_failed src_ip=phase1
Terminal L2: failure: already have such entry
note: I deleted the previous phase1 entries form the FW address-list. I am unclear where the L2 report is coming from…?
I am running 6.44.3. The failure message in my log is:
phase1 negotiation failed due to time up
xxxxxx(xxx)<=>XXXXXX(xxx)
as;dlfkj;lkjw2l;j22as;lkdfa;lsfj;lasjkf
The first IP address is the target VPN and the second is my Cell phone IP. I am using my cell VPN to hit the correct address with invalid secret and credentials.
For the second piece you asked me to run manually I get some strange hex(?) back: *19da;*19db;*19ed;*19fe
I am guessing it is not pickup up the system time of that message, yet still trying to subtract 24h thus the hex. That is an uneducated guess.
edit: if I make - 0m it will return a blank. not sure why it is not picking up the time of the message containing “negotiation failed”
That is it - with two blanks between. The log is filled with at least 10 “negotiation failed” lines in the last 24 hours. Could the clock be causing a problem?
The log is stored in memory - I assume that is ok as default?
update - I typed the whole think in the terminal manually (each line) thinking there was a character set issue - but go the same result as above.
Thanks for your help - this would be a great script to have!
as it does not appear to find any results within the last 24 hours.
I am hoping someone with more scripting skill that I have (which is zero) may chime in. I will keep working at it in my own layman way and report back any progress.
so that worked
