aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
-rw-r--r--README.md1
-rw-r--r--doc/dhcp-to-dns.md1
-rw-r--r--doc/ipsec-to-dns.md46
-rw-r--r--global-config2
-rw-r--r--global-config-overlay2
-rw-r--r--global-config.changes1
-rw-r--r--global-functions2
-rw-r--r--ipsec-to-dns68
8 files changed, 120 insertions, 3 deletions
diff --git a/README.md b/README.md
index 5d7498d..e102202 100644
--- a/README.md
+++ b/README.md
@@ -165,6 +165,7 @@ Available Scripts
* [Send backup via e-mail](doc/email-backup.md)
* [Send GPS position to server](doc/gps-track.md)
* [Use WPA2 network with hotspot credentials](doc/hotspot-to-wpa.md)
+* [Create DNS records for IPSec peers](doc/ipsec-to-dns.md)
* [Update configuration on IPv6 prefix change](doc/ipv6-update.md)
* [Manage IP addresses with bridge status](doc/ip-addr-bridge.md)
* [Run other scripts on DHCP lease](doc/lease-script.md)
diff --git a/doc/dhcp-to-dns.md b/doc/dhcp-to-dns.md
index 22bf3bc..60eb29d 100644
--- a/doc/dhcp-to-dns.md
+++ b/doc/dhcp-to-dns.md
@@ -44,6 +44,7 @@ See also
* [Collect MAC addresses in wireless access list](collect-wireless-mac.md)
* [Comment DHCP leases with info from access list](dhcp-lease-comment.md)
+* [Create DNS records for IPSec peers](ipsec-to-dns.md)
* [Run other scripts on DHCP lease](lease-script.md)
---
diff --git a/doc/ipsec-to-dns.md b/doc/ipsec-to-dns.md
new file mode 100644
index 0000000..9a0f486
--- /dev/null
+++ b/doc/ipsec-to-dns.md
@@ -0,0 +1,46 @@
+Create DNS records for IPSec peers
+==================================
+
+[◀ Go back to main README](../README.md)
+
+🛈 This script can not be used on its own but requires the base installation.
+See [main README](../README.md) for details.
+
+Description
+-----------
+
+This script adds (and removes) dns records based on IPSec peers and their
+dynamic addresses from mode-config.
+
+Requirements and installation
+-----------------------------
+
+Just install the script:
+
+ $ScriptInstallUpdate ipsec-to-dns;
+
+This script is run from scheduler:
+
+ / system scheduler add interval=1m name=ipsec-to-dns on-event="/ system script run ipsec-to-dns;" start-time=startup;
+
+Configuration
+-------------
+
+On first run a disabled static dns record acting as marker (with comment
+"`--- ipsec-to-dns above ---`") is added. Move this entry to define where new
+entries are to be added.
+
+The configuration goes to `global-config-overlay`, these are the parameters:
+
+* `Domain`: the domain used for dns records
+* `HostNameInZone`: whether or not to add the ipsec/dns server's hostname
+* `PrefixInZone`: whether or not to add prefix `ipsec`
+
+See also
+--------
+
+* [Create DNS records for DHCP leases](dns-to-dhcp.md)
+
+---
+[◀ Go back to main README](../README.md)
+[▲ Go back to top](#top)
diff --git a/global-config b/global-config
index 77f41f6..a02d840 100644
--- a/global-config
+++ b/global-config
@@ -8,7 +8,7 @@
# Make sure all configuration properties are up to date and this
# value is in sync with value in script 'global-functions'!
-:global GlobalConfigVersion 50;
+:global GlobalConfigVersion 51;
# This is used for DNS and backup file.
:global Domain "example.com";
diff --git a/global-config-overlay b/global-config-overlay
index ac5e396..6ff1a9e 100644
--- a/global-config-overlay
+++ b/global-config-overlay
@@ -8,7 +8,7 @@
# Make sure all configuration properties are up to date and this
# value is in sync with value in script 'global-functions'!
# Comment or remove to disable news and change notifications.
-:global GlobalConfigVersion 50;
+:global GlobalConfigVersion 51;
# Copy configuration from global-config here and modify it.
diff --git a/global-config.changes b/global-config.changes
index 74af117..4bada85 100644
--- a/global-config.changes
+++ b/global-config.changes
@@ -54,6 +54,7 @@
48="Added support for overriding e-mail and Telegram settings for every script.";
49="Dropped '\$EmailBackupTo' & '\$EmailBackupCc' from configuration, use settings override if required.";
50="Added support for dynamic address update in 'netwatch-notify'.";
+ 51="Added 'ipsec-to-dns' to add DNS records for IPSec peers from mode-config.";
};
# Migration steps to be applied on script updates
diff --git a/global-functions b/global-functions
index 2626c36..92995c9 100644
--- a/global-functions
+++ b/global-functions
@@ -8,7 +8,7 @@
# https://git.eworm.de/cgit/routeros-scripts/about/
# expected configuration version
-:global ExpectedConfigVersion 50;
+:global ExpectedConfigVersion 51;
# global variables not to be changed by user
:global GlobalFunctionsReady false;
diff --git a/ipsec-to-dns b/ipsec-to-dns
new file mode 100644
index 0000000..bfdc807
--- /dev/null
+++ b/ipsec-to-dns
@@ -0,0 +1,68 @@
+#!rsc by RouterOS
+# RouterOS script: ipsec-to-dns
+# Copyright (c) 2021 Christian Hesse <mail@eworm.de>
+# https://git.eworm.de/cgit/routeros-scripts/about/COPYING.md
+#
+# and add/remove/update DNS entries from IPSec mode-config
+# https://git.eworm.de/cgit/routeros-scripts/about/doc/ipsec-to-dns.md
+
+:local 0 "ipsec-to-dns";
+:global GlobalFunctionsReady;
+:while ($GlobalFunctionsReady != true) do={ :delay 500ms; }
+
+:global Domain;
+:global HostNameInZone;
+:global Identity;
+:global PrefixInZone;
+
+:global CharacterReplace;
+:global LogPrintExit2;
+:global IfThenElse;
+
+:local Zone \
+ ([ $IfThenElse ($PrefixInZone = true) "ipsec." ] . \
+ [ $IfThenElse ($HostNameInZone = true) ($Identity . ".") ] . $Domain);
+:local Ttl 5m;
+:local CommentPrefix ("managed by " . $0 . " for ");
+:local CommentString ("--- " . $0 . " above ---");
+
+:if ([ :len [ / ip dns static find where comment=$CommentString name=- type=NXDOMAIN disabled ] ] = 0) do={
+ / ip dns static add comment=$CommentString name=- type=NXDOMAIN disabled=yes;
+ $LogPrintExit2 warning $0 ("Added disabled static dns record with comment '" . $CommentString . "'.") false;
+}
+:local PlaceBefore ([ / ip dns static find where comment=$CommentString name=- type=NXDOMAIN disabled ]->0);
+
+:foreach DnsRecord in=[ / ip dns static find where comment ~ $CommentPrefix ] do={
+ :local DnsRecordVal [ / ip dns static get $DnsRecord ];
+ :local PeerId [ $CharacterReplace ($DnsRecordVal->"comment") $CommentPrefix "" ];
+ :if ([ :len [ / ip ipsec active-peers find where id=$PeerId dynamic-address=($DnsRecordVal->"address") ] ] > 0) do={
+ $LogPrintExit2 debug $0 ("Peer " . $PeerId . " (" . $DnsRecordVal->"name" . ") still exists. Not deleting DNS entry.") false;
+ } else={
+ :local Found false;
+ $LogPrintExit2 info $0 ("Peer " . $PeerId . " (" . $DnsRecordVal->"name" . ") has gone, deleting DNS entry.") false;
+ / ip dns static remove $DnsRecord;
+ }
+}
+
+:foreach Peer in=[ / ip ipsec active-peers find where !(dynamic-address=[]) ] do={
+ :local PeerVal [ / ip ipsec active-peers get $Peer ];
+ :local Comment ($CommentPrefix . $PeerVal->"id");
+:put ($PeerVal->"id");
+ :local HostName [ :pick ($PeerVal->"id") 0 [ :find ($PeerVal->"id" . ".") "." ] ];
+:put $HostName;
+
+ :local Fqdn ($HostName . "." . $Zone);
+ :local DnsRecord [ / ip dns static find where name=$Fqdn ];
+ :if ([ :len $DnsRecord ] > 0) do={
+ :local DnsIp [ / ip dns static get $DnsRecord address ];
+ :if ($DnsIp = $PeerVal->"dynamic-address") do={
+ $LogPrintExit2 debug $0 ("DNS entry for " . $Fqdn . " does not need updating.") false;
+ } else={
+ $LogPrintExit2 info $0 ("Replacing DNS entry for " . $Fqdn . ", new address is " . $PeerVal->"dynamic-address" . ".") false;
+ / ip dns static set name=$Fqdn address=($PeerVal->"dynamic-address") ttl=$Ttl comment=$Comment $DnsRecord;
+ }
+ } else={
+ $LogPrintExit2 info $0 ("Adding new DNS entry for " . $Fqdn . ", address is " . $PeerVal->"dynamic-address" . ".") false;
+ / ip dns static add name=$Fqdn address=($PeerVal->"dynamic-address") ttl=$Ttl comment=$Comment place-before=$PlaceBefore;
+ }
+}