I spent part of the weekend figuring out how to get pinhole firewall NAT ("port mapping") rules built, and I had a bunch of existing rules from another system that I didn't want to manually convert. So I put together this little python script to generate the rules which can then be pasted in via the terminal. Hopefully it's useful to someone else along the way.
The only configuration is whether you want the interior "hairpin" NAT rules built or not.
Comments welcome...
https://gist.github.com/ljwobker/7104a9 ... b2fb581cb2
Re: python script for building firewall pinholes and hairpin rules ("port forwarding")
missing / in front of "ip"
Why do not use directly RouterOS script instead of install python just for repeat 2 lines???
Ignoring comments and whitespace are also less line of code 
I prefer to put each hairpin under the relative rule, instead to separate rules and hairpin.
I prefer also to put only one time "/ip firewall nat" instead of repeating it continuosly.
But the behaviour of your python script can be exactly copied.
Your same behaviour, except the added fix for "ip":
Why do not use directly RouterOS script instead of install python just for repeat 2 lines???
Code: Select all
# "pinhole name/comment"= "outside_port", "protocol", "inside_host", "inside_port"
{ :local rules { "Joe web server"= "80", "tcp", "192.168.1.35", "80" \
; "trusted inside SSH"= "1999", "tcp", "192.168.1.40", "22" }
:local "inside_subnet" "192.168.15.0/24"
:local "build_hairpins" true ; # set this if you want the inside hairpin rules built as well
:put "\1Bc\r\n/ip firewall nat"
foreach comment,map in=$rules do={
:put "add action=dst-nat chain=dstnat in-interface-list=WAN dst-port=$($map->0) protocol=$($map->1) \
to-addresses=$($map->2) to-ports=$($map->3) comment=\"$comment\""
:if ($"build_hairpins") do={
:put "add action=dst-nat chain=dstnat dst-address-list=WAN dst-port=$($map->0) protocol=$($map->1) \
to-addresses=$($map->2) to-ports=$($map->3) src-address=$"inside_subnet" comment=\"$comment hairpin\""}}}
I prefer to put each hairpin under the relative rule, instead to separate rules and hairpin.
I prefer also to put only one time "/ip firewall nat" instead of repeating it continuosly.
But the behaviour of your python script can be exactly copied.
Your same behaviour, except the added fix for "ip":
Code: Select all
# "pinhole name/comment"= "outside_port", "protocol", "inside_host", "inside_port"
{ :local rules { "Joe web server"= "80", "tcp", "192.168.1.35", "80" \
; "trusted inside SSH"= "1999", "tcp", "192.168.1.40", "22" }
:local "inside_subnet" "192.168.15.0/24"
:local "build_hairpins" true ; # set this if you want the inside hairpin rules built as well
foreach comment,map in=$rules do={
:put "/ip firewall nat add comment=\"$comment\" action=dst-nat chain=dstnat protocol=$($map->1) \
dst-port=$($map->0) in-interface-list=WAN to-addresses=$($map->2) to-ports=$($map->3)"}
:if ($"build_hairpins") do={foreach comment,map in=$rules do={
:put "/ip firewall nat add action=dst-nat chain=dstnat dst-address-list=WAN protocol=$($map->1) dst-port=$($map->0) \
src-address=$"inside_subnet" to-addresses=$($map->2) to-ports=$($map->3) comment=\"$comment hairpin\""}}}
Re: python script for building firewall pinholes and hairpin rules ("port forwarding")
Adding firewall rules for pinholes/NAT seems like one-time cut-and-paste thing, so not sure what Python adds here. And now you have an external script that isn't safe to run more than once - so you can't just add to that list at the top and have it work...
You can use SSH from python to just run the same code @rextended provides. For this particular small task I'd think that be cleaner.
Just my two cents however.
You can use SSH from python to just run the same code @rextended provides. For this particular small task I'd think that be cleaner.
Just my two cents however.
Re: python script for building firewall pinholes and hairpin rules ("port forwarding")
Why python? -- Because I already know it! I didn't even know there WAS a routerOS scripting language, but that's a very useful tip.
Apologies for the typo.
And while *I* don't expect to use this regularly, maybe it helps someone else.
Certainly just one of many ways to solve this particular task.
Apologies for the typo.
And while *I* don't expect to use this regularly, maybe it helps someone else.
Certainly just one of many ways to solve this particular task.
Who is online
Users browsing this forum: No registered users and 3 guests