firewall filter with address-list problem

RouterOS General
1

Hi,

need help. I use API to add/remove firewall filter rules which use src and dst address-list. Address list is managed by API too.
Everything seem to be OK, except that sometimes rule doesnt filter (accept) packets unless board is rebooted.
Rules without src/dst-address-list (only with src/dst-address set) do work always.
It happens on different versions including 5.7

2

can you post examples of filter rules you are using exactly?

3

export

/ip firewall address-list
add address=10.1.1.1 disabled=no list=id-0
add address=10.1.14.44 disabled=no list=id-0
add address=10.1.40.0/24 disabled=no list=id-0
add address=10.1.22.0/24 disabled=no list=id-0
add address=10.1.20.0/24 disabled=no list=id-0
add address=10.1.23.0/24 disabled=no list=id-0

/ip firewall filter
add action=accept chain=forward comment=id-0 disabled=no dst-address=10.0.0.0/8 src-address-list=id-0
add action=accept chain=forward comment=id-0 disabled=no dst-address-list=id-0 src-address=10.0.0.0/8
add action=drop chain=forward comment=id-DROP disabled=no dst-address=10.0.0.0/24
add action=drop chain=forward comment=id-DROP disabled=no src-address=10.0.0.0/24
add action=drop chain=forward comment=id-DROP disabled=no dst-address=10.1.230.88/30
add action=drop chain=forward comment=id-DROP disabled=no src-address=10.1.230.88/30

PS:
for example, icmp from 10.1.1.1 to 10.1.230.90 was dropped, after reboot was accepted