@usex/mikrotik-mcp 3.22.0 → 3.24.0

package/schemas/tools/create_filter_rule.json

@@ -63,6 +63,130 @@
       "description": "RouterOS flag expression e.g. \"syn,!ack\"",
       "type": "string"
     },
+    "src_mac_address": {
+      "description": "Source MAC, supports ! and mask e.g. \"00:11:...\"",
+      "type": "string"
+    },
+    "in_interface_list": {
+      "description": "Match by inbound interface list name",
+      "type": "string"
+    },
+    "out_interface_list": {
+      "description": "Match by outbound interface list name",
+      "type": "string"
+    },
+    "port": {
+      "description": "Match src OR dst port(s) (protocol-agnostic)",
+      "type": "string"
+    },
+    "connection_mark": {
+      "description": "Match packets with this connection mark",
+      "type": "string"
+    },
+    "packet_mark": {
+      "description": "Match packets with this packet mark",
+      "type": "string"
+    },
+    "routing_mark": {
+      "description": "Match packets with this routing mark",
+      "type": "string"
+    },
+    "connection_type": {
+      "description": "Conntrack helper type e.g. \"ftp,sip\"",
+      "type": "string"
+    },
+    "connection_bytes": {
+      "description": "Total conn bytes range e.g. \"1000000-0\"",
+      "type": "string"
+    },
+    "connection_limit": {
+      "description": "Per-address conn limit e.g. \"100,32\"",
+      "type": "string"
+    },
+    "connection_rate": {
+      "description": "Connection rate range e.g. \"0-100k\"",
+      "type": "string"
+    },
+    "content": {
+      "description": "Match a literal string in the packet payload",
+      "type": "string"
+    },
+    "dscp": {
+      "description": "Match DSCP/TOS value 0-63",
+      "type": "string"
+    },
+    "layer7_protocol": {
+      "description": "Match a /ip firewall layer7-protocol name",
+      "type": "string"
+    },
+    "packet_size": {
+      "description": "Packet size or range in bytes e.g. \"0-1500\"",
+      "type": "string"
+    },
+    "ipsec_policy": {
+      "description": "IPsec policy match e.g. \"in,ipsec\" or \"out,none\"",
+      "type": "string"
+    },
+    "ttl": {
+      "description": "TTL match e.g. \"equal:64\" or \"less-than:5\"",
+      "type": "string"
+    },
+    "nth": {
+      "description": "Match every Nth packet e.g. \"2,1\"",
+      "type": "string"
+    },
+    "time": {
+      "description": "Time/day match e.g. \"8h-16h,mon,tue,wed\"",
+      "type": "string"
+    },
+    "random": {
+      "description": "Match a packet randomly with given probability (1-99)",
+      "type": "string"
+    },
+    "tcp_mss": {
+      "description": "TCP MSS match e.g. \"1300-1536\" or \"!1460\"",
+      "type": "string"
+    },
+    "fragment": {
+      "description": "Match non-first IP fragments",
+      "type": "boolean"
+    },
+    "src_address_type": {
+      "description": "Source address type e.g. \"unicast\",\"local\"",
+      "type": "string"
+    },
+    "dst_address_type": {
+      "description": "Dest address type e.g. \"broadcast\",\"multicast\"",
+      "type": "string"
+    },
+    "hotspot": {
+      "description": "Hotspot match e.g. \"auth\",\"from-client\",\"local-dst\"",
+      "type": "string"
+    },
+    "icmp_options": {
+      "description": "ICMP type:code match e.g. \"8:0\"",
+      "type": "string"
+    },
+    "priority": {
+      "description": "Match packets by priority (0-63) set internally",
+      "type": "string"
+    },
+    "jump_target": {
+      "description": "Target chain name when action=jump",
+      "type": "string"
+    },
+    "reject_with": {
+      "description": "ICMP/TCP reject response when action=reject",
+      "type": "string"
+    },
+    "address_list": {
+      "description": "List name for add-src-to-address-list / add-dst-to-address-list actions",
+      "type": "string"
+    },
+    "address_list_timeout": {
+      "description": "Timeout for the address-list entry e.g. \"1d\" or \"none\"",
+      "type": "string"
+    },
     "comment": {
       "type": "string"
     },

package/schemas/tools/create_gre_tunnel.json

@@ -28,6 +28,18 @@
       "description": "Clamp TCP MSS to the tunnel MTU",
       "type": "boolean"
     },
+    "allow_fast_path": {
+      "description": "Allow FastPath processing for this tunnel",
+      "type": "boolean"
+    },
+    "ipsec_secret": {
+      "description": "Pre-shared key to auto-create an IPsec policy securing the tunnel",
+      "type": "string"
+    },
+    "dscp": {
+      "description": "DSCP for encapsulated packets: 'inherit' or 0-63",
+      "type": "string"
+    },
     "mtu": {
       "type": "integer",
       "minimum": -9007199254740991,

package/schemas/tools/create_ipip_tunnel.json

@@ -19,6 +19,27 @@
       "description": "Keepalive interval/retries, e.g. '10s,3'",
       "type": "string"
     },
+    "dont_fragment": {
+      "description": "Don't-fragment behavior",
+      "type": "string",
+      "enum": ["inherit", "no"]
+    },
+    "clamp_tcp_mss": {
+      "description": "Clamp TCP MSS to the tunnel MTU",
+      "type": "boolean"
+    },
+    "allow_fast_path": {
+      "description": "Allow FastPath processing for this tunnel",
+      "type": "boolean"
+    },
+    "ipsec_secret": {
+      "description": "Pre-shared key to auto-create an IPsec policy securing the tunnel",
+      "type": "string"
+    },
+    "dscp": {
+      "description": "DSCP for encapsulated packets: 'inherit' or 0-63",
+      "type": "string"
+    },
     "mtu": {
       "type": "integer",
       "minimum": -9007199254740991,

package/schemas/tools/create_ipsec_identity.json

@@ -23,6 +23,11 @@
     "remote_id": {
       "type": "string"
     },
+    "match_by": {
+      "description": "How the remote peer is matched to this identity",
+      "type": "string",
+      "enum": ["remote-id", "certificate"]
+    },
     "generate_policy": {
       "type": "string",
       "enum": ["no", "port-override", "port-strict"]
@@ -36,10 +41,26 @@
     "certificate": {
       "type": "string"
     },
+    "remote_certificate": {
+      "description": "Remote peer's certificate name (rsa/digital-signature auth)",
+      "type": "string"
+    },
+    "eap_methods": {
+      "description": "EAP method(s), e.g. 'eap-tls' (eap auth)",
+      "type": "string"
+    },
+    "notrack_chain": {
+      "description": "Raw firewall chain to bypass connection tracking for matched traffic",
+      "type": "string"
+    },
     "comment": {
       "type": "string"
+    },
+    "disabled": {
+      "default": false,
+      "type": "boolean"
     }
   },
-  "required": ["peer", "auth_method"],
+  "required": ["peer", "auth_method", "disabled"],
   "additionalProperties": false
 }

package/schemas/tools/create_ipsec_peer.json

@@ -24,6 +24,12 @@
     "local_address": {
       "type": "string"
     },
+    "port": {
+      "description": "UDP port for IKE negotiation (default 500)",
+      "type": "integer",
+      "minimum": -9007199254740991,
+      "maximum": 9007199254740991
+    },
     "passive": {
       "description": "Passive (responder only)",
       "type": "boolean"

package/schemas/tools/create_ipsec_policy.json

@@ -11,10 +11,22 @@
       "description": "Source subnet, e.g. '10.0.0.0/24'",
       "type": "string"
     },
+    "src_port": {
+      "description": "Source port to match (0 = any)",
+      "type": "integer",
+      "minimum": -9007199254740991,
+      "maximum": 9007199254740991
+    },
     "dst_address": {
       "description": "Destination subnet, e.g. '10.0.1.0/24'",
       "type": "string"
     },
+    "dst_port": {
+      "description": "Destination port to match (0 = any)",
+      "type": "integer",
+      "minimum": -9007199254740991,
+      "maximum": 9007199254740991
+    },
     "protocol": {
       "type": "string"
     },
@@ -42,14 +54,28 @@
     "sa_dst_address": {
       "type": "string"
     },
+    "priority": {
+      "description": "Policy ordering priority",
+      "type": "integer",
+      "minimum": -9007199254740991,
+      "maximum": 9007199254740991
+    },
     "template": {
       "description": "Policy template (for dynamic policies)",
       "type": "boolean"
     },
+    "group": {
+      "description": "Policy template group (when template=true)",
+      "type": "string"
+    },
     "comment": {
       "type": "string"
+    },
+    "disabled": {
+      "default": false,
+      "type": "boolean"
     }
   },
-  "required": ["action", "tunnel"],
+  "required": ["action", "tunnel", "disabled"],
   "additionalProperties": false
 }

package/schemas/tools/create_ipsec_profile.json

@@ -21,6 +21,10 @@
       "description": "Hash algorithm, e.g. 'sha256'",
       "type": "string"
     },
+    "prf_algorithm": {
+      "description": "PRF algorithm, e.g. 'auto' or 'sha256'",
+      "type": "string"
+    },
     "lifetime": {
       "description": "Phase-1 lifetime, e.g. '1d'",
       "type": "string"

package/schemas/tools/create_ipsec_proposal.json

@@ -25,8 +25,12 @@
     "lifetime": {
       "description": "Phase-2 lifetime, e.g. '30m'",
       "type": "string"
+    },
+    "disabled": {
+      "default": false,
+      "type": "boolean"
     }
   },
-  "required": ["name", "auth_algorithms", "enc_algorithms", "pfs_group"],
+  "required": ["name", "auth_algorithms", "enc_algorithms", "pfs_group", "disabled"],
   "additionalProperties": false
 }

package/schemas/tools/create_ipv6_dhcp_server.json

@@ -34,6 +34,18 @@
       "minimum": -9007199254740991,
       "maximum": 9007199254740991
     },
+    "use_radius": {
+      "description": "Authenticate clients via RADIUS",
+      "type": "boolean"
+    },
+    "allow_dual_stack_queue": {
+      "description": "Share a simple queue with the client's IPv4 DHCP lease",
+      "type": "boolean"
+    },
+    "parent_queue": {
+      "description": "Parent queue for dynamically created simple queues",
+      "type": "string"
+    },
     "dhcp_option": {
       "description": "Custom DHCPv6 option names",
       "type": "array",

package/schemas/tools/create_ipv6_filter_rule.json

@@ -18,7 +18,9 @@
         "passthrough",
         "return",
         "tarpit",
-        "fasttrack-connection"
+        "fasttrack-connection",
+        "add-src-to-address-list",
+        "add-dst-to-address-list"
       ]
     },
     "src_address": {
@@ -70,6 +72,126 @@
       "description": "RouterOS flag expression e.g. \"syn,!ack\"",
       "type": "string"
     },
+    "port": {
+      "description": "Match src or dst port (any protocol with ports)",
+      "type": "string"
+    },
+    "icmp_options": {
+      "description": "ICMPv6 type:code e.g. \"128:0\"",
+      "type": "string"
+    },
+    "connection_mark": {
+      "description": "Match packets with this connection mark",
+      "type": "string"
+    },
+    "connection_type": {
+      "description": "Match connection helper type e.g. \"ftp\", \"sip\"",
+      "type": "string"
+    },
+    "connection_bytes": {
+      "description": "Match total connection bytes range e.g. \"1000000-\"",
+      "type": "string"
+    },
+    "connection_limit": {
+      "description": "Limit connections per address e.g. \"100,128\"",
+      "type": "string"
+    },
+    "connection_rate": {
+      "description": "Match connection data rate e.g. \"100k-\"",
+      "type": "string"
+    },
+    "packet_mark": {
+      "description": "Match packets with this packet mark",
+      "type": "string"
+    },
+    "routing_mark": {
+      "description": "Match packets with this routing mark",
+      "type": "string"
+    },
+    "packet_size": {
+      "description": "Match packet size range e.g. \"1400-1500\"",
+      "type": "string"
+    },
+    "dscp": {
+      "description": "Match DSCP (0-63)",
+      "type": "string"
+    },
+    "ingress_priority": {
+      "description": "Match ingress priority (0-63)",
+      "type": "string"
+    },
+    "priority": {
+      "description": "Match priority set by mangle (0-63)",
+      "type": "string"
+    },
+    "src_mac_address": {
+      "description": "Match source MAC address",
+      "type": "string"
+    },
+    "src_address_type": {
+      "description": "Match src address type e.g. \"unicast\", \"multicast\"",
+      "type": "string"
+    },
+    "dst_address_type": {
+      "description": "Match dst address type e.g. \"unicast\", \"multicast\"",
+      "type": "string"
+    },
+    "tcp_mss": {
+      "description": "Match TCP MSS value/range e.g. \"1300-1536\"",
+      "type": "string"
+    },
+    "headers": {
+      "description": "Match IPv6 extension headers present in the packet",
+      "type": "string"
+    },
+    "tls_host": {
+      "description": "Match TLS SNI host (glob pattern)",
+      "type": "string"
+    },
+    "content": {
+      "description": "Match packets containing this text",
+      "type": "string"
+    },
+    "nth": {
+      "description": "Match every Nth packet e.g. \"2,0\"",
+      "type": "string"
+    },
+    "random": {
+      "description": "Randomly match a percentage of packets (1-99)",
+      "type": "string"
+    },
+    "time": {
+      "description": "Match by time/day e.g. \"8h-16h,mon,tue\"",
+      "type": "string"
+    },
+    "dst_limit": {
+      "description": "Per-destination rate limit e.g. \"10,5,dst-address\"",
+      "type": "string"
+    },
+    "ipsec_policy": {
+      "description": "Match IPsec policy e.g. \"in,ipsec\" or \"out,none\"",
+      "type": "string"
+    },
+    "per_connection_classifier": {
+      "description": "Hash connections into buckets e.g. \"both-addresses:2/0\"",
+      "type": "string"
+    },
+    "jump_target": {
+      "description": "Target chain name when action=jump",
+      "type": "string"
+    },
+    "reject_with": {
+      "description": "ICMPv6 reject response when action=reject e.g. \"icmp-admin-prohibited\"",
+      "type": "string"
+    },
+    "address_list": {
+      "description": "Address-list name when action=add-src/dst-to-address-list",
+      "type": "string"
+    },
+    "address_list_timeout": {
+      "description": "Timeout for the added address-list entry e.g. \"1d\" or \"none\"",
+      "type": "string"
+    },
     "comment": {
       "type": "string"
     },

package/schemas/tools/create_ipv6_mangle_rule.json

@@ -42,11 +42,130 @@
       "type": "string"
     },
     "in_interface": {
+      "description": "Negatable, e.g. \"!ether1\"",
       "type": "string"
     },
     "out_interface": {
       "type": "string"
     },
+    "in_interface_list": {
+      "description": "Interface list, negatable e.g. \"!WAN\"",
+      "type": "string"
+    },
+    "out_interface_list": {
+      "type": "string"
+    },
+    "src_address_list": {
+      "description": "Match src in a named list; negate \"!name\"",
+      "type": "string"
+    },
+    "dst_address_list": {
+      "description": "Match dst in a named list; negate \"!name\"",
+      "type": "string"
+    },
+    "src_address_type": {
+      "description": "e.g. \"unicast\", \"local\", \"!local\"",
+      "type": "string"
+    },
+    "dst_address_type": {
+      "type": "string"
+    },
+    "src_mac_address": {
+      "description": "Source MAC, negatable e.g. \"!00:11:...\"",
+      "type": "string"
+    },
+    "port": {
+      "description": "Match if src OR dst port matches (with protocol)",
+      "type": "string"
+    },
+    "connection_state": {
+      "description": "e.g. \"new\", \"established,related\", \"!invalid\"",
+      "type": "string"
+    },
+    "connection_type": {
+      "description": "Helper, e.g. \"sip\", \"ftp\"",
+      "type": "string"
+    },
+    "connection_bytes": {
+      "description": "e.g. \"1000000-0\" (>1 MB connections)",
+      "type": "string"
+    },
+    "connection_limit": {
+      "description": "e.g. \"100,128\"",
+      "type": "string"
+    },
+    "connection_rate": {
+      "description": "e.g. \"100k-1M\"",
+      "type": "string"
+    },
+    "per_connection_classifier": {
+      "description": "PCC for load balancing, e.g. \"both-addresses:2/0\"",
+      "type": "string"
+    },
+    "tcp_flags": {
+      "description": "RouterOS flag expression e.g. \"syn,!ack\"",
+      "type": "string"
+    },
+    "tcp_mss": {
+      "description": "Match TCP MSS, e.g. \"1400-1500\" or \"!1460\"",
+      "type": "string"
+    },
+    "icmp_options": {
+      "description": "Match ICMPv6 type:code, e.g. \"128:0\"",
+      "type": "string"
+    },
+    "packet_size": {
+      "description": "e.g. \"1500\" or \"0-500\"",
+      "type": "string"
+    },
+    "dscp": {
+      "description": "Match incoming DSCP (0-63)",
+      "type": "string"
+    },
+    "priority": {
+      "description": "Match packet/queue priority (0-63)",
+      "type": "string"
+    },
+    "ingress_priority": {
+      "description": "Match ingress (VLAN/MPLS) priority (0-63)",
+      "type": "string"
+    },
+    "ipsec_policy": {
+      "description": "e.g. \"in,ipsec\" or \"out,none\"",
+      "type": "string"
+    },
+    "nth": {
+      "description": "e.g. \"2,1\" — every 2nd packet",
+      "type": "string"
+    },
+    "random": {
+      "description": "Match a random N% of packets (1-99)",
+      "type": "string"
+    },
+    "time": {
+      "description": "e.g. \"8h-16h,mon,tue,wed,thu,fri\"",
+      "type": "string"
+    },
+    "hop_limit": {
+      "description": "Match hop-limit, e.g. \"equal:64\", \"less-than:10\"",
+      "type": "string"
+    },
+    "content": {
+      "description": "Match packets containing this text",
+      "type": "string"
+    },
+    "headers": {
+      "description": "Match IPv6 extension headers, e.g. \"hop:contains\"",
+      "type": "string"
+    },
+    "limit": {
+      "description": "Rate limit matcher, e.g. \"50,5:packet\"",
+      "type": "string"
+    },
+    "dst_limit": {
+      "description": "Per-destination rate matcher, e.g. \"50,5,dst-address/1m\"",
+      "type": "string"
+    },
     "connection_mark": {
       "type": "string"
     },
@@ -66,12 +185,33 @@
       "type": "string"
     },
     "new_dscp": {
+      "description": "0-63, for change-dscp",
       "type": "string"
     },
     "new_hop_limit": {
       "description": "e.g. \"decrement\", \"increment\", or \"set:64\"",
       "type": "string"
     },
+    "new_mss": {
+      "description": "e.g. \"1440\" or \"clamp-to-pmtu\", for change-mss",
+      "type": "string"
+    },
+    "new_priority": {
+      "description": "e.g. \"4\" or \"from-dscp\", for set-priority",
+      "type": "string"
+    },
+    "jump_target": {
+      "description": "Target chain name for action=jump",
+      "type": "string"
+    },
+    "sniff_target": {
+      "description": "TZSP collector IP for action=sniff-tzsp",
+      "type": "string"
+    },
+    "sniff_target_port": {
+      "description": "TZSP collector UDP port for sniff-tzsp",
+      "type": "string"
+    },
     "passthrough": {
       "type": "boolean"
     },