MIKROTIK: SETUP SQUIDBLACKLIST FIREWALL
The blacklists were incredibly simple to implement into RouterOS and once configured, the lists can be scheduled to update at regular intervals via the RouterOS system scheduler. Squidblacklist.org provides a list of available blacklists, but make sure to review the blacklist compatibility chart first, before implementing the list into your RouterOS configuration. In addition, you will need to change the “dst-path” value to an existing path for the script to work. If you want to download the blacklist to the root of your MikroTik you can delete the “dst-path” property and its value entirely. Also, make sure that the “in-interface” and “out-interface” property value is set to that of your network environments WAN interface. Should you choose the “All-In-One Firewall/Filter Setup” script (via copy/paste in the MikroTik terminal), you will need to enable the scheduled tasks, since they are disabled by default in the script.
ALL-IN-ONE FIREWALL/FILTER SETUP
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 | /system script #CREATE DOWNLOAD BLACKLISTS SCRIPT add comment=Firewall name=Blacklist_SquidBlacklist_Download_drop.malicious.rsc policy=read,test source=":log warning \"START - Download blacklist (drop.malicious.rsc) updates.\";\r\ \n/tool fetch address=www.squidblacklist.org host=www.squidblacklist.org mode=http src-path=/downloads/drop.malicious.rsc dst-path=/disk1/blacklists/drop.malicious.rsc\r\ \n:log warning \"END - Download blacklist (drop.malicious.rsc) updates.\";" #CREATE IMPORT BLACKLISTS SCRIPT add comment=Firewall name=Blacklist_SquidBlacklist_Import_drop.malicious.rsc policy=read,write source=":log warning \"START - Import blacklist (drop.malicious.rsc) update.\";\r\ \nimport /disk1/blacklists/drop.malicious.rsc\r\ \n:log warning \"END - Import blacklist (drop.malicious.rsc) update.\";" /system scheduler #CREATE DOWNLOAD BLACKLISTS SCHEDULER add comment=Firewall interval=1d name=Blacklist_SquidBlacklist_Download_drop.malicious.rsc on-event="/system script run Blacklist_SquidBlacklist_Download_drop.malicious.rsc" policy=read,test start-date=jan/01/2017 start-time=01:00:00 disabled=yes #CREATE IMPORT BLACKLISTS SCHEDULER add comment=Firewall interval=1d name=Blacklist_SquidBlacklist_Import_drop.malicious.rsc on-event="/system script run Blacklist_SquidBlacklist_Import_drop.malicious.rsc" policy=read,write start-date=jan/01/2017 start-time=01:15:00 disabled=yes /ip firewall filter #CREATE INPUT RULES FOR BLACKLISTS add action=drop chain=input in-interface=ether1 src-address-list="sbl blocklist.de" log=yes log-prefix="BL_sbl blocklist.de" comment="Squild Blacklist: SBL Blocklist.de." add action=drop chain=input in-interface=ether1 src-address-list="sbl dshield" log=yes log-prefix="BL_sbl dshield" comment="Squild Blacklist: SBL DShield." add action=drop chain=input in-interface=ether1 src-address-list="sbl spamhaus" log=yes log-prefix="BL_sbl spamhaus" comment="Squild Blacklist: SBL Spamhaus." /ip firewall filter #CREATE FORWARD RULES FOR BLACKLISTS add action=drop chain=forward out-interface=ether1 dst-address-list="sbl blocklist.de" log=yes log-prefix="BL_sbl blocklist.de" comment="Squild Blacklist: SBL Blocklist.de." add action=drop chain=forward out-interface=ether1 dst-address-list="sbl dshield" log=yes log-prefix="BL_sbl dshield" comment="Squild Blacklist: SBL DShield." add action=drop chain=forward out-interface=ether1 dst-address-list="sbl spamhaus" log=yes log-prefix="BL_sbl spamhaus" comment="Squild Blacklist: SBL Spamhaus."21 |