Krawl to RouterOS auto blocking


Before you start
Make sure you've set KRAWL_DASHBOARD_SECRET_PATH in your Krawl Docker environment variables. If you skip this the dashboard URL changes every time the container restarts and you'll have to update the script each time.

1. Add the Script

Log into your RouterOS WebFig and make sure Advanced Mode is enabled.

Go to System > Scripts, click +, name it krawl-blocker and set the policy to ftp, read, write and test.

Paste the script below into the Source box. Just update the url variable to point to your Krawl instance:

:local url "https://your-krawl-instance/your-dashboard-path/api/get_banlist?fwtype=raw"
:local listName "krawl-blocklist"
:local fileName "malicious_ips.txt"
:do {
    /tool fetch url=$url dst-path="/$fileName"
    :local content [/file get [/file find name=$fileName] contents]
    :local contentLen [:len $content]
    :local lastEnd 0
    :local added 0
    :local skipped 0
    :local total 0
    :local lineEnd 0
    :local line ""
    :do {
        :set lineEnd [:find $content "\n" $lastEnd]
        :if ($lineEnd = -1) do={ :set lineEnd $contentLen }
        :set line [:pick $content $lastEnd $lineEnd]
        :set lastEnd ($lineEnd + 1)
        :if ([:len $line] > 0) do={
            :if ([:pick $line 0 1] != "#") do={
                :set total ($total + 1)
                :if ([:len [/ip firewall address-list find list=$listName address=$line]] = 0) do={
                    /ip firewall address-list add list=$listName address=$line comment="krawl" timeout=7d
                    :set added ($added + 1)
                } else={
                    :set skipped ($skipped + 1)
                }
            }
        }
    } while ($lastEnd < $contentLen)
    /file remove $fileName
    :log info "Krawl: $total total, $added added, $skipped already blocked"
} on-error={
    :log warning "Krawl: update failed"
}

By default blocked IPs expire after 7 days. If you want them to stick around permanently just remove the timeout=7d part from this line:

/ip firewall address-list add list=$listName address=$line comment="krawl" timeout=7d

2. Schedule it

Go to System > Scheduler and add a new entry:

  • Name: krawl-update
  • Interval: 00:05:00
  • On Event: /system script run krawl-blocker
  • Policy: ftp, read, write, test

3. Block the traffic

Go to IP > Firewall > Raw and add a new rule:

  • Chain: prerouting
  • Action: drop
  • In. Interface: ether1 (change this to whatever your WAN port is)
  • Src. Address List: krawl-blocklist

Test it

Run the script manually once from System > Scripts and check System > Log for the output. Should show something like Krawl: 12 total, 4 added, 8 already blocked. If that looks good you're all set, it'll run every 5 minutes from here.


Written by u/KetchupDead - 2026-01-31

Edit

Pub: 31 Jan 2026 21:43 UTC

Edit: 03 Mar 2026 21:39 UTC

Views: 19