/ip firewall address-list add works reasonably fast. It responds even faster if such entry is already present.
Yet /ip firewall address-list print where address=… is slow as hell. 11 seconds at best.
Same goes for /ip firewall address-list remove [ find address= ] - also about 11 seconds.
Does that sound like fine enough behavior or are there plans to speed it up a bit?
PS. whats up with syntax inconsistencies like
/ip firewall address-list print where address=
versus
/ip firewall address-list remove [ find address= ]
Neither /ip firewall address-list print [ find address= ] or /ip firewall address-list remove where address= work. Why do you insist using different syntax for essentially the same thing?
If your specified model is this -https://www.cloudrouterswitches.com/RB750.asp , then he simply lacks the power to run the Ros 7.x version faster. It is not a new model, it has little ram and a low-power processor. It works a bit faster with Ros 6.x versions.
There are other ways but in the end it can’t be sped-up.
The address-list uses hashes and when adding it seems the hash is handed to routine in the background that is very fast and it return success of fail and when success it is added.
When targeting one specific IP to change something it needs a location in the hash list and that is then slower and I think that the routine is not returning the location when adding failed. Mikrotik could tackle this to also return the location of the hash to be replaced on fail. Then this command would not need a “find” to change the timeout.
set address=1.2.3.4 list=long-list timeout=4h
if (on fail adding) do use location of hash and replace it with the new hash and settings else set new hash in list and settings
This allows “set” to be able to add new entries if there is there no “fail”
When having to mutate and those are large numbers of mutations in a address-list then first make a duplicate of the current list by duplicating it and at the same time make you changes. After completing then swap-out the current list and duplicated list and if you want to have a fallback then do not delete the swapped-out list.
Found this after falling into the exact same trap of assuming that removing an address-list (blocklist) with 26k entries and then repopulating is inefficient and rather use the add or edit if exists approach.
To add to topic, also the “keep existing list” (Blocklist), “create new list with imports” (“Blocklist_IMPORT”) and “swap” is also not a good option. As swap basically means:
rename “Blocklist” to “Blocklist_OLD”
rename “Blocklist_IMPORT” to “Blocklist”
delete “Blocklist_OLD”
Both renaming and the delete command take far too long on the MIPSBE and thus are not practical on a daily basis … (which would be required to use the Routers Firewall with a dynamic Blocklist such as CrowdSec)
@MikroTik: is there any way to have this addressed as part of the RouterOS Scripting Language?