Krawl to RouterOS auto blocking
Before you start
Make sure you've set KRAWL_DASHBOARD_SECRET_PATH in your Krawl Docker environment variables. If you skip this the dashboard URL changes every time the container restarts and you'll have to update the script each time.
1. Add the Script
Log into your RouterOS WebFig and make sure Advanced Mode is enabled.
Go to System > Scripts, click +, name it krawl-blocker and set the policy to ftp, read, write and test.
Paste the script below into the Source box. Just update the url variable to point to your Krawl instance:
By default blocked IPs expire after 7 days. If you want them to stick around permanently just remove the
timeout=7dpart from this line:
2. Schedule it
Go to System > Scheduler and add a new entry:
- Name:
krawl-update - Interval:
00:05:00 - On Event:
/system script run krawl-blocker - Policy:
ftp,read,write,test
3. Block the traffic
Go to IP > Firewall > Raw and add a new rule:
- Chain:
prerouting - Action:
drop - In. Interface:
ether1(change this to whatever your WAN port is) - Src. Address List:
krawl-blocklist
Test it
Run the script manually once from System > Scripts and check System > Log for the output. Should show something like Krawl: 12 total, 4 added, 8 already blocked. If that looks good you're all set, it'll run every 5 minutes from here.
Written by u/KetchupDead - 2026-01-31