etuldan/mikrotik-blocklist repository overview

⁠mikrotik-blocklist

⁠Description

mikrotik-blocklist is a webservice that handle and create a mikrotik script containing IP blocklist, created from commonly used blocklists.

While there are already some pre-generated mikrotik scripts that are regularly updated, this is a MAJOR RISK issue, as the maintainer of these scripts could inject some malicious code onti them, and your router would automatically pull the update.
So, I created this piece of software.

DO NOT trust me, DO NOT use any public server that deploys my sofware. While it's not prohibited (as it's GPLv3), this pose another MAJOR RISK issue, as you can't trust the publisher.

Deploy it yourself if you can trust the code. DO NOT auto-update without approval !

⁠Deployment

Again, DO NOT trust any 3rd party deployment, as the code could have been modified. You can deploy it either as a binary app, or as a container. In both cases, the app should be reacheable via HTTP from your router (only an internal LAN is strongly recommended). mikrotik-blocklist doesn't support HTTP, if you need it, use a HTTPS proxy in front of mikrotik-blocklist.

services:
  mikrotik-blocklist:
    build: .
    container_name: mikrotik-blocklist
    restart: always
    ports:
      - 8080:8080
    depends_on:
      - redis
    volumes:
      - ./config.yml:/app/config.yml

  redis:
    image: redis:8.2.1-alpine
    restart: always
    ports:
      - 6379:6379
    command: redis-server --save 20 1 --loglevel warning
    volumes:
      - cache:/data

volumes:
  cache:
    driver: local

docker compose up -d

It will build the image locally and pull a redis one.
Again, DO NOT pull a pre-existing image, as there is still a MAJOR RISK issue.

⁠Configuration

On your server, configure the environment variables.

app:
  blocklists:
    - https://raw.githubusercontent.com/firehol/blocklist-ipsets/refs/heads/master/firehol_level1.netset
#    - https://raw.githubusercontent.com/firehol/blocklist-ipsets/refs/heads/master/greensnow.ipset
#  port: 8080
db:
  host: "redis:6379"
#  username: ""
#  password: ""
#  name: 0

On your router:

• create a script:

/tool fetch url="http://<host>" dst-path=mikrotik-blocklist.rsc;
/import file-name=mikrotik-blocklist.rsc;
/file remove mikrotik-blocklist.rsc

where <host> is the webserver on which mikrotik-blocklist is deployed.

• add a scheduled task running this script:

/system scheduler add interval=1d name=mikrotik-blocklist on-event=mikrotik-blocklist policy=local,telnet,ssh,ftp,reboot,read,write,policy,test,winbox,password,web,sniff,sensitive,api,romon,rest-api start-date=2025-01-01 start-time=05:00:00

• add a new firewall rule:

/ip firewall raw add action=drop chain=prerouting src-address-list=mikrotik-blocklist

⁠How it works

When your router pulls the script from the scheduled task, the service will generate a new temporary script with a random UUID, delaying the next call.
For each subsequent call from the temporary script, the service will either reply with another temporary script, or with the final blocklist script containing all the IP addresses to ban.
The service uses Redis as a temporary database to store the blocklist and link each request according to its UUID.