Krawl to RouterOS Auto Blocking


Before you start: Make sure you've set KRAWL_DASHBOARD_SECRET_PATH in your Krawl Docker environment variables. If you skip this, the dashboard URL changes every time the container restarts and you'll have to update the script each time.


1. Add the Script

Log into your RouterOS WebFig and make sure Advanced Mode is enabled.
Go to System > Scripts, click +, name it krawl-blocker, and set the policy to ftp, read, write, and test.
Paste the script below into the Source box, and update the :local url line at the top to point to your Krawl instance:

:local url "https://your-krawl-instance/your-dashboard-path/api/export-ips?categories=attacker&fwtype=raw"
:local listName "krawl-blocklist"
:local fileName "malicious_ips.txt"
:do {
    /tool fetch url=$url dst-path="/$fileName"
    :local content [/file get [/file find name=$fileName] contents]
    :local contentLen [:len $content]
    :local lastEnd 0
    :local added 0
    :local skipped 0
    :local total 0
    :local lineEnd 0
    :local line ""
    :do {
        :set lineEnd [:find $content "\n" $lastEnd]
        :if ($lineEnd = -1) do={ :set lineEnd $contentLen }
        :set line [:pick $content $lastEnd $lineEnd]
        :set lastEnd ($lineEnd + 1)
        :if ([:len $line] > 0) do={
            :if ([:pick $line 0 1] != "#") do={
                :set total ($total + 1)
                :if ([:len [/ip firewall address-list find list=$listName address=$line]] = 0) do={
                    /ip firewall address-list add list=$listName address=$line comment="krawl" timeout=7d
                    :set added ($added + 1)
                } else={
                    :set skipped ($skipped + 1)
                }
            }
        }
    } while ($lastEnd < $contentLen)
    /file remove $fileName
    :log info "Krawl: $total total, $added added, $skipped already blocked"
} on-error={
    :log warning "Krawl: update failed"
}

The example above blocks IPs marked as attackers only. To also block bad crawlers or other categories, see the Firewall Exporters documentation.

Tip: By default, blocked IPs expire after 7 days. To block them permanently, remove timeout=7d from the address-list line.


2. Schedule It

Go to System > Scheduler and add a new entry:

  • Name: krawl-update
  • Interval: 00:05:00
  • On Event: /system script run krawl-blocker
  • Policy: ftp, read, write, test

3. Block the Traffic

Go to IP > Firewall > Raw and add a new rule:

  • Chain: prerouting
  • Src. Address List: krawl-blocklist
  • In. Interface: ether1 (change this to your incoming WAN port)
  • Action: drop

Testing

Run the script manually once from System > Scripts and check System > Log for the output. You should see something like:
Krawl: 12 total, 4 added, 8 already blocked
If that looks good, you're all set. It will run automatically every 5 minutes from here.


Updated for v2.1.0, 2026-05-17

Edit

Pub: 31 Jan 2026 21:43 UTC

Edit: 17 May 2026 20:31 UTC

Views: 64