Mikrotik RouterOS ipv6-npt脚本

admin

1. #!rsc by RouterOS
   
2. #
   
3. # Set up NPTv6.
   
4. #
   
5. # GUA prefix is reserved by allocating a network from $argWanPool
   
6. # on $argLoopbackInt. Once GUA network is available, its address-prefix
   
7. # is used to set up mangling rules to perform network prefix translation
   
8. # with addresses from $argUlaPool.
   
9. #
   
10. # Since mangling is performed after connection tracking, all mangled packets
    
11. # continue processing with connection-state=invalid. Thus raw rules are added
    
12. # to mark these packets for notrack. Adjust your filter rules accordingly.
    
13. #
    
14. # Optional arg*Extra can be used to further narrow matching criteria.
    
15. # E.g. to perform translation only when the packet is routed through WAN:
    
16. #
    
17. #   :global argSnptMangleExtra {"out-interface-list"="WAN"}
    
18. #
    
19. #
    
20. # Arguments:
    
21. #   argLoopbackInt (str): name of the loopback interface
    
22. #   argWanPool (str): name of the WAN pool
    
23. #   argUlaPool (str): name of the ULA pool
    
24. #   argManagedID (str): regex-escaped unique ID of the managed objects
    
25. #   [argSnptMangleExtra] (array): Optional extra properties for the SNPT mangle rule
    
26. #   [argDnptMangleExtra] (array): Optional extra properties for the DNPT mangle rule
    
27. #   [argSnptRawExtra] (array): Optional extra properties for the SNPT raw rule
    
28. #   [argDnptRawExtra] (array): Optional extra properties for the DNPT raw rule
    
29. #
    
30. #
    
31. # Affects:
    
32. #   /ipv6/address
    
33. #   /ipv6/firewall/mangle
    
34. #   /ipv6/firewall/raw
    
35. #
    
36. #
    
37. # Requirements:
    
38. #   - mod/ipv6-functions
    
39. 
    
40. :global GlobalFunctionsReady;
    
41. :while ($GlobalFunctionsReady != true) do={ :delay 500ms; }
    
42. 
    
43. 
    
44. :local SetupRules do={
    
45.     :global argLoopbackInt
    
46.     :global argWanPool
    
47.     :global argManagedID
    
48.     :global argSnptMangleExtra
    
49.     :global argDnptMangleExtra
    
50.     :global argSnptRawExtra
    
51.     :global argDnptRawExtra
    
52. 
    
53.     :global WaitIP6Address
    
54.     :global SetIfExistsElseAdd
    
55.     :global SetIfExistsElseAddUnlessEqual
    
56. 
    
57.     $SetIfExistsElseAddUnlessEqual /ipv6/address\
    
58.         ({"comment~"$argManagedID\\\$""})\
    
59.         ({\
    
60.             interface="$argLoopbackInt";\
    
61.             advertise=false;\
    
62.             "from-pool"="$argWanPool"\
    
63.         })\
    
64.         ({\
    
65.             interface=$argLoopbackInt;\
    
66.             advertise="no";\
    
67.             "from-pool"=$argWanPool;\
    
68.             comment=""Managed: NPTv6 / $argManagedID""\
    
69.         })
    
70.     :local varGuaPrefix [$WaitIP6Address $argLoopbackInt $2 ("$argManagedID\$")]
    
71. 
    
72.     $SetIfExistsElseAdd /ipv6/firewall/mangle\
    
73.         ({"comment~"snpt-$argManagedID\\\$""})\
    
74.         ($argSnptMangleExtra , {\
    
75.             chain="postrouting";\
    
76.             action="snpt";\
    
77.             "src-address"=$1;\
    
78.             "src-prefix"=$1;\
    
79.             "dst-prefix"=$varGuaPrefix;\
    
80.             comment=""Managed: NPTv6 / snpt-$argManagedID""\
    
81.         })
    
82. 
    
83.     $SetIfExistsElseAdd /ipv6/firewall/mangle\
    
84.         ({"comment~"dnpt-$argManagedID\\\$""})\
    
85.         ($argDnptMangleExtra , {\
    
86.             chain="prerouting";\
    
87.             action="dnpt";\
    
88.             "dst-address"=$varGuaPrefix;\
    
89.             "src-prefix"=$varGuaPrefix;\
    
90.             "dst-prefix"=$1;\
    
91.             comment=""Managed: NPTv6 / dnpt-$argManagedID""\
    
92.         })
    
93. 
    
94.     $SetIfExistsElseAdd /ipv6/firewall/raw\
    
95.         ({"comment~"snpt-$argManagedID\\\$""})\
    
96.         ($argSnptRawExtra , {\
    
97.             chain="prerouting";\
    
98.             action="notrack";\
    
99.             "src-address"=$1;\
    
100.             comment=""Managed: NPTv6 / snpt-$argManagedID""\
     
101.         })
     
102. 
     
103.     $SetIfExistsElseAdd /ipv6/firewall/raw\
     
104.         ({"comment~"dnpt-$argManagedID\\\$""})\
     
105.         ($argDnptRawExtra , {\
     
106.             chain="prerouting";\
     
107.             action="notrack";\
     
108.             "dst-address"=$varGuaPrefix;\
     
109.             comment=""Managed: NPTv6 / dnpt-$argManagedID""\
     
110.         })
     
111. }
     
112. 
     
113. :local TearDown do={
     
114.     :global argManagedID
     
115.     /ipv6/address/remove [find comment~"$argManagedID\$"]
     
116.     /ipv6/firewall/mangle/remove [find comment~"$argManagedID\$"]
     
117.     /ipv6/firewall/raw/remove [find comment~"$argManagedID\$"]
     
118. }
     
119. 
     
120. :global LogPrint
     
121. :global AssertNotEmpty
     
122. 
     
123. :global argLoopbackInt
     
124. :global argWanPool
     
125. :global argUlaPool
     
126. :global argManagedID
     
127. 
     
128. $AssertNotEmpty "argLoopbackInt" $argLoopbackInt
     
129. $AssertNotEmpty "argWanPool" $argWanPool
     
130. $AssertNotEmpty "argUlaPool" $argUlaPool
     
131. $AssertNotEmpty "argManagedID" $argManagedID
     
132. 
     
133. 
     
134. /ipv6/pool
     
135. :local varWanPrefix [get value-name=prefix $argWanPool]
     
136. :local varUlaPrefix [get value-name=prefix $argUlaPool]
     
137. 
     
138. :do {
     
139.     $SetupRules $varUlaPrefix $varWanPrefix
     
140.     $LogPrint info $0 ("Add NPT: $varUlaPrefix <-> $varWanPrefix")
     
141. } on-error={
     
142.     $LogPrint warning $0 ("Failed to update NPTv6, retrying from scratch")
     
143.     :do {
     
144.         $TearDown
     
145.         $SetupRules $varUlaPrefix $varWanPrefix
     
146.     } on-error={
     
147.         $TearDown
     
148.         $LogPrint error $0 ("Failed to set up NPTv6")
     
149.         :error "fatal error in ipv6-npt.rsc"
     
150.     }
     
151. }

复制代码