Community discussions

MikroTik App
 
BrandonSk
newbie
Topic Author
Posts: 45
Joined: Wed May 06, 2015 12:21 am

Enable firewall rule via SSH

Mon Dec 25, 2017 12:07 am

Hello all,

I am trying to enable a firewall rule via ssh, but for some reason this is not working.
What I have:
-> a user who can ssh into the mikrotik box (let's call him autobot)
-> the user uses ssh key for authentication (passwordless, because it's run from script)
-> for testing purposes the autobot user for now belongs to the "full" group

What IS working:
-> ssh login is working, I can login into the mikrotik and execute commands
-> once logged in I can enable the firewall rule by running:
/ip firewall nat enable [/ip firewall nat find comment="enable me"]
-> I can run a command as a direct input of the ssh command, for example
ssh -i autobot_private_rsa autobot@10.10.10.1 /system script add name=test
(creates an empty script named test)

What IS NOT working:
-> when I try to execute the enable firewall rule command from above as a direct input of the ssh
ssh -i autobot_private_rsa autobot@10.10.10.1 /ip firewall nat enable [/ip firewall nat find comment="enable me"]
I was searching the web but I could not find a similar issue mentioned anywhere. Most searches lead to links dealing with enabling ssh access and similar.
Reading through the wiki I did not find a note which would mention that such operation is not allowed via ssh (I thought it could be perhaps disallowed for security reasons), but maybe I've missed it.

So now I am stuck. In console it works, but direct execution via ssh not (but other commands do work this way).
Your help is appreciated!

EDIT:
Seems that there is a parsing problem or perhaps I need to escape something.
If I change the comment to "enable_me", then everything works as expected.
So, if I replace spaces with underscores, then it is ok.
But still would like to know how this could be done with comments containing spaces.


Thank you,
Brandon.
 
BrandonSk
newbie
Topic Author
Posts: 45
Joined: Wed May 06, 2015 12:21 am

Re: Enable firewall rule via SSH  [SOLVED]

Mon Dec 25, 2017 2:19 am

OK, so it turns out to be a linux quoting issue rather than mikrotik related one.

So for anyone coming across the smae thing, here is how to get it working with comments containing spaces as well.

As I am running the line from a shell script, I defined variable for the command part (note that comment quotes need to be escaped):
STR="/ip firewall nat enable [/ip firewall nat find comment=\"enable me\"]"
ssh -i autobot_private_rsa autobot@10.10.10.1 "${STR}"
Cheers everyone.
B.