No hope here, you'll have to schedule the script. Just don't forget to add the /x after setting the tail of the address to 0s by bitwise anding it with the mask.

Well, ($ipAddress&$cidrMask) suggests that the actual expression would be like (4.3.2.1&255.255.255.0) which yields 4.3.2.0, but what I had in mind was that you have to place 4.3.2.0/24 to the address-list as e.g. within a /21 network, 4.3.2.0 is not an address of a network but an ordinary host address.

But on the other hand, the address-list code is clever itself:

Code: Select all

[me@MyTik] > ip firewall address-list print
Flags: X - disabled, D - dynamic
 #   LIST                            ADDRESS                                              CREATION-TIME        TIMEOUT
 0   my-test                         192.168.1.3                                          jul/20/2018 13:55:53
[me@MyTik] > ip firewall address-list set [find list=my-test address=192.168.1.3] address=192.168.1.3/24
[me@MyTik] > ip firewall address-list print
Flags: X - disabled, D - dynamic
 #   LIST                            ADDRESS                                              CREATION-TIME        TIMEOUT
 0   my-test                         192.168.1.0/24                                       jul/20/2018 13:55:53

So it is enough to specify the mask length and the address-list code zeroes the bits of the prefix which exceed the mask length automatically.

Therefore, the code only needs to find list items whose address values don't contain the / character and add the /24 to them:

Code: Select all

[me@MyTik] > ip firewall address-list print
Flags: X - disabled, D - dynamic
 #   LIST                            ADDRESS                                              CREATION-TIME        TIMEOUT
 0   my-test                         192.168.1.17                                         jul/20/2018 13:55:53
 1   my-test                         192.168.5.43                                         jul/20/2018 14:07:55
[me@MyTik] > :foreach id in=[ip firewall address-list find list=my-test address~"^[0-9\\.]*\$"] do={local ipAddr [/ip firewall address-list get $id address];/ip firewall address-list set $id address=($ipAddr."/24")}
[me@MyTik] > ip firewall address-list print
Flags: X - disabled, D - dynamic
 #   LIST                            ADDRESS                                              CREATION-TIME        TIMEOUT
 0   my-test                         192.168.1.0/24                                       jul/20/2018 13:55:53
 1   my-test                         192.168.5.0/24                                       jul/20/2018 14:07:55

:foreach id in=[ip firewall address-list find list=my-test address~"^[0-9\\.]*\$"] do={local ipAddr [/ip firewall address-list get $id address];/ip firewall address-list set $id address=($ipAddr."/24")}

The correct use of on-error is rather peculiar (although logical, you want the on-error to be targeted to a specific part of the script) so maybe the issue is only that.

I would first do my best to make the on-error work because a check whether the result of the /32 to /24 address conversion exists in the address-list becomes more complex to do if you plan on more mask lengths than just the /24 one. So you would either have to maintain a table of mask length to bitmap translations, or you would have to insert an address into an auxiliary address list and use the result of the automatic prefix adjustment (and remove the address from the auxiliary address-list at once of course). See the difference:

[kevinds@MikroTik] > /ip firewall address-list print where list=class-e 
Flags: X - disabled, D - dynamic 
 #   LIST                      ADDRESS                                       CREATION-TIME        TIMEOUT             
 0   class-e                   240.0.0.0/24                                  jul/23/2018 17:25:01
 1   class-e                   240.0.0.0/22                                  jul/23/2018 17:25:07
 2   class-e                   240.0.0.0/16                                  jul/23/2018 17:25:10
[kevinds@MikroTik] > 

:foreach id in=[ip firewall address-list find list=my-list address~"^[0-9\\.]*\$"] do={local ipAddr [/ip firewall address-list get $id address];/ip firewall address-list set $id address=($ipAddr."/24")}

Yes, you do... as the link I gave shows, the on-error is just a part of a larger scheme. You take just a part of the script which you expect might fail, and for that part you specify the on-error handling. So it is
:do {some script} on-error={some error handling}

And you have to bear in mind that in this case, the do is not a parameter of another command (like in :foreach counter=id in=value-list do={foreach body}) but it is a command itself, so there must be a space, not =, between the do and the first { following it.

So the whole thing looks like below:

Code: Select all

:foreach id in=[ip firewall address-list find list=my-list address~"^[0-9\\.]*\$"] do={local ipAddr [/ip firewall address-list get $id address];do {/ip firewall address-list set $id address=($ipAddr."/24")} on-error={log info message="duplicate address found"}}

:foreach id in=[ip firewall address-list find list=ip-scanners-list address~"^[0-9\\.]*\$"] do={local ipAddr [/ip firewall address-list get $id address];do {/ip firewal address-list set $id address=($ipAddr."/24")} on-error={/ip firewall address-list remove $id}}

I expanded a bit on your idea.

- Script takes addresses in your dynamic list
- Converts it to clean /24 network address and adds whole statement to new blacklist

Code: Select all

:foreach addr in=[/ip firewall address-list find list=dynamic_list address~"^[0-9\\.]*\$"] do={
  :local ipAddr [/ip firewall address-list get $addr address];
  :local dotPos "0";
  :local dot ".";
  :local endString ".0/24";
  :local octet1;
  :local octet2;
  :local octet3;
  :local threeOctets;
  :set dotPos [:find $ipAddr "."];
  :set octet1 [:pick $ipAddr 0 $dotPos];
  :set dotPos ($dotPos+1);
  :set octet2 [:pick $ipAddr $dotPos [:find $ipAddr "." $dotPos]];
  :set dotPos ([:find $ipAddr "." $dotPos]+1);
  :set octet3 [:pick $ipAddr $dotPos [:find $ipAddr "." $dotPos]];
  :set threeOctets ("$octet1$dot$octet2$dot$octet3$endString");
  do { /ip firewall address-list add list=blacklist_clean address=$threeOctets} on-error={} }
}

I would advise for you to set timeout on your dynamic list, so you optimize this thing a bit. Timeout should be somewhat higher than your script interval, just in case.

I'm not sure how fast hashing methods in RouterOS are, never benchmarked it. My initial idea is to have less entries in the list and (in theory) faster rule processing, because my assumption is, as you stated: less address list entries > faster firewall. Using this method you will only have a network address, not separate addresses with /24 sufix that belong to the same network.

You mentioned /16 in the future - I had that in mind as well because part of this code could be used for creating those bigger prefixes.

My script doesn't deal with deleting entries because I think that is a waste of router's resources. I suggested you set timeout on automatic list, so entries disapear on their own. You are free to see zero value in my approach, I had fun contemplating the solution.