Firewall: dynamic ip lookup instead of static address list?

[mozerd]

Is there any way to use some kind of “dynamic” ip address lookup within the firewall (with eg DNSBL check) in the instead of using the build-in static address lists?

The objective is to move out all the static address lists to a server since they’ve grown to big for RoS.

Background to my question is that we’re using ip backlists from Squid/FireHOL and the import administration is becoming rather tedious and shaky because RoS (6.42 long-term) doesn’t seem to cope well with volumes like +50K lines on our CCRs. As an example we quite often get really weird results from the address-list tab in Winbox 3.18 and intermittent sluggish respons time even though the CPU is almost idling (also using the terminal)

There is also a security risk since there are no smart ways (that doesn’t take forever) to update the address list online without wipe and reload.

Any thoughts and ideas are welcome!

Hi
I developed MOAB extracted from FireHOL] and have a fairly large number of users where none so far have complained of any intermittent sluggish response times …

Insofar as ip address lookup within the firewall (with eg DNSBL check) — IMO that would impose a significant performance hit plus setting something like that up locally requires significant time and resources adding another point of failure.

IMO, MikroTik should address http://forum.mikrotik.com/t/text-files-4096-characters-in-size-limitation/122882/1 … by removing the current limitation making it far more efficient and secure.