[Script] Print/Log spammer addresses from a list only once

RouterOS Scripting
1

This is a modification of a script by Bob Burley that I wanted to share.

It reports each new address added to the list “spammer”, but only once. This is done by remembering printed addresses in the list “reported”.

  1. First make sure your firewall rule(s) put spammer addresses to the list “spammer”
  2. Add this script to your router, don’t foget to set script policy to “read,write”
  3. Add scheduler entry with policy to “read,write” and interval ~10s
  4. To allow an address through, you need to remove it only from “spammer”, and it will be aut-removed from “reported” as well. This is done by the first half of the script.

Remove addresses in “reported” which are not present in “spammer”

:foreach NextReported in [:ip firewall address-list find list=reported] do={
:local FoundReportedAddressInSpammer false
:local ReportedIp [:ip firewall address-list get $NextReported address]
:foreach NextSpammer in [:ip firewall address-list find list=spammer] do={
:local SpammerIp [:ip firewall address-list get $NextSpammer address]
:if ($ReportedIp=$SpammerIp) do={
:set FoundReportedAddressInSpammer true
}
}
:if ($FoundReportedAddressInSpammer=false) do={
:ip firewall address-list remove $NextReported
}
}

Log new addresses and add them to “reported”

:if ([:len [:ip firewall address-list find list=spammer]]!=[:len [:ip firewall address-list find list=reported]]) do={
:foreach NextSpammer in [:ip firewall address-list find list=spammer] do={
:local AlreadyReported false
:local SpammerIp [:ip firewall address-list get $NextSpammer address]
:foreach NextReported in [:ip firewall address-list find list=reported] do={
:local ReportedIp [:ip firewall address-list get $NextReported address]
:if ($SpammerIp=$ReportedIp) do={
:set AlreadyReported true
}
}
:if ($AlreadyReported=false) do={
:log warning (“WARNING: New IP " . $SpammerIp . " added to spammer list”)
:ip firewall address-list add address=$SpammerIp list=reported
}
}
}Tested on RouterOS 5.20. Please report bugs!

2

First of all, I have fix all the syntax and formal errors, but I have not checked the logic.

# Remove addresses in "reported" which are not present in "spammer"
:foreach NextReported in [/ip firewall address-list find where list=reported] do={
    :local FoundReportedAddressInSpammer value=false;
    :local ReportedIp value=[/ip firewall address-list get $NextReported value-name=address];
    :foreach NextSpammer in [/ip firewall address-list find where list=spammer] do={
        :local SpammerIp value=[/ip firewall address-list get $NextSpammer value-name=address];
        :if ($ReportedIp = $SpammerIp) do={
            :set $FoundReportedAddressInSpammer value=true;
        }
    }
    :if ($FoundReportedAddressInSpammer = false) do={
        /ip firewall address-list remove $NextReported;
    }
}
# Log new addresses and add them to "reported"
:if ([:len [/ip firewall address-list find where list=spammer]] != [:len [/ip firewall address-list find where list=reported]]) do={
    :foreach NextSpammer in [/ip firewall address-list find where list=spammer] do={
        :local AlreadyReported value=false;
        :local SpammerIp value=[/ip firewall address-list get $NextSpammer value-name=address];
        :foreach NextReported in [/ip firewall address-list find where list=reported] do={
            :local ReportedIp value=[/ip firewall address-list get $NextReported value-name=address];
            :if ($SpammerIp = $ReportedIp) do={
                :set $AlreadyReported value=true;
            }
        }
        :if ($AlreadyReported = false) do={
            /log warning message=("WARNING: New IP " . $SpammerIp . " added to spammer list");
            /ip firewall address-list add address=$SpammerIp list=reported;
        }
    }
}
3

Thank you! I had to make a small change to make the script work on 5.X series: (“value-name” → “value” on line 23)

Remove addresses in “reported” which are not present in “spammer”

:foreach NextReported in [/ip firewall address-list find where list=reported] do={
:local FoundReportedAddressInSpammer value=false;
:local ReportedIp value=[/ip firewall address-list get $NextReported value-name=address];
:foreach NextSpammer in [/ip firewall address-list find where list=spammer] do={
:local SpammerIp value=[/ip firewall address-list get $NextSpammer value-name=address];
:if ($ReportedIp = $SpammerIp) do={
:set $FoundReportedAddressInSpammer value=true;
}
}
:if ($FoundReportedAddressInSpammer = false) do={
/ip firewall address-list remove $NextReported;
}
}

Log new addresses and add them to “reported”

:if ([:len [/ip firewall address-list find where list=spammer]] != [:len [/ip firewall address-list find where list=reported]]) do={
:foreach NextSpammer in [/ip firewall address-list find where list=spammer] do={
:local AlreadyReported value=false;
:local SpammerIp value=[/ip firewall address-list get $NextSpammer value-name=address];
:foreach NextReported in [/ip firewall address-list find where list=reported] do={
:local ReportedIp value=[/ip firewall address-list get $NextReported value-name=address];
:if ($SpammerIp = $ReportedIp) do={
:set $AlreadyReported value=true;
}
}
:if ($AlreadyReported = false) do={
/log warning message=(“WARNING: New IP " . $SpammerIp . " added to spammer list”);
/ip firewall address-list add address=$SpammerIp list=reported;
}
}
}

4

Bravo!

Is my error :wink:
Must be “value”. I fix my previous post