MikroTik RouterOS

Keep a RouterOS address list in sync and drop it in the raw table.

RouterOS can fetch a script over HTTPS and import it. The mikrotik format is exactly that: it clears the isipsafe address list and adds every listed address.

Set it up

1. Fetch and import once, from the terminal:

   /tool fetch url="https://isipsafe.com/api/v1/blocklist?key=sl_your_key_here&format=mikrotik" dst-path=isipsafe.rsc
   /import isipsafe.rsc

2. Drop the list early, in the raw table, so blocked traffic never touches connection tracking:

   /ip firewall raw add chain=prerouting src-address-list=isipsafe action=drop comment="isipsafe"
   /ipv6 firewall raw add chain=prerouting src-address-list=isipsafe action=drop comment="isipsafe"

3. Refresh every hour with a script and scheduler:

   /system script add name=isipsafe-update source={
     /tool fetch url="https://isipsafe.com/api/v1/blocklist?key=sl_your_key_here&format=mikrotik" dst-path=isipsafe.rsc
     :delay 3s
     /import isipsafe.rsc
   }
   /system scheduler add name=isipsafe interval=1h on-event=isipsafe-update

Smaller routers have limited memory. Keep the list short with &confidenceMinimum=90&limit=20000 on hAP-class hardware.

Need a hand?

If something here does not work with your version of MikroTik RouterOS, or you have improved it, tell us. We update these pages with what people send.

MikroTik RouterOS and its logo are trademarks of their respective owners. isipsafe is not affiliated with or endorsed by them.