Earlier this year I started using both free and subscription-based blacklists from Squidblacklists.org. The blacklists were incredibly simple to implement into RouterOS and once configured, the lists can be scheduled to update at regular intervals via the RouterOS system scheduler. Squidblacklist.org provides a list of available blacklists, but make sure to review the blacklist compatibility chart first, before implementing the list into your RouterOS configuration. In addition, you will need to change the “dst-path” value to an existing path for the script to work. If you want to download the blacklist to the root of your MikroTik you can delete the “dst-path” property and its value entirely. Also, make sure that the “in-interface” and “out-interface” property value is set to that of your network environments WAN interface. Should you choose the “All-In-One Firewall/Filter Setup” script (via copy/paste in the MikroTik terminal), you will need to enable the scheduled tasks, since they are disabled by default in the script.
All-In-One Firewall/Filter Setup
/system script
#CREATE DOWNLOAD BLACKLISTS SCRIPT
add comment=Firewall name=Blacklist_SquidBlacklist_Download_drop.malicious.rsc policy=read,test source=":log warning \"START - Download blacklist (drop.malicious.rsc) updates.\";\r\
\n/tool fetch address=www.squidblacklist.org host=www.squidblacklist.org mode=http src-path=/downloads/drop.malicious.rsc dst-path=/disk1/blacklists/drop.malicious.rsc\r\
\n:log warning \"END - Download blacklist (drop.malicious.rsc) updates.\";"
#CREATE IMPORT BLACKLISTS SCRIPT
add comment=Firewall name=Blacklist_SquidBlacklist_Import_drop.malicious.rsc policy=read,write source=":log warning \"START - Import blacklist (drop.malicious.rsc) update.\";\r\
\nimport /disk1/blacklists/drop.malicious.rsc\r\
\n:log warning \"END - Import blacklist (drop.malicious.rsc) update.\";"
/system scheduler
#CREATE DOWNLOAD BLACKLISTS SCHEDULER
add comment=Firewall interval=1d name=Blacklist_SquidBlacklist_Download_drop.malicious.rsc on-event="/system script run Blacklist_SquidBlacklist_Download_drop.malicious.rsc" policy=read,test start-date=jan/01/2017 start-time=01:00:00 disabled=yes
#CREATE IMPORT BLACKLISTS SCHEDULER
add comment=Firewall interval=1d name=Blacklist_SquidBlacklist_Import_drop.malicious.rsc on-event="/system script run Blacklist_SquidBlacklist_Import_drop.malicious.rsc" policy=read,write start-date=jan/01/2017 start-time=01:15:00 disabled=yes
/ip firewall filter
#CREATE INPUT RULES FOR BLACKLISTS
add action=drop chain=input in-interface=ether1 src-address-list="sbl blocklist.de" log=yes log-prefix="BL_sbl blocklist.de" comment="Squild Blacklist: SBL Blocklist.de."
add action=drop chain=input in-interface=ether1 src-address-list="sbl dshield" log=yes log-prefix="BL_sbl dshield" comment="Squild Blacklist: SBL DShield."
add action=drop chain=input in-interface=ether1 src-address-list="sbl spamhaus" log=yes log-prefix="BL_sbl spamhaus" comment="Squild Blacklist: SBL Spamhaus."
/ip firewall filter
#CREATE FORWARD RULES FOR BLACKLISTS
add action=drop chain=forward out-interface=ether1 dst-address-list="sbl blocklist.de" log=yes log-prefix="BL_sbl blocklist.de" comment="Squild Blacklist: SBL Blocklist.de."
add action=drop chain=forward out-interface=ether1 dst-address-list="sbl dshield" log=yes log-prefix="BL_sbl dshield" comment="Squild Blacklist: SBL DShield."
add action=drop chain=forward out-interface=ether1 dst-address-list="sbl spamhaus" log=yes log-prefix="BL_sbl spamhaus" comment="Squild Blacklist: SBL Spamhaus."
Manual Setup
If you would like to setup everything manually via GUI/Winbox (System > Scheduler), you can use the following System Scheduler “On Event” commands to download and import the blacklist. Also, don’t forget to create the firewall/filter drop rules required for the blacklists, I’ll include an additional code snippet for this at the bottom.
Script: Download Blacklist
:log warning "START - Download blacklist (drop.malicious.rsc) updates.";
/tool fetch address=www.squidblacklist.org host=www.squidblacklist.org mode=http src-path=/downloads/drop.malicious.rsc dst-path=/disk1/blacklists/drop.malicious.rsc
:log warning "END - Download blacklist (drop.malicious.rsc) updates.";
Script: Import Blacklist
:log warning "START - Import blacklist (drop.malicious.rsc) update.";
import /disk1/blacklists/drop.malicious.rsc
:log warning "END - Import blacklist (drop.malicious.rsc) update.";
Scheduler: Execute Download Blacklist Script
/system script run Blacklist_SquidBlacklist_Download_drop.malicious.rsc
Scheduler: Execute Import Blacklist Script
/system script run Blacklist_SquidBlacklist_Import_drop.malicious.rsc
Create Firewall/Filter Input Drop Rules
/ip firewall filter
#CREATE INPUT RULES FOR BLACKLISTS
add action=drop chain=input in-interface=ether1 src-address-list="sbl blocklist.de" log=yes log-prefix="BL_sbl blocklist.de" comment="Squild Blacklist: SBL Blocklist.de."
add action=drop chain=input in-interface=ether1 src-address-list="sbl dshield" log=yes log-prefix="BL_sbl dshield" comment="Squild Blacklist: SBL DShield."
add action=drop chain=input in-interface=ether1 src-address-list="sbl spamhaus" log=yes log-prefix="BL_sbl spamhaus" comment="Squild Blacklist: SBL Spamhaus."
Create Firewall/Filter Forward Drop Rules
/ip firewall filter
#CREATE FORWARD RULES FOR BLACKLISTS
add action=drop chain=forward out-interface=ether1 dst-address-list="sbl blocklist.de" log=yes log-prefix="BL_sbl blocklist.de" comment="Squild Blacklist: SBL Blocklist.de."
add action=drop chain=forward out-interface=ether1 dst-address-list="sbl dshield" log=yes log-prefix="BL_sbl dshield" comment="Squild Blacklist: SBL DShield."
add action=drop chain=forward out-interface=ether1 dst-address-list="sbl spamhaus" log=yes log-prefix="BL_sbl spamhaus" comment="Squild Blacklist: SBL Spamhaus."
The firewall forward rules are not correct. It should be “chain=forward”. Looks like he just pasted the same thing twice.
Thank you, I’ve corrected the error. My apologies, I had to rebuild the page at one point and duplicated the code box template in the editor.
Sweet nice rules!
Have you been able to connect to the Squidproxy server lately? It doesn’t seem to work for me.
-tp
It was down for me as well in my test environment. Also had issues pulling the list from my pfSense router.
Just an update, Benjamin Nichols, Squidblacklist founder, passed away. More info here: https://www.forevermissed.com/benjamin-earnest-nichols/about
Sadly, Ben Nichols passed away in 2020. Sadly this is not going to work anymore,…
Ben Nichols — the guy who maintained squidblacklist.
on SBL there are obsoleted (and already valid) entries (like zoom servers) left. This: https://forum.mikrotik.com/viewtopic.php?f=9&t=152632 might be replacement…