There’s a fancy dream of all web users to make it safer and faster. One of a relly good tools for that is AdBlockPlus Service. This service supplys regex filter rules of a harmfull content, as such https://easylist-downloads.adblockplus.org/malwaredomains_full.txt
Is it possible to apply AdBlockPlus regex filter rules as a basic traffic filter in RouterOS?
If such feature would get available it would make dream come true about routers of all home users ever. I’d even pay for it. I use at home MikroTik RB951G-2HnD with RouterOS 5.26
This looks good - I am going to import these into a metarouter and see how it runs as a web proxy, redirecting any of those matched l7 regex’s to a simple ‘possible malware’ static html file. I am not good with scripting, but I am sure it would be quite easy to schedule downloading, parsing and updating the L7 protocol list. I will post back with results, when I have had time to try this.
Just in case anyone else runs across this in a google search like I did. Be sure to read the “ReadMe” as always, but it works out great for me on my RB450G.
yes i have. i used this repo to create a list with almost 52k entries. it does it’s job well.
but be aware, that the implementation as DNS static entries takes shitload of RAM (cca 200 MB), so it cannot be used on mtiks with low RAM amount. also, it takes about 10 minutes to load after reboot, and during that time, DNS service is not responding.
because of this, i also implemented it as a firewall address list. it uses much less memory (cca 50MB, works on 128MB RAM mtiks) and reboot loading is non-blocking.
You might want to look at the size of your DNS cache. I have not done napkin math to tell you the exact cache size required for almost 150k entries, but I guess you could increase it to 200MB for starters, and if it’s still full try increasing it even more. There is enough memory available on the board you are using. On a side note, I think loading MIkroTik’s simple DNS service with hundreds of thousands of static entries is a horrible idea, but I support your experiment and would love to hear the results you get from this. People use dedicated appliances like PiHole for this purpose - which often proves to be unreliable solution.
Regarding firewall rule, your in-interface is wrong - it should be your local network interface (or master port if you use hardware switch feature, or bridge interface if you use software switching), not gateway one.
Did you increase size of DNS cache? Default 2MB is nowhere near enough for what you want to achieve. If you did not do that, most probably you see no hits because your DNS cache is not working at all. If you did increase the cache size, another firewall rule is interfering with your rule - in this case export firewall rules and paste them here in
The thing that indicates problem is this value: cache-used: 2048KiB - it means your cache is full and not working for additional queries. You can add two zeros and make this value something like this: cache-size: 204800KiB (making it ~200MiB). Monitor “cache-used” value after you alter the cache size, if it stays the same or increases just slightly you will most likely need to reboot the router.
