aboutsummaryrefslogtreecommitdiffstats
path: root/ipsec-to-dns
diff options
context:
space:
mode:
authorGravatar Christian Hesse <mail@eworm.de>2021-05-17 16:32:07 +0200
committerGravatar Christian Hesse <mail@eworm.de>2021-05-17 16:41:51 +0200
commit862417b8d32f6eef1c05ba9137fe2a7f14436987 (patch)
treeb14fce4182be88330586cee1e0a71a466c84f96f /ipsec-to-dns
parent604306f2200a2a4bc6f6865f4aea90befe2e0142 (diff)
add 'ipsec-to-dns'change-51
Diffstat (limited to 'ipsec-to-dns')
-rw-r--r--ipsec-to-dns68
1 files changed, 68 insertions, 0 deletions
diff --git a/ipsec-to-dns b/ipsec-to-dns
new file mode 100644
index 0000000..bfdc807
--- /dev/null
+++ b/ipsec-to-dns
@@ -0,0 +1,68 @@
+#!rsc by RouterOS
+# RouterOS script: ipsec-to-dns
+# Copyright (c) 2021 Christian Hesse <mail@eworm.de>
+# https://git.eworm.de/cgit/routeros-scripts/about/COPYING.md
+#
+# and add/remove/update DNS entries from IPSec mode-config
+# https://git.eworm.de/cgit/routeros-scripts/about/doc/ipsec-to-dns.md
+
+:local 0 "ipsec-to-dns";
+:global GlobalFunctionsReady;
+:while ($GlobalFunctionsReady != true) do={ :delay 500ms; }
+
+:global Domain;
+:global HostNameInZone;
+:global Identity;
+:global PrefixInZone;
+
+:global CharacterReplace;
+:global LogPrintExit2;
+:global IfThenElse;
+
+:local Zone \
+ ([ $IfThenElse ($PrefixInZone = true) "ipsec." ] . \
+ [ $IfThenElse ($HostNameInZone = true) ($Identity . ".") ] . $Domain);
+:local Ttl 5m;
+:local CommentPrefix ("managed by " . $0 . " for ");
+:local CommentString ("--- " . $0 . " above ---");
+
+:if ([ :len [ / ip dns static find where comment=$CommentString name=- type=NXDOMAIN disabled ] ] = 0) do={
+ / ip dns static add comment=$CommentString name=- type=NXDOMAIN disabled=yes;
+ $LogPrintExit2 warning $0 ("Added disabled static dns record with comment '" . $CommentString . "'.") false;
+}
+:local PlaceBefore ([ / ip dns static find where comment=$CommentString name=- type=NXDOMAIN disabled ]->0);
+
+:foreach DnsRecord in=[ / ip dns static find where comment ~ $CommentPrefix ] do={
+ :local DnsRecordVal [ / ip dns static get $DnsRecord ];
+ :local PeerId [ $CharacterReplace ($DnsRecordVal->"comment") $CommentPrefix "" ];
+ :if ([ :len [ / ip ipsec active-peers find where id=$PeerId dynamic-address=($DnsRecordVal->"address") ] ] > 0) do={
+ $LogPrintExit2 debug $0 ("Peer " . $PeerId . " (" . $DnsRecordVal->"name" . ") still exists. Not deleting DNS entry.") false;
+ } else={
+ :local Found false;
+ $LogPrintExit2 info $0 ("Peer " . $PeerId . " (" . $DnsRecordVal->"name" . ") has gone, deleting DNS entry.") false;
+ / ip dns static remove $DnsRecord;
+ }
+}
+
+:foreach Peer in=[ / ip ipsec active-peers find where !(dynamic-address=[]) ] do={
+ :local PeerVal [ / ip ipsec active-peers get $Peer ];
+ :local Comment ($CommentPrefix . $PeerVal->"id");
+:put ($PeerVal->"id");
+ :local HostName [ :pick ($PeerVal->"id") 0 [ :find ($PeerVal->"id" . ".") "." ] ];
+:put $HostName;
+
+ :local Fqdn ($HostName . "." . $Zone);
+ :local DnsRecord [ / ip dns static find where name=$Fqdn ];
+ :if ([ :len $DnsRecord ] > 0) do={
+ :local DnsIp [ / ip dns static get $DnsRecord address ];
+ :if ($DnsIp = $PeerVal->"dynamic-address") do={
+ $LogPrintExit2 debug $0 ("DNS entry for " . $Fqdn . " does not need updating.") false;
+ } else={
+ $LogPrintExit2 info $0 ("Replacing DNS entry for " . $Fqdn . ", new address is " . $PeerVal->"dynamic-address" . ".") false;
+ / ip dns static set name=$Fqdn address=($PeerVal->"dynamic-address") ttl=$Ttl comment=$Comment $DnsRecord;
+ }
+ } else={
+ $LogPrintExit2 info $0 ("Adding new DNS entry for " . $Fqdn . ", address is " . $PeerVal->"dynamic-address" . ".") false;
+ / ip dns static add name=$Fqdn address=($PeerVal->"dynamic-address") ttl=$Ttl comment=$Comment place-before=$PlaceBefore;
+ }
+}