'/ip firewall address-list print where' is slow

7.14rc1 on rb750
about 6k address-list entries

/ip firewall address-list add works reasonably fast. It responds even faster if such entry is already present.

Yet /ip firewall address-list print where address=… is slow as hell. 11 seconds at best.
Same goes for /ip firewall address-list remove [ find address= ] - also about 11 seconds.

Does that sound like fine enough behavior or are there plans to speed it up a bit?

PS. whats up with syntax inconsistencies like
/ip firewall address-list print where address=
versus
/ip firewall address-list remove [ find address= ]

Neither /ip firewall address-list print [ find address= ] or /ip firewall address-list remove where address= work. Why do you insist using different syntax for essentially the same thing?


rgds,
vv

Hi!

Did you ever find a solution for this?
I am having the same problem

Best wishes
Stril

If your specified model is this -https://www.cloudrouterswitches.com/RB750.asp , then he simply lacks the power to run the Ros 7.x version faster. It is not a new model, it has little ram and a low-power processor. It works a bit faster with Ros 6.x versions.

Hi!

No, I am using CCR-routers.
While adding new entries is VERY fast, modifying is quite slow.

My code is:

{ :do {/ip firewall address-list add list=blacklist address=X.X.X.X comment=Atacker timeout=4h} on-error={ /ip firewall address-list set [find list=blacklist address=X.X.X.X] timeout=4h} }

→ If the entry is already present, the command

/ip firewall address-list set [find list=blacklist address=X.X.X.X] timeout=4h

…does need some seconds - although on CCR2216.

Is there any possibility to speed this up?

Best wishes

There are other ways but in the end it can’t be sped-up.

The address-list uses hashes and when adding it seems the hash is handed to routine in the background that is very fast and it return success of fail and when success it is added.

When targeting one specific IP to change something it needs a location in the hash list and that is then slower and I think that the routine is not returning the location when adding failed. Mikrotik could tackle this to also return the location of the hash to be replaced on fail. Then this command would not need a “find” to change the timeout.

set address=1.2.3.4 list=long-list timeout=4h

if (on fail adding) do use location of hash and replace it with the new hash and settings else set new hash in list and settings

This allows “set” to be able to add new entries if there is there no “fail”

When having to mutate and those are large numbers of mutations in a address-list then first make a duplicate of the current list by duplicating it and at the same time make you changes. After completing then swap-out the current list and duplicated list and if you want to have a fallback then do not delete the swapped-out list.

Found this after falling into the exact same trap of assuming that removing an address-list (blocklist) with 26k entries and then repopulating is inefficient and rather use the add or edit if exists approach.

To add to topic, also the “keep existing list” (Blocklist), “create new list with imports” (“Blocklist_IMPORT”) and “swap” is also not a good option. As swap basically means:

    1. rename “Blocklist” to “Blocklist_OLD”
  1. rename “Blocklist_IMPORT” to “Blocklist”
  2. delete “Blocklist_OLD”

Both renaming and the delete command take far too long on the MIPSBE and thus are not practical on a daily basis … (which would be required to use the Routers Firewall with a dynamic Blocklist such as CrowdSec)

@MikroTik: is there any way to have this addressed as part of the RouterOS Scripting Language?

  1. Import on a proper way the list (do / on-error is one of the worst) with a name like thislist_ with a consistent timeout.
  2. On firewall filter/nat/mangle/raw change the rules to use now thislist_ (instead of thislist_)
  3. Simply the entries of previous import are automatically deleted.