请教 获取vpn认证失败的ip地址

xuxi3201

如果vpn拨入认证失败，就把这个ip加入黑名单一分钟。
。
请问，获取拨入ip地址

47771885

用计费的话可以很轻松的实现并且进行统计

cspm333

將連線ip抓到temp裡：

1. /ip firewall mangle
   
2. add action=jump chain=input connection-state=new dst-port=1723,443,1194 in-interface-list=WAN jump-target=vpn-point protocol=tcp
   
3. add action=jump chain=input connection-state=new dst-port=1701,500,4500 in-interface-list=WAN jump-target=vpn-point protocol=udp
   
4. add action=return chain=vpn-point src-address-list=VPN
   
5. add action=add-src-to-address-list address-list=temp address-list-timeout=2m chain= vpn-point src-address-list=!temp
   

复制代码

profile：有連線的從temp移除，並置入VPN

1. :do {/ip firewall address-list add list=VPN comment=mobile address=＄"caller-id" timeout=1d} on-error={}
   
2. :do {/ip firewall address-list remove [find list~"(temp|Scanners)" address=＄"caller-id" dynamic]} on-error={}
   

复制代码

帳號綁定profile：VPN


未在接觸後1分鐘內完成連線的遠端，停止1分鐘後才能繼續。

1. /ip firewall raw
   
2. add action=drop chain=prerouting src-address-list=Scanners

复制代码

驗證script：

1. :global vpn
   
2. :local connected [/ip firewall address-list find list=temp dynamic]
   
3. 
   
4. :local scanners 0
   
5. :foreach i in=$connected do={
   
6.   :if ([/ip firewall address-list get $i timeout]<0:1:0) do={
   
7.     :do {/ip firewall address-list add list=Scanners address=[get $i address] timeout=1m} on-error={}
   
8.     /ip firewall address-list remove $i ; :set scanners ($scanners+1)
   
9.   }
   
10. }
    
11. :if ([:len $connected]>$scanners) do={:set vpn ($vpn-1)}

复制代码

排程，每分鐘檢查一次：

1. :global vpn
   
2. :if ([:typeof $vpn]!="num") do={:set vpn 0}
   
3. 
   
4. :local check [/ip firewall mangle get [find src-address-list~"temp"] byte]
   
5. :if ($vpn!=$check) do={:set vpn $check ; /system script run vpn-server}
   

复制代码

actcs

这个工作应该让RADIUS来做，不应该让接入路由器承担这个压力