Page 1 of 1

IP Firewall NAT Script to change out-interface

Posted: Thu Jul 21, 2022 2:31 pm
by leemans
Hi All,
I need a script which gets the out-interface in a Firewall NAT rule into the CurrentOutInterface and then compare it with the CorrectOutInterface.
When the Interfaces doesn't match the out-interface in the NAT rule must be updated with the correct one.
The issue that I have is on the second line... can't get the out-interface value into the variable CurrentOutInterface.

:local CorrectOutInterface "<l2tp-Equispirit.Horses>";
:local CurrentOutInterface [/ip firewall nat get [find where comment="Scripted - Mask VPN data / L2TP Equi Interface will be added by Script !!!"]] out-interface];

:if ($CurrentOutInterface != $CorrectOutInterface) do={
/ip firewall nat set [find where comment="Scripted - Mask VPN data / L2TP Equi Interface will be added by Script !!!" ] out-interface=<l2tp-Equispirit.Horses>
***
Can somebody help to fix this issue.
Thanks P.

Re: IP Firewall NAT Script to change out-interface

Posted: Thu Jul 21, 2022 2:59 pm
by Zacharias
But why do you need to change the out interfaces ?

Re: IP Firewall NAT Script to change out-interface

Posted: Thu Jul 21, 2022 6:42 pm
by chechito
outgoing interface decision is a matter of routing, when you do src-NAT you only make address translation, when you do dst-NAT you change destination adress which can in fact changes outgoing interface but this really depends of routing table

Re: IP Firewall NAT Script to change out-interface

Posted: Fri Jul 22, 2022 9:59 am
by FramJamesgot
I'm currently using a dynamic DNS to accomplish this so external requests will hit a domain supplied by dynamic DNS and if the IP assigned to this domain goes down, I issue a command to update/switch the IP to the other interface. do you have a more elegant way of handling this?

Re: IP Firewall NAT Script to change out-interface

Posted: Wed Aug 10, 2022 11:03 am
by leemans
I need this out-interface because when the IP changes on the LTE device I lose the port in the bridge of my Router where to the LTE device makes VPN connection to.
When the L2TP connection is back up the interface does not automatically appears back in the bridge of my Router, it stays unknown until I update this record with the correct interface name.