Hi,

We have a a firewall setting to protect our routers from ssh, pptp, and web attacks.
It checks if an ip is on a whitelist, and if its not when it does more then 2 failed login attempts within one minute, the ip is added to a blacklist and dropped.

However, we have routers that function as pptp servers and i want to find a way to prevent established pptp clients from ever getting on the blacklist.
In my eyes the easiest way is to run a script that checks the established pptp tunnels and adds the client addresses to a whitelist.
Has anyone got a script for this, or does someone know the command to print the client addresses so i can write a script to put them on the whitelist? gives me a list of established clients and their client ip addresses
but how do i get the router to print a list of only the client addresses?

BR.

Ammer

check this

ros code

/ppp active 
	:foreach i in=[find] do={
		:local ip [get value-name=address $i]
			/ip firewall address-list add list=pptp-whitelist address=$ip
		}