Tag Archives: script

Scriptlet: Bulk VPN connections on MikroTik with connection rate limiting

During my day job we use some MikroTik CHR deployments for (among other things) VPN session termination. The CHR’s are easy to spin up, offer a wide variety of VPN types, and for low traffic sessions can support upwards of 10,000 sessions on a single device.

It’s over 9000!

In the event of an outage though, you would run into a problem – those 10,000 sessions all want to re-establish at once.. and the CPU on the MikroTik quickly bottlenecks until it becomes unable to cope and begins to drop connections quickly becoming a vicious cycle.

We initially dealt with this by defining a hard limit on the number of new sessions per second, using 2 simple firewall rules and the connection limit classifier to keep these under 10 per second – however this meant that after an outage it would take at absolute minimum, over 15 minutes for all the sessions to come back online! So we came up with a better solution. Continue reading Scriptlet: Bulk VPN connections on MikroTik with connection rate limiting

Scriptlet: Halt MikroTik scheduled scripts if multiple instances are detected.

The following script can be run in terminal (or via any automation tool that can login to your MikroTik devices via SSH) and checks for any duplicate script ‘jobs’ and kills them.

I wrote this after noticing a few of my scripts that use fetch would hang periodically and leave multiple jobs open.

#kill duplicate script jobs
:global counter
:global counter2
:foreach counter in=[/system script job find] do={
:global job [/system script job get $counter script]
:if ([:len [/system script job find where script=$"job"]] > 0 && [:len $job] > 0) do={
:put "Duplicate script running: $job - terminating all"
:foreach counter2 in=[/system script job find where script=$"job"] do={
/system script job remove $counter2
}
}
}

Continue reading Scriptlet: Halt MikroTik scheduled scripts if multiple instances are detected.

Scriptlet: Find Default Route Interface Names (and a free licence!)

Today I’m giving you the task of reviewing and improving a small script I’ve written, and one of you will win a free Level 4 RouterOS licence. 

Background: I had need of a script to find the interfaces associated with any default routes in order to create matching firewall entries, and it had to work with RouterOS v6.

This script searches through any default route (dst-address=0.0.0.0/0) and adds it to an array so long as the interface can’t already be found in the array. I don’t often use arrays in MikroTik so the first version has a search function that doesn’t loop through the array, but instead just converts it to a string again to run the find command (Line 8)

Continue reading Scriptlet: Find Default Route Interface Names (and a free licence!)

Queue Tree Mikrotik to limit total bandwidth

Hi Guys,
today i’ll show you how to manage the Mikrotik Queue Tree to limit the total bandwidth (for. example you can split a 20Mbps DSL to 4Mbps per 5 users)
In my example i’ll limit upload+download=20Mbps

First of all we need to mark the packets to be traced in the queue:

/ip firewall mangle
add action=mark-packet chain=prerouting in-interface=ether3 new-packet-mark=upload
add action=mark-packet chain=postrouting new-packet-mark=download out-interface=ether3

Then we’ll set up the queue tree:

/queue tree
add max-limit=20M name=total-traffic parent=global queue=default
add name=upload packet-mark=upload parent=total-traffic queue=default
add name=download packet-mark=download parent=total-traffic queue=default

In this case the upload and download mark will be added and when this sum reach the limit it is possibile to send an email as alert (You can find the script for checking the queue tree limit here.)

Enjoy!

MikroTik Scripting: Failover Routing for Asterisk PBX

Hi guys,

This is my second article and I wanted to raise the difficulty level of my tutorials!

We work a lot with Asterisk PBX and MikroTik and we’ve encountered a problem when we have 2 internet connection with a MikroTik using WAN failover, our Asterisk PBX would stop working when the primary connections fail; we finally  figured out why.

In this case, the Asterisk connections would remain appended to the primary gateway, and Asterisk doesn’t understand the change of connection; so we came up with a solution using 2 MikroTik scripts.

First, the “Check Script” checks if the primary internet connection is working or not. If fails, use the secondary internet link and reboot the router. You are probably asking why we would do this…I know!

Because after the reboot I can run a “Restart Script” to check if primary connection is still out, or came back.

In this way, by rebooting the router, the asterisk pbx client loose for a moment the registration and reconnect with the new gateway so everything works.
Actually we’re testing other solutions to avoid the router reboot…when I’ve found that I’ll update this post and let you know!

Editors note: This could be achieved in a few ways, I’ll leave it as a test for our readers to see what improvements you can come up with!

Here are the scripts:

Check Script

:global strDate [/system clock get date]
:global strTime [/system clock get time]
:global strSystemName [/system identity get name]

:if ([/ping 10.104.7.187 interface=pppoe-out1 count=5] = 0 && [/ping 8.8.4.4 interface=pppoe-out1 count=5] = 0 && [/ip route get [find comment="Primary"] disabled]=false) do={
    :log info "Disabling Primary";
    /ip route set [find comment="Primary"] disabled=yes
    /tool e-mail send from="yyyyy@gmail.com" to="xxxx@gmail.com" subject="Route Failover - $strDate $strTime - $strSystemName" body="Failover to Telecom occurred at $strDate $strTime on $strSystemName"
    :delay 3
    /system reboot

} else= {
    :log info "No Failover Necessary";
}

Restart Script

:delay 10;
:if ([/ip route get [find comment="Primary"] disabled]=true) do={
    /interface ethernet set numbers=4 disabled=no

     /ip route set [find comment="Primary"] disabled=no
     /ip route set [find comment="Primary"] distance=3
    :delay 10
    :if ([/ping 10.104.7.187 routing-table=Primary count=5] > 0 && [/ping 8.8.4.4 routing-table=Primary count=5] > 0) do={

       /ip route set [find comment="Primary"] distance=1
       /system reboot
    }
     else= {

        /ip route set [find comment="Primary"] distance=3

    }
} else= {
    :log info "No Failover Necessary";
}

Written by Razorblade, edited by Omega-00