Feature Request: Address List use Wildcard FQDN

The address list can use FQDN as address. Can we see use wildcard or regex FQDN ?

like a:
/ip firewall address-list
add address=*.example.net list=example.net

I guess we can use below method to get address:

  1. DNS cache (ROS as DNS relay)
  2. trust DNS reply (ROS resolve specify dns reply message)

It will useful for setting firewall rule or policy base routing.

I think it is too late to add that kind of “trick” as “everyone” is switching to DoH and DoT and that makes this impossible.
And of course a lookup of *.example.net to obtain the addresses for the list is impossible.

Unless you block all DoH servers in the firewall :slight_smile:

@pe1chl let me explain why you are right and the OP request is real nonsense!!!

If some wildcard are used, just one “dot” for example, RouterOS, for do what you want, must try all valid DNS characters like:
1.google.it, 2.google.it … a.google.it, b.google.it … y.google.it, z.google.it
then with one single wildcard characters must do 40 DNS requests.
If added something like "" wildcard, RouterOS must try from
1.google.it
to
zzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzz.google.it
for do that, must do (243 positions with 40 possible values each position = 40^253 =) ~ 2
10^405 of DNS querys

Just 2*10^405 of DNS querys, for each wildcard DNS on address list..
Numbers of atoms on the universe are like 10^82…

very feasable, not?

DoH maybe a trend. almost device/software start to support it, but not default enable at all now.
I think this feature can useful a long time


So I find DNS cache or listen DNS reply. I think that is better than brute force.

Usng DNS cache for populate firewall address-list is already possible.

Are you mean use script to do this? or ROS feature?

The 1st