Community discussions

MikroTik App
 
Geoffb
just joined
Topic Author
Posts: 13
Joined: Wed Dec 27, 2006 4:13 pm

How to email when IP added to address list?

Fri Nov 06, 2009 2:58 pm

Hi All,

I need a little bit of help please.

We have a generic firewall rule which checks for more than 30 SMTP connections and then adds the clients IP to a src-address list.
See below:
37   ;;; Detect SMTP Spammers
     chain=SMTP action=add-src-to-address-list protocol=tcp address-list=smtp_spammers address-list-timeout=3h dst-port=25 connection-limit=30,32
What we want to do now is whenever an IP address is added to this src-list, we want it to email through to our support department so they can be aware of who was added.

Can anyone give some ideas?
Thanks. :)
 
kirshteins
MikroTik Support
MikroTik Support
Posts: 592
Joined: Tue Dec 02, 2008 10:55 am

Re: How to email when IP added to address list?

Fri Nov 06, 2009 3:44 pm

Set up action and rule for logger
/system logging action
action add name=mail email-to=email@server.com target=email 
/system logging
add action=mail disabled=no prefix=_mail topics=firewall
Set up e-mail settings under
/tool e-mail
Then copy your given rule and place a copy before original rule. Change action=log and log-prefix=_mail properties for the new rule

Then you should be able to receive e-mails with necessary information. Something similar to:

firewall,info _mail: _mail input: in:ether1 out:(none), src-mac xx:xx:xx:xx:xx:xx, proto ICMP (type 0, code 0), src-IP-address->dst-IP-address, len 44
 
Nutcracker
Frequent Visitor
Frequent Visitor
Posts: 66
Joined: Mon Jun 04, 2007 5:03 pm

Re: How to email when IP added to address list?

Fri Nov 06, 2009 5:05 pm

Is there any chance of making that line any short, ie just the IP and some text of our choice?

PS. I work with Geoffb, that is why i am asking.
 
fewi
Forum Guru
Forum Guru
Posts: 7734
Joined: Tue Aug 11, 2009 3:19 am

Re: How to email when IP added to address list?

Fri Nov 06, 2009 6:00 pm

Since it simply emails out the log entry itself you cannot easily change the content. You can either log to an external syslog server, parse the incoming logs there and email out alerts, or you can log to memory and write a script that is scheduled to run every minute or so and finds new log lines matching the pattern you are looking for, and then emails you. An example of such a script is on the wiki.

Personally I'd just keep it as you have it now.
 
er
just joined
Posts: 13
Joined: Sat Jun 03, 2006 12:38 am

Re: How to email when IP added to address list?

Sat Nov 07, 2009 11:44 pm

Hi
I use this script
:foreach i in [/ip firewall address-list find list=spamm] do={ /tool e-mail send to=xxx@xxxx.xx subject="Spamm" body=("Spamm fra " . [/ip firewall address-list get $i  address])}
 
User avatar
ploquets
Member Candidate
Member Candidate
Posts: 144
Joined: Tue Nov 17, 2015 12:49 pm
Location: Uruguaiana, RS, Brazil
Contact:

Re: How to email when IP added to address list?

Mon May 15, 2017 11:52 pm

Hi
I use this script
:foreach i in [/ip firewall address-list find list=spamm] do={ /tool e-mail send to=xxx@xxxx.xx subject="Spamm" body=("Spamm fra " . [/ip firewall address-list get $i  address])}
Is there any way to create only one email with all IPs inside at the address-list? Not one email per IP.
Thank you

Who is online

Users browsing this forum: Bing [Bot], eworm, fager, jvanhambelgium, Kashes, kd2pm2, llag, ofca and 141 guests