Krawl to RouterOS Auto Blocking
Before you start: Make sure you've set KRAWL_DASHBOARD_SECRET_PATH in your Krawl Docker environment variables. If you skip this, the dashboard URL changes every time the container restarts and you'll have to update the script each time.
1. Add the Script
Log into your RouterOS WebFig and make sure Advanced Mode is enabled.
Go to System > Scripts, click +, name it krawl-blocker, and set the policy to ftp, read, write, and test.
Paste the script below into the Source box, and update the :local url line at the top to point to your Krawl instance:
The example above blocks IPs marked as attackers only. To also block bad crawlers or other categories, see the Firewall Exporters documentation.
Tip: By default, blocked IPs expire after 7 days. To block them permanently, remove
timeout=7dfrom the address-list line.
2. Schedule It
Go to System > Scheduler and add a new entry:
- Name:
krawl-update - Interval:
00:05:00 - On Event:
/system script run krawl-blocker - Policy:
ftp,read,write,test
3. Block the Traffic
Go to IP > Firewall > Raw and add a new rule:
- Chain:
prerouting - Src. Address List:
krawl-blocklist - In. Interface:
ether1(change this to your incoming WAN port) - Action:
drop
Testing
Run the script manually once from System > Scripts and check System > Log for the output. You should see something like:
Krawl: 12 total, 4 added, 8 already blocked
If that looks good, you're all set. It will run automatically every 5 minutes from here.
Updated for v2.1.0, 2026-05-17