Updated the server side to create dynamic entries so that they are not written to NAND. This has a downside, the list will need to be reloaded on reboot. The entries now also expire after 48 hours.
:foreach i in=[/ip firewall address-list find ] do={ :if ( [/ip firewall address-list get $i comment] = "intrusBlacklist" ) do={ /ip firewall address-list remove $i } }
Can be simplified to
/ip firewall address-list remove [/ip firewall address-list find comment = "intrusBlacklist"]
Should actually increase the efficiency.
Many thanks for this.
On the latest Router OS I can see it’s created the entries under Address Lists, but on the filter rules I don’t see any new filter rules showing up that reference the address list called blacklist as created by the script.
Model is MikroTik RB951G-2HND
Cheers
Where I have already see part of that rules on exact order? 
Ah:
http://forum.mikrotik.com/t/for-isp-how-to-really-block-invalid-icmp-tcp-udp-packets-and-others-ver-2021/75627/1
Sort the rules for efficency (simply drop if coming from blocked list, not first check malformed packet then drop)
/ip firewall filter
add action=jump chain=input comment="Check for bad stuff in \"Attack\" chain" jump-target=Attacks
add chain=input comment="Allow ICMP Response" icmp-options=8:0 protocol=icmp
add chain=input comment="Allow any packets from our trusted \"IPSec\" partners" connection-state=new src-address-list=ipSec
add chain=input comment="Allow the Private IP ranges to access the router" connection-state=new src-address-list=PrivateIPs
add chain=input comment="Allow current valid connections as well as valid related packets" connection-state=established,related
add action=drop chain=input comment="Drop everything else by default"
add action=jump chain=forward comment="Check for bad stuff in \"Attack\" chain" jump-target=Attacks
add chain=forward comment="Allow current valid connections as well as valid related packets" connection-state=established,related
add chain=forward comment="Allow the Private IP ranges to be forwarded by the router" connection-state=new src-address-list=PrivateIPs
add action=drop chain=Attacks comment="Drop connections FROM blacklisted hosts" src-address-list=blacklist
add action=drop chain=Attacks comment="Drop connections TO blacklisted hosts" dst-address-list=blacklist
add action=drop chain=Attacks comment="Invalid TCP flag combo" protocol=tcp tcp-flags=!fin,!syn,!rst,!ack
add action=drop chain=Attacks comment="Invalid TCP flag combo" protocol=tcp tcp-flags=fin,syn
add action=drop chain=Attacks comment="Invalid TCP flag combo" protocol=tcp tcp-flags=fin,rst
add action=drop chain=Attacks comment="Invalid TCP flag combo" protocol=tcp tcp-flags=fin,!ack
add action=drop chain=Attacks comment="Invalid TCP flag combo" protocol=tcp tcp-flags=fin,urg
add action=drop chain=Attacks comment="Invalid TCP flag combo" protocol=tcp tcp-flags=syn,rst
add action=drop chain=Attacks comment="Invalid TCP flag combo" protocol=tcp tcp-flags=rst,urg
add action=drop chain=Attacks comment="Invalid TCP source port (0)" protocol=tcp src-port=0
add action=drop chain=Attacks comment="Invalid TCP destination port (0)" dst-port=0 protocol=tcp
add action=drop chain=Attacks comment="Invalid UDP source port (0)" protocol=udp src-port=0
add action=drop chain=Attacks comment="Invalid UDP destination port (0)" dst-port=0 protocol=udp
add action=drop chain=Attacks comment="Invalid packets (No valid current connection)" connection-state=invalid
add action=return chain=Attacks comment="Return to the chain that jumped"
add action=drop chain=forward comment="Drop everything else on WAN1" in-interface=wan1
add action=drop chain=forward comment="Drop everything else on WAN2" in-interface=wan2
good set of rules.
Thanks for this ruleset.
Is it useful to use to put the input and forward chain into this same set of rules?
What i am also interested, is it possible to say how much performance influance has a rule?
I have a home use setup with an rb2011 and so i think i will never reach the limit (2-5 devices running @ same time)
It only interests me 
PS: Cant give karma, dont know why
on s.o.h.o. or at home as really no impact, except if layer-7 are used for filter traffic
on big amount of traffic count the power of the RouterBOARD
In my office (I’m a WISP) one 2011-RM is sufficient for 1Gbit internal traffic for 12 PC, 1 Server, 1 NAS, Public Local HotSpot (one Metal 2 out of the door) printers, VoIP systems (20 phones / 4 lines), failover between main line (20Mbps/20Mbps) and one ADSL line (7Mbps up / 380kbps down) and the firewall have near 80 rules on filter, 40 on NAT and 20 on mangle, hotspot service active withe relative rules, EoIP tunnels, DNS and address-list filter and web-proxy.
(DNS, address-list filter and web-proxy are used for remove all the ADs on web pages, https or not…)
I NOT use NAND,r USB or microSD for user-manager storage, I use one separate PC with RouterOS
These are the same filters I use, along with the blacklist that ranges from 2000~5000 IP’s and subnets.
If you are interested, You can look at the stats for the routers that I monitor directly. The demo key only allows access to 15 of the routers. I will leave it open for a day or so.
Thanks for this information!
I’ve switched all my servers over to SSL only. Here is an updated script with https enabled.
I have new filter rules coming soon using the raw prerouting , once 6.36 is released.
:log warning "Downloading current Blacklist for this model";
:local model [/system resource get board-name]
:local version [/system resource get version]
:local memory [/system resource get total-memory]
:local uname [/system identity get name]
/tool fetch url="https://mikrotik.intrustech.com/download.php?get=complete&model=$model&version=$version&memory=$memory&id=$uname" mode=https dst-path="/currentBlacklist.rsc";
# Disable Logging so each add and remove isn't in the system log, we turn it back on at the end
:log warning "Disabling system Logging";
/system logging disable 0
# Find and Remove the old filters
:log warning "Removing previous Blacklist Address-List entries";
:foreach i in=[/ip firewall address-list find ] do={ :if ( [/ip firewall address-list get $i comment] = "intrusBlacklist" ) do={ /ip firewall address-list remove $i } }
# Import the new filters
:log warning "Importing current Blacklist";
/import file-name=/currentBlacklist.rsc
# Delete the import file
:log warning "Removing temp files";
/file remove currentBlacklist.rsc
# Enable the Logging
:log warning "Enabling system logging, all done.";
/system logging enable 0
Great work!
is this lastest working version ?
It does. However, it appears that if you are on older versions of RouterOS, you will need to disable https. the current RC fixed the issue.
Personally, I would recommend upgrading to the RC so you can take advantage of the RAW filter.
Im using V6.35.4 and I will try this. also I found this while searching http://joshaven.com/resources/tricks/mikrotik-automatically-updated-address-list/ and its seems working good.
Replace this:
/tool fetch url="https://mikrotik.intrustech.com/download.php?get=complete&model=$model&version=$version&memory=$memory&id=$uname" mode=https dst-path="/currentBlacklist.rsc";
with this:
/tool fetch url="http://mikrotik.intrustech.com/download.php?get=complete&model=$model&version=$version&memory=$memory&id=$uname" mode=http dst-path="/currentBlacklist.rsc";
For some reason, anything before 6.36RC will not connect to the server via https.
Thanks A lot… I will try this…
let me know if it doesn’t work. I’ve been meaning to give this scrip a rewrite to match the new servers.
gives an error;
failure: closing connection: <301 Moved Permanently> 104.27.182.151:80 (4)
but i found this. http://joshaven.com/resources/tricks/mikrotik-automatically-updated-address-list/ and its working… i dont know which one is better
Which kind of mineral water is “better”: sparkling or non-sparkling ? 
You can combine both lists if you feel that each one is not enough for you.
If not, just check counters when you use each of them and decide which blocks more attacks and use it. Remeber that lists are dynamic so the their goodness could change each time you reload it.
choose the non-sparkling one.. it will better.