Syed Jahanzaib Personal Blog to Share Knowledge !

January 10, 2013

Mikrotik: Netwatch Script to Detect Target Server Link & Act Accordingly

Filed under: Mikrotik Related — Tags: , , — Syed Jahanzaib / Pinochio~:) @ 9:16 AM


Someone requested me to create a script that can check Squid Proxy or Target Server Link state from Mikrotik, and if the Squid Proxy / Target Server is not responding, then it should Disable the redirect NAT rule so all load can be handle by Mikrotik.You can modify this script as per your requirements. you can modify it to check WAN link, and if the WAN link is down, it can trigger SMS Script / Sound Alaram, or shift to backup WAN link by enabling diabling ROUTE’s or it can also be used to detect any wan link failure detection and change the rules accordingly.
Possibilities are endless.
So here it is.

[for ver 5.x]

Adding Comments in Redirect Rule

First add comments in required NAT rule, i.e Rule that redirects port 80 traffic to squid. You can also disable/enable rules based on the numbers, BUT its not recommended BECAUSE if you add any new rule and move it somewhere, all your scripts will disable/enable wrong rules, that is why you have to use find command and get rules this way.

You can use GUI to add comment in the rule, I am showing you an example below . . .
/ip firewall nat
add action=dst-nat chain=dstnat comment=”Redirect to SQUID” disabled=no dst-port=80 protocol=tcp to-addresses= to-ports=8080

add action=masquerade chain=srcnat comment=”Default NAT Rule for Internet Access / zaib” disabled=no to-addresses=

1- nat rule

Change the host ip address as your local requirements. Its jsut an example to show you.



Adding EMAIL account in mikrotik

/tool e-mail set address= password=your_password port=587 start-tls=no user=your_gmailid

Adding Scripts to Enable/Disable Rule

After adding comments in the dst-nt rule, you have to create two scripts that can enable and disable the dst-nat rule. We can name them UP and DOWN.
 Copy paste the below scripts on Mikrotik Terminal. It will create two scripts in System/Scripts with the name of UP and DOWN.


:log info "Squid Proxy Server is not responding. Please Check Connectivity"
/ip firewall nat disable [find comment="Redirect to SQUID"]
:log info "Emailing the DOWN status. . . "
#/tool e-mail send to="" password=yourgmailid subject="Squid Proxy Server is not responding. Please Check Connectivity"  body="Squid Proxy Server is not responding. Please Check Connectivity" server= tls=yes


:log info "Squid Proxy Server is OK."
/ip firewall nat enable [find comment="Redirect to SQUID"]
:log info "Emailing the UP status. . . "
#/tool e-mail send to="" password=yourgmailid subject="Squid Proxy Server is OK."  body="Squid Proxy Server is OK." server= tls=yes

2- Script-List


Adding NETWATCH to monitor Target Server [Squid] Link Detection

Use the below script to add netwatch entry for squid / target server link detection. It will also add the UP and DOWN script for the appropriate action. For example. When the target server link is down, it will execute script DOWN which will disable the NAT redirect rule , when the target server link is up and working, it will execute the UP script which will re-enable the redirect rule.

/tool netwatch
add comment=”Netwatch to Check SQUID Server Link state / zaib” disabled=no down-script=”/sys script run down” host= interval=5m timeout=1s \
    up-script=”/sys script run up”

3 - Squid Link Detection

(Replace the host ip to match your local target server ip)



Testing THE Scripts . . .   :)~

Now test the scripts, Unplug the Target Server LAN link, and you will see something like below in the LOG.

4- link down


Now plugin the Target Server LAN link, and you will see something like below in the LOG.

5- link up



[For Ver 6.x]

Netwatch base monitoring for local server. copy paste following and modify necessary information before enabling this rule.


First setup EMAIL config.

/tool e-mail
set address= last-status=succeeded password=GMAIL_PASSWORD port=587 start-tls=yes user=YOUR_GMAILID


Now add the netwatch script … You can simply copy paste the script, modify it before pasting …

/tool netwatch
add down-script=":log warning \"Squid Proxy Server is not responding. Please C\
    heck Connectivity . . . \"\r\
    \n:global sub1 ([/system identity get name])\r\
    \n:global sub2 ([/system clock get time])\r\
    \n:global sub3 ([/system clock get date])\r\
    \n:global adminmail1\r\
    \n:global gmailid\r\
    \n:global gmailpwd  GMAIL_PASSWORD\r\
    \n:global gmailsmtp\r\
    \n:set gmailsmtp [:resolve \"\"];\r\
    \n# ENABLING SQUID Redirect Rule\r\
    \n/ip firewall nat disable [find comment=\"Redirect to SQUID\"]\r\
    \n/tool e-mail send to=\$adminmail1 password=\$gmailpwd subject=\"\$sub3 \
    \$sub2 \$sub1 SQUID IS DOWN ... DISABLING NAT RULE\" from=\$gmailid server\
    =\$gmailip start-tls=yes  body=\"Squid Proxy Server is not responding. Ple\
    ase Check Connectivity\"" host= interval=10s timeout=3s \
    up-script=":log warning \"Squid Proxy Server is UP. Enalbing REDIRECT NAT \
    rule  . . . \"\r\
    \n:global sub1 ([/system identity get name])\r\
    \n:global sub2 ([/system clock get time])\r\
    \n:global sub3 ([/system clock get date])\r\
    \n:global adminmail1\r\
    \n:global gmailid\r\
    \n:global gmailpwd  GMAIL_PASSWORD\r\
    \n:global gmailsmtp\r\
    \n:set gmailsmtp [:resolve \"\"];\r\
    \n# Disabling SQUID Redirect Rule\r\
    \n/ip firewall nat disable [find comment=\"Redirect to SQUID\"]\r\
    \n/tool e-mail send to=\$adminmail1 password=\$gmailpwd subject=\"\$sub3 \
    \$sub2 \$sub1 Squid Proxy Server is OK UP. Enabling REDIRECT NAT rule\" fr\
    om=\$gmailid server=\$gmailsmtp start-tls=yes  body=\"Squid Proxy Server i\
    s UP. Enalbing REDIRECT NAT rule\"\r\


It will add the netwatch script, and will monitor your local server and will email you as well. Modify it before using it




Following script [] will check SQUID service status , and if it found squid stop, it will start it auto, if the squid is already running , it will do nothing :)

First create file in any folder or temp folder by

mkdir /temp
touch /temp/
chmod +x  /temp/

Now edit this file

nano /temp/

& paste the following code

pid=`pidof squid`
if [ "$pid" == "" ]; then
echo -e "SQUID service is NOT running, Trying to start using SERVICE command  (( IF squid is installed via apt-get or yum ))  . . ."
service squid start

# or if squid is compiled then use simple command to start squid
echo -e "Now, Trying to start using squid command ( IF Squid is Compiled from the source)  . . ."
echo You should now see the squid process below ...
echo .
sleep 3
ps aux |grep squid
echo SQUID service is Running OK , no further action required, EXITING  . . . You should see Squid process below ...
ps aux |grep squid

Save & Exit.

Test it by running


You can check any service status with above command, if the service is not running , it will try to start with.

You can create its cron entry to run it after every 5 minutes.

For example, add it using CRON by following

crontab -e

and add following line

*/5 * * * * /temp/

Now save and exit.


Syed Jahanzaib


  1. Thanks, sir, I will try this, more power to you sir,

    Comment by acep sumarna — January 10, 2013 @ 9:23 AM

  2. good idea
    but i want know best computer to squid cache? ram cpu mother ???
    and install ubunt 11 or 12 ?

    Comment by malak — January 11, 2013 @ 3:04 PM

    • It depends on various factors, like number of active users that would be accessing the proxy service, Internet link, Other specific requirements, filters etc.

      Comment by Syed Jahanzaib / Pinochio~:) — January 12, 2013 @ 10:16 AM

  3. what if squid service down but server still running and you can ping that server. how to identifi from mikrotik??

    Comment by Syaifuddin JW — January 11, 2013 @ 6:28 PM

    • Yes its possible but Netwatch won’t going to help you in this regard.
      Create an script that can ssh (using password less trick) to squid and check SQUID service status. If its stopped, then it should DISABLE the Mikrotik REDIRECT NAT rule otherwise it may enable the rule. Then schedule it to run after every 5 or 10 minutes or whatever.

      Comment by Syed Jahanzaib / Pinochio~:) — January 12, 2013 @ 10:19 AM

      • Nice trick . I Would like to see a common script for radius as a backup restore solution . For example doing a replication setup we need manually to change the radius ip . Is there a way to do a script and add 2 radiuses and if the first has ping enable it . If it fails enable second radius command . It would be nice for every user.

        Comment by Darkng — February 23, 2013 @ 4:20 AM

      • sir script man ERRER hay add nahi hoti

        Comment by M.Tahir Shafiq — March 30, 2013 @ 8:02 PM

  4. sir script man ERRER hay add nahi hoti

    Comment by M.Tahir shafiq — January 12, 2013 @ 1:35 PM

  5. yes sir script errer ata hai jab ke mere pass v5.18 hai

    Comment by imtiaz ali — January 16, 2013 @ 9:48 PM

  6. Muhammed Shahjehan

    Nice tip

    Thanks Sir,
    i will try ………….

    Allah Hafiz

    Comment by Muhammed Shahjehan — February 11, 2013 @ 4:23 PM

  7. Assalamu alikum Bro..This is Nahid from Bangladesh..I always see your post in your personal blog and learn many thing from it.. Specially about Mikrotik router..Your post help me so much at my work..Bro I want know that: “How can I install Mikrotik OS on a Desktop Computer”??.Can I use a Desktop PC as a Mikrotik Router??. I have no idea please help me A to can i do that.. I always pray for u..Keep well..Allah hafiz..

    Comment by GSB NAHID — February 19, 2013 @ 11:54 AM

  8. error in script

    Comment by Azhar Khan — October 30, 2013 @ 8:35 PM

  9. Syed Jahanzaib bro keep it up nice article working fine thanx you very much🙂

    Comment by Sharjeel Khan — November 9, 2013 @ 6:19 PM

  10. this script is not working after i upgraded my router os to v 6.9 please help

    Comment by mushhood hussain — February 5, 2014 @ 7:11 PM

  11. Dear Jahanzaib !

    Once somewhere i read a post from you about Mikrotik to check the WAN link of DSL is active or not and if it is not active it send an sms or email notification to inform the administrator about the link. I looked out alot in your posts but did not find it. If you can help me it will be very very thankful.

    Comment by Qamar — February 7, 2014 @ 12:02 AM

  12. Syed Jahanzaib

    Nice Article Working

    Comment by deallink — February 8, 2014 @ 10:22 PM

  13. thanx
    very very helpful

    Comment by ali sameer — March 19, 2014 @ 1:09 AM

  14. Sir…………squid check service Script is not working…on 2.7 st9
    plz……….explain how to edit the scrip

    Comment by Salman — December 29, 2014 @ 6:03 AM

  15. Sir…….This updated Script is working…ok 2.7
    Thank u very much ..thanks…..thanks….thanks a lot Sir////////
    ALLAH AAp Ko ” JAZA E KHAIR ” Dey…….Ameen….!

    Comment by Salman — December 30, 2014 @ 3:49 AM

  16. Hi sir, a very interesting job. I’m trying to do something like this… on my mikrotik, the users login process is done by an external radius server, but in the event that this server is down, they should authenticate via the internal mikrotik radius server. I hope you can give me a hand.

    Best regards

    Comment by Alberto — February 24, 2015 @ 4:34 PM

    • you can use two radius server in mikrotik RADIUS section, so if primary is down, it will go directly to secondary.
      you can also Netwatch script, which can monitor your primary radius, in case its down, the script can disable primary radius rule, and will enable secondary, and will switch back when primary is available.

      Comment by Syed Jahanzaib / Pinochio~:) — February 25, 2015 @ 8:12 AM

      • Thanks for the idea. In the Mikrotik’s documentation I had read something like this, but I wanted to be sure that the servers automatically switch. What would be the benefits of doing a netwatch script of the primary server? However, in the event that the MTs are not going on the internet, I still have to make sure that users do log-in via local database. I thought of using the “usermanager”which, always from Mikrotik’s wiki, should works as a real RADIUS server. I should put in my script something like this…

        / radius add service = login address = secret = “SECRET_KEY” disabled = no
        / user aaa September use-radius = yes

        What do you think?

        Comment by Alberto — February 25, 2015 @ 1:53 PM

RSS feed for comments on this post. TrackBack URI

Leave a Reply

Fill in your details below or click an icon to log in: Logo

You are commenting using your account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s

Blog at

%d bloggers like this: