:global ipCommentArray
:set ipCommentArray [:toarray ""]

:local addToBlackList do={
    :global ipCommentArray
    :local blacklist "Black List"
    :foreach entry in=$ipCommentArray do={
        :local ip [:pick $entry 0 [:find $entry ";"]]
        :local comment [:pick $entry ([:find $entry ";"] + 1) [:len $entry]]
        :if ([:len [/ip firewall address-list find where list=$blacklist address=$ip]] = 0) do={
            /ip firewall address-list add list=$blacklist address=$ip comment=$comment
            /log warning "Bloqueada IP $ip por $comment"
        }
    }
    :set ipCommentArray [:toarray ""]
}

# Bloque para IPsec
{
    :local logContent
    :local ipAddress
    :foreach logLine in=[/log find where (topics~"ipsec" and topics~"error" and message~"phase1 negotiation failed")] do={
        :set logContent [/log get $logLine message]
        :local ipPos [:find $logContent "<=>"]
        :if ($ipPos > 0) do={
            :local ipStart ($ipPos + 3)
            :local ipEnd [:find $logContent "[" $ipStart]
            :if ($ipEnd > $ipStart) do={
                :set ipAddress [:pick $logContent $ipStart $ipEnd]
                #/log warning "Por contenido $ipAddress "
                :set ($ipCommentArray->[:len $ipCommentArray]) "$ipAddress;VPN IPSEC Attack"
                #/log warning "Por 1 bloquear $ipAddress por intento sospechoso en VPN IPSEC"
            }
        } else={
            :local ipStart [:find $logContent " "]
            :if ($ipStart > 0) do={
                :set ipAddress [:pick $logContent 0 $ipStart]
                :set ($ipCommentArray->[:len $ipCommentArray]) "$ipAddress;VPN IPSEC Attack"
                #/log warning "Por 2 bloquear $ipAddress por intento sospechoso en VPN IPSEC"
            }
        }
    }
}

# Bloque para L2TP
{
    :local connections [:toarray [/log find where topics~"l2tp" && topics~"info" && message~"first L2TP UDP packet received from"]]
    :foreach logEntry in=$connections do={
        :local logText [/log get $logEntry message]
        :local srcIP [:pick $logText ([:find $logText "from "] + 5) [:len $logText]]
        :local logTime [/log get $logEntry time]
        :local success [:toarray [/log find where topics~"l2tp" && topics~"info" && message~"logged in" && message~$srcIP]]
        :if ([:len $success] = 0) do={
            :set ($ipCommentArray->[:len $ipCommentArray]) "$srcIP;VPN L2TP Attack"
            #/log warning "Por bloquear $srcIP por intento sospechoso en VPN L2TP "
        }
    }
}

# Bloque para PPTP
{
    :local connections [:toarray [/log find where topics~"pptp" && topics~"info" && message~"TCP connection established from"]]
    :foreach logEntry in=$connections do={
        :local logText [/log get $logEntry message]
        :local srcIP [:pick $logText ([:find $logText "from "] + 5) [:len $logText]]
        :local logTime [/log get $logEntry time]
        :local success [:toarray [/log find where topics~"pptp" && topics~"ppp" && message~"logged in" && message~$srcIP]]
        :if ([:len $success] = 0) do={
            :set ($ipCommentArray->[:len $ipCommentArray]) "$srcIP;VPN PPTP Attack"
            #/log warning "Por bloquear $srcIP por intento sospechoso en VPN PPTP"
        }
    }
}

$addToBlackList