Script to clear out connections

RouterOS Scripting
1

I am trying to write a script that will read IP addresses on an address list and then go to the /ip firewall connections and clear out those IP Addresses active connections.

The reason for this is, we have a couple of firewall rules that monitor the number of active sessions of an end user, if they violate this limit they are then blocked and all HTTP traffic is redirected to a web page letting them know that they are blocked for a specific time. This works fine, but there are times that I am noticing that they either continue to pass traffic because of the established connections, or when the time expires they are blocked again because of their open TCP connections still being “open” in the router.

I was hoping someone could give me some pointers on the best way to do this.

The first problem that I am having, is that it seams I am unable to delete connections based off of the IP of the end user. This is the string I am trying to use for that.

:foreach i in=[/ip firewall connection find scr-address="192.168.50.25"] do={/ip firewall connection remove $i}

This works fine if i search for a connection mark or other things, but apparently not the IP address.

The second issue I am having is putting the address list into an array and reading out the IP addresses from that array to be used in clearing out the connections.

Any help in getting this script going would be greatly appreciated. Thanks.

2

thank you for reporting it, we will look into problem.

try to use quotation and connection marks to match right connections.

3

try this:

/ip firewall connection remove [/ip firewall connection find scr-address~“192.168.50.25:”]

4

thank you for reporting it, we will look into problem.

try to use quotation and connection marks to match right connections.

Thanks for looking into it. I also just upgraded to 4.10 on my test box from 4.5 and it still has the same problem. I can’t use connection marks since we are using PCC for the hotspot, I would have to clear out everyone’s connections from the table just to clear out one users connections, that’s not really a good solution. These connections that I am trying to clear out are also already established, so I don’t believe that I can change their mark in order to clear them out. I’ve also tried with and without quotes and as many variations that I could think of.

try this:

/ip firewall connection remove [/ip firewall connection find scr-address~“192.168.50.25:”]

Tried it with the same results.

Once that’s taken care of, I just need to figure out how to pull the addresses from the address list and use that to clear out the connections :slight_smile:.

5

do you get any errors when you run that command?

How about this:

:put [:len [/ip firewall connection find scr-address~“192.168.50.25:” ] ]

6

No errors when the command is run. It accepts it, just nothing happens.

Running the command returns a number of 0. I’m looking at Winbox and there are a few open sessions for my test machine, so I’m assuming it should return some number.

7

oh, there is a typo in there, it should be src-address, not scr-address.

8

Darn them little typo’s! That has that portion of the script working now.

:foreach i in=[/ip firewall connection find src-address~"192.168.51.252"] do={/ip firewall connection remove $i}

Now to figure out how to pull the IP out of an address list and use that in the script.

9

If the address list contains hosts just iterate through it:

:foreach ENTRY in=[/ip firewall address-list find where list=Address-List-Name] do={
  :local IP [/ip firewall address-list get $ENTRY address];
  :foreach CONN in=[/ip firewall connection find src-address~"$IP"] do={
    /ip firewall connection remove $CONN;
  }
}

Since you’re matching exactly and not a regex, you could also try using “=” when finding the connections instead of “~”. That should be cheaper on resources. Of course that might not matter depending on how many entries you’re parsing, what hardware you’re running and how busy that hardware is.

10

That got it, I needed to modify it a bit more, but now it’s clearing out the connections.

Here is the final product. I’ll see what I can do to up both of your Karma.

:foreach ENTRY in=[/ip firewall address-list find list="abuse"] do={
 :local IP [/ip firewall address-list get number=$ENTRY address ]; 
  :foreach CONN in=[/ip firewall connection find src-address~"$IP:"] do={
   /ip firewall connection remove $CONN;
 }
}

We are running 493 and 450 boards. A lot of them are only serviced by a couple of bonded T-1s. Most of them see between 50-125 unique users a day. The only times when I see the CPU spike is sometimes with the API, when Torch gets stuck, or when the box receives a ton of garbage traffic from somewhere. The first two are easy enough to get the CPU back down, the last one is a pain :laughing: .

11

Rather than loop thru each connection, its more efficient to just have one line remove them all:

:foreach ENTRY in=[/ip firewall address-list find list=“abuse”] do={
:local IP [/ip firewall address-list get number=$ENTRY address ];
/ip firewall connection remove [/ip firewall connection find src-address~“$IP:”]
}

This will save resources. The conntrack table is moving fast, so looping thru them might be slow enough where sometimes a connection doesn’t exist anymore, or an index number is reused and you now removed the wrong one.

12

That one is running much faster. Thanks for the updated script.

13

also, instead of

~"$IP:"

use

~"^$IP:"

because if $IP == “1.2.3.4”, your code will match “1.2.3.4:80”, “21.2.3.4:443”, “111.2.3.4:445”, etc.

14

good catch!

15

Thanks, I’ll go through and update the script on our boxes.