Firewall · Topic 3 of 6

Firewall Address Lists

Group addresses into named firewall address lists, use them in filter rules, and fill lists automatically with timeouts to build allow and block lists.

5 min

In a nutshell

An address list is a named group of addresses, networks or ranges.
Entries with the same list name belong to the same list.
Rules use src-address-list and dst-address-list to match a list.

What it is

An address list is a named group of IP addresses that firewall rules can refer to.

Instead of writing one rule for every address, you put the addresses into a list and write one rule for the list. When the group changes, you change the list and leave the rules alone.

A list can hold single addresses, whole networks and ranges. Entries can be added by hand, or by a firewall rule at run time.

How it works

You create the list, refer to it in a rule, and optionally let rules fill it automatically.

Creating an address list

/ip firewall address-list add list=management address=192.168.88.0/24
/ip firewall address-list add list=management address=10.10.10.5
/ip firewall address-list add list=management address=192.168.88.200-192.168.88.220
/ip firewall address-list print

All entries with the same list name form one list. An entry can be a single address, a network in prefix form, or a range.

An entry can also have a timeout. When the time runs out, RouterOS removes the entry by itself.

/ip firewall address-list add list=guests address=192.168.88.77 timeout=1d

Entries made by hand are static. Entries that have a timeout or that a rule has added are dynamic, and they carry the D flag in the print output.

Using a list in a rule

Firewall rules can match an address list as a source or as a destination.

/ip firewall filter add chain=input src-address-list=management action=accept
/ip firewall filter add chain=input action=drop

The first rule accepts management traffic only from addresses in the management list. The second rule drops everything else. Together they give a short and readable policy for the router.

The matching options are:

Parameter	Matches
`src-address-list`	The source address of the packet
`dst-address-list`	The destination address of the packet

You can negate a match with an exclamation mark. For example, src-address-list=!management matches every address that is not in the list.

Adding addresses from a rule

A rule can add the source or destination of a matching packet to a list. This turns the firewall into a small detection system.

/ip firewall filter add chain=input protocol=tcp dst-port=22 connection-state=new action=add-src-to-address-list address-list=ssh-seen address-list-timeout=1h

The action add-src-to-address-list puts the source address into the named list. The address-list-timeout option removes the entry after the given time. A matching add-dst-to-address-list action exists for destination addresses.

A common use is a block list. One rule adds the address of a misbehaving client to a list. A second rule, higher in the chain, drops everything from that list.

/ip firewall filter add chain=input src-address-list=blocked action=drop

Exam tip

Always set a timeout on lists that fill automatically, or the list grows without limit and may lock out innocent users for ever.

Typical uses

Address lists suit many tasks:

A management list that decides who may reach the router.
A list of servers that need special handling.
A block list that stops known bad sources.
A list of customers who receive a given service.

Address lists are also usable in other tables, such as NAT and mangle, so one list can serve several purposes.

Keeping lists tidy

Use clear names, and use the comment field to explain why an entry exists. Check the list from time to time and remove entries that are no longer needed.

/ip firewall address-list print where list=management
/ip firewall address-list remove numbers=0

The where condition shows only the entries of one list, which is handy when several lists exist.

Watch out

A drop rule that uses a list must sit above the accept rules for the same traffic, or the block never takes effect.

What to remember for the exam

Six facts cover this topic.

An address list is a named group of addresses, networks or ranges.
Entries with the same list name belong to the same list.
Rules use src-address-list and dst-address-list to match a list.
An entry can have a timeout, and dynamic entries carry the D flag.
add-src-to-address-list is a rule action that fills a list automatically.
Put block rules above the accept rules, so they are checked first.

Common mistakes

These four mistakes are common.

Creating a list without using it. A list does nothing until a rule refers to it.

Typing the list name differently in the rule. The name must match exactly, including the case.

Forgetting timeouts on automatic lists. The list grows and can block users for too long.

Placing the block rule too low. An earlier accept rule lets the traffic through before the block is checked.

Check yourself

Work through these three questions.

What is the benefit of an address list?
One rule can match many addresses, and you change the list instead of the rules. Entries can be single addresses, networks or ranges.
Which rule action adds the source address of a packet to a list?
add-src-to-address-list, together with address-list and address-list-timeout. The timeout removes the entry automatically.
Why should the block rule be placed above the accept rules?
Rules are checked from the top and the first match wins. An earlier accept rule would let the traffic through before the block is reached.

Topic 3 of 6 in Firewall

Test yourself on Firewall

The full MikroTik MTCNA question bank has 558 questions, with timed practice exams and an explanation for every answer.

Subscribe Try Sample Exam

This study guide is independent and is not affiliated with, endorsed by, or sponsored by MikroTik. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.