When making a firewall rule to block IPs or meet conditions based on an address list it would be nice to be able to add more than one list. For example:
You have a static list of IPs to block outbound connections to known spyware sites, inside the list is an entire Class B. Inside this Class B is a single Class C known to be legitimate for a customer. Now you can do ! rules under the source IP prior to using the list in the advanced page, However this is sloppy when compared to generated a list of IPs to not include inside the List. So being able to add a second source list and select ! (NOT EQUAL) would be very useful.
For Example:
add chain=forward dst-address=!206.142.77.0/24 dst-address-list=spy-addr action=drop comment=“Drop Known Spyware outbound” disabled=no
206.142.77.0/24 is a website host carrying legitimate traffic.
spy-addr contains the entry
add list=spy-addr address=206.142.0.0/16 comment=“” disabled=no
Because 206.142.0.0/16 has MANY MANY spyware sites hosted on it.
These 2 rules allow me to bypass the class C blocked within, however if another IP in the spy-addr list has the same problem I run into trouble
If the Advanced Tab would allow multiplr address lists to be checked it would allow me to maybe do this:
add chain=forward dst-address-list=spy-addr dst-address-list=!spyexcl-addr action=drop comment=“Drop Known Spyware outbound” disabled=no
then add list=spy-addr address=206.142.0.0/16 comment=“” disabled=no
would be the same, but then an additional one could be added to exclude the IPs within:
add list=spy-excladdr address=206.142.77.0/24 comment=“” disabled=no