Mikrotik : Intégrer des blacklists

Paramétrages sur le Mikrotik

/system script add name="Download_dshield" source={
/tool fetch url="http://blacklist.comasys.loc/dshield.rsc" mode=http;
:log info "Downloaded dshield.rsc from http://blacklist.comasys.loc";
}

/system script add name="Replace_dshield" source={
/ip firewall address-list remove [find where comment="DShield"]
/import file-name=dshield.rsc;
:log info "Removed old dshield records and imported new list";
}

/system scheduler add comment="Download dshield list" interval=1d name="DownloadDShieldList" on-event=Download_dshield start-date=jan/01/1970 start-time=00:19:05
/system scheduler add comment="Apply dshield List" interval=1d name="InstallDShieldList" on-event=Replace_dshield start-date=jan/01/1970 start-time=00:24:05


/ip firewall raw add action=drop chain=prerouting comment="Blacklist Dshield" log=yes src-address-list=dshield
/ip firewall filter add chain=input action=drop comment="Drop new connections from dshield" connection-state=new src-address-list=dshield in-interface=ether1
/ip firewall filter add chain=forward action=drop comment="Drop new connections from dshield" src-address-list=dshield in-interface=ether1


/system script add name="Downloadciarmy" source={
/tool fetch url="http://blacklist.comasys.loc/ciarmy.rsc" mode=http;
:log info "Downloaded Blacklist ciarmy.rsc from http://blacklist.comasys.loc";
}


/system script add name="Replaceciarmy" source={
/ip firewall address-list remove [find where comment="ciarmy"]
/import file-name=ciarmy.rsc;
:log info "Removed old ciarmy records and imported new list";
}


/system scheduler add comment="Download ciarmy list" interval=1d name="DownloadciarmyList" on-event=Downloadciarmy start-date=jan/01/1970 start-time=04:30:04
/system scheduler add comment="Apply ciarmy List" interval=1d name="InstallciarmyList" on-event=Replaceciarmy start-date=jan/01/1970 start-time=04:35:04


/ip firewall raw add action=drop chain=prerouting comment="Blacklist ciarmy" log=yes src-address-list="ciarmy"
/ip firewall filter add chain=input action=drop comment="Drop new connections from ciarmy" connection-state=new src-address-list=ciarmy in-interface=ether1
/ip firewall filter add chain=forward action=drop comment="Drop new connections from ciarmy" src-address-list=ciarmy in-interface=ether1




/system script add name="Downloadmyipms" source={
/tool fetch url="http://blacklist.comasys.loc/myipms.rsc" mode=http;
:log info "Downloaded Blacklist myipms.rsc from http://blacklist.comasys.loc";
}

/system script add name="Replacemyipms" source={
/ip firewall address-list remove [find where comment="myipms"]
/import file-name=myipms.rsc;
:log info "Removed old myipms records and imported new list";
}


/system scheduler add comment="Download myipms list" interval=1d name="DownloadmyipmsList" on-event=Downloadmyipms start-date=jan/01/1970 start-time=02:01:04
/system scheduler add comment="Apply myipms List" interval=1d name="InstallmyipmsList" on-event=Replacemyipms start-date=jan/01/1970 start-time=02:01:04


/ip firewall raw add action=drop chain=prerouting comment="Blacklist myip.ms" log=yes src-address-list=myipms
/ip firewall filter add chain=input action=drop comment="Drop new connections from myipms" connection-state=new src-address-list=myipms in-interface=ether1
/ip firewall filter add chain=forward action=drop comment="Drop new connections from myipms" src-address-list=myipms in-interface=ether1


/system script add name="Downloadcybercrime" source={
/tool fetch url="http://blacklist.comasys.loc/cybercrime2.rsc" mode=http;
:log info "Downloaded cybercrime2.rsc from http://blacklist.comasys.loc";
}

/system script add name="Replacecybercrime" source={
/ip firewall address-list remove [find where comment="cybercrime2"]
/import file-name=cybercrime2.rsc;
:log info "Removed old cybercrime records and imported new list";
}

/system scheduler add comment="Download cybercrime list" interval=1d name="Downloadcybercrime2" on-event=Downloadcybercrime start-date=jan/01/1970 start-time=05:10:04
/system scheduler add comment="Apply cybercrime List" interval=1d name="Installcybercrime2" on-event=Replacecybercrime start-date=jan/01/1970 start-time=05:15:04



/ip firewall raw add action=drop chain=prerouting comment="Blacklist cybercrime" log=yes src-address-list=cybercrime2
/ip firewall filter add chain=input action=drop comment="Drop new connections from cybercrime2" connection-state=new src-address-list=cybercrime2 in-interface=ether1
/ip firewall filter add chain=forward action=drop comment="Drop new connections from cybercrime2" src-address-list=cybercrime2 in-interface=ether1



/system script add name="Downloadblocklist" source={
/tool fetch url="http://blacklist.comasys.loc/blocklist.rsc" mode=http;
:log info "Downloaded Blacklist blocklist.rsc from http://blacklist.comasys.loc";
}


/system script add name="Replaceblocklist" source={
/ip firewall address-list remove [find where comment="blocklist"]
/import file-name=blocklist.rsc;
:log info "Removed old blocklist records and imported new list";
}


/system scheduler add comment="Download blocklist list" interval=1d name="DownloadblocklistList" on-event=Downloadblocklist start-date=jan/01/1970 start-time=02:21:04
/system scheduler add comment="Apply blocklist List" interval=1d name="InstallblocklistList" on-event=Replaceblocklist start-date=jan/01/1970 start-time=02:26:04


/ip firewall raw add action=drop chain=prerouting comment="Blacklist blocklist.de" log=yes src-address-list=blocklist
/ip firewall filter add chain=input action=drop comment="Drop new connections from blocklist" connection-state=new src-address-list=blocklist in-interface=ether1
/ip firewall filter add chain=forward action=drop comment="Drop new connections from blocklist" src-address-list=blocklist in-interface=ether1

Script de mise en forme des fichiers Mikrotik

#!/bin/sh
saveTo=/var/www/html
now=$(date);
echo "# Generated by Yakakliker.org" `date` > $saveTo/dshield.rsc
echo "/ip firewall address-list" >> $saveTo/dshield.rsc
wget -q -O - http://feeds.dshield.org/block.txt | awk --posix '/^[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.0\t/ { print "add list=dshield address=" $1 "/24 comment=DShield";}' >> $saveTo/dshield.rsc

echo "# Generated by Yakakliker.org" `date` > $saveTo/spamhaus.rsc
echo "/ip firewall address-list" >> $saveTo/spamhaus.rsc
wget -q -O - http://www.spamhaus.org/drop/drop.txt | awk --posix '/[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\// { print "add list=spamhaus address=" $1 " comment=SpamHaus";}' >> $saveTo/spamhaus.rsc

echo "# Generated by Yakakliker.org" `date` > $saveTo/spamhaus2.rsc
echo "/ip firewall address-list" >> $saveTo/spamhaus2.rsc
wget -q -O - http://www.spamhaus.org/drop/edrop.txt | awk --posix '/[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\// { print "add list=edrop address=" $1 " comment=edrop";}' >> $saveTo/spamhaus2.rsc

echo "# Generated by Yakakliker.org base 7 days" `date` > $saveTo/openbl7.rsc
echo "/ip firewall address-list" >> $saveTo/openbl7.rsc
wget -q -O - http://www.openbl.org/lists/base_7days.txt.gz | gunzip | awk --posix '/^[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}/ { print "add list=openbl7 address=" $1 " comment=OpenBL";}' >> $saveTo/openbl7.rsc

echo "# Generated by Yakakliker.org base 30 days" `date` > $saveTo/openbl30.rsc
echo "/ip firewall address-list" >> $saveTo/openbl30.rsc
wget -q -O - http://www.openbl.org/lists/base_30days.txt.gz | gunzip | awk --posix '/^[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}/ { print "add list=openbl30 address=" $1 " comment=OpenBL";}' >> $saveTo/openbl30.rsc

echo "# Generated by Yakakliker.org base 60 days" `date` > $saveTo/openbl60.rsc
echo "/ip firewall address-list" >> $saveTo/openbl60.rsc
wget -q -O - http://www.openbl.org/lists/base_60days.txt.gz | gunzip | awk --posix '/^[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}/ { print "add list=openbl60 address=" $1 " comment=OpenBL";}' >> $saveTo/openbl60.rsc

echo "# Generated by Yakakliker.org base 90 days" `date` > $saveTo/openbl90.rsc
echo "/ip firewall address-list" >> $saveTo/openbl90.rsc
wget -q -O - http://www.openbl.org/lists/base_90days.txt.gz | gunzip | awk --posix '/^[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}/ { print "add list=openbl90 address=" $1 " comment=OpenBL";}' >> $saveTo/openbl90.rsc

echo "# Generated by Yakakliker.org base 180 days" `date` > $saveTo/openbl180.rsc
echo "/ip firewall address-list" >> $saveTo/openbl180.rsc
wget -q -O - http://www.openbl.org/lists/base_180days.txt.gz | gunzip | awk --posix '/^[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}/ { print "add list=openbl180 address=" $1 " comment=OpenBL";}' >> $saveTo/openbl180.rsc

echo "# Generated by Yakakliker.org base 360 days" `date` > $saveTo/openbl360.rsc
echo "/ip firewall address-list" >> $saveTo/openbl360.rsc
wget -q -O - http://www.openbl.org/lists/base_360days.txt.gz | gunzip | awk --posix '/^[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}/ { print "add list=openbl360 address=" $1 " comment=OpenBL";}' >> $saveTo/openbl360.rsc

echo "# Generated by Yakakliker.org" `date` > $saveTo/malc0de.rsc
echo "/ip firewall address-list" >> $saveTo/malc0de.rsc
wget -q -O - http://malc0de.com/bl/IP_Blacklist.txt | awk --posix '/^[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}/ { print "add list=malc0de address=" $1 " comment=malc0de";}' >> $saveTo/malc0de.rsc

echo "# Generated by Yakakliker.org" `date` > $saveTo/tik-usg.rsc
wget -q -O - http://www.squidblacklist.org/downloads/tik-usg.rsc >> $saveTo/tik-usg.rsc

echo "# Generated by Yakakliker.org" `date` > $saveTo/myipms.rsc
echo "/ip firewall address-list" >> $saveTo/myipms.rsc
wget -q -O - https://myip.ms/files/blacklist/general/latest_blacklist.txt | awk --posix '/^[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}/ { print "add list=myipms address=" $1 " comment=myipms";}' >> $saveTo/myipms.rsc
 
echo "# Generated by Yakakliker.org" `date` > $saveTo/malwaredomainlist.rsc
echo "/ip firewall address-list" >> $saveTo/malwaredomainlist.rsc
wget -q -O - http://www.malwaredomainlist.com/hostslist/ip.txt | awk --posix '/^[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}/ sub("\r$", "") { print "add list=malwaredomainlist address=" $1 " comment=malwaredomainlist";}' >> $saveTo/malwaredomainlist.rsc

echo "# Generated by Yakakliker.org" `date` > $saveTo/blocklist.rsc
echo "/ip firewall address-list" >> $saveTo/blocklist.rsc
wget -q -O - https://lists.blocklist.de/lists/all.txt | awk --posix '/^[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}/ { print "add list=blocklist address=" $1 " comment=blocklist";}' >> $saveTo/blocklist.rsc

echo "# Generated by Yakakliker.org" `date` > $saveTo/zeustracker.rsc
echo "/ip firewall address-list" >> $saveTo/zeustracker.rsc
wget -q -O - https://zeustracker.abuse.ch/blocklist.php?download=ipblocklist | awk --posix '/^[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}/ { print "add list=zeustracker address=" $1 " comment=zeustracker";}' >> $saveTo/zeustracker.rsc
  
echo "# Generated by Yakakliker.org" `date` > $saveTo/ransomwaretracker.rsc
echo "/ip firewall address-list" >> $saveTo/ransomwaretracker.rsc
wget -q -O - http://ransomwaretracker.abuse.ch/downloads/RW_IPBL.txt | awk --posix '/^[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}/ { print "add list=ransomwaretracker address=" $1 " comment=ransomwaretracker";}' >> $saveTo/ransomwaretracker.rsc
 
echo "# Generated by Yakakliker.org" `date` > $saveTo/CryptoWall.rsc
echo "/ip firewall address-list" >> $saveTo/CryptoWall.rsc
wget -q -O - http://ransomwaretracker.abuse.ch/downloads/CW_PS_IPBL.txt | awk --posix '/^[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}/ { print "add list=CryptoWall address=" $1 " comment=CryptoWall";}' >> $saveTo/CryptoWall.rsc
 
echo "# Generated by Yakakliker.org" `date` > $saveTo/Locky.rsc
echo "/ip firewall address-list" >> $saveTo/Locky.rsc
wget -q -O - http://ransomwaretracker.abuse.ch/downloads/LY_C2_IPBL.txt | awk --posix '/^[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}/ { print "add list=Locky address=" $1 " comment=Locky";}' >> $saveTo/Locky.rsc
 
echo "# Generated by Yakakliker.org" `date` > $saveTo/Locky2.rsc
echo "/ip firewall address-list" >> $saveTo/Locky2.rsc
wget -q -O - http://ransomwaretracker.abuse.ch/downloads/LY_PS_IPBL.txt | awk --posix '/^[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}/ { print "add list=Locky2 address=" $1 " comment=Locky2";}' >> $saveTo/Locky2.rsc
 
echo "# Generated by Yakakliker.org" `date` > $saveTo/TorrentLockerC2.rsc
echo "/ip firewall address-list" >> $saveTo/TorrentLockerC2.rsc
wget -q -O - http://ransomwaretracker.abuse.ch/downloads/TL_C2_IPBL.txt | awk --posix '/^[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}/ { print "add list=TorrentLockerC2 address=" $1 " comment=TorrentLockerC2";}' >> $saveTo/TorrentLockerC2.rsc

echo "# Generated by Yakakliker.org" `date` > $saveTo/TorrentLocker.rsc
echo "/ip firewall address-list" >> $saveTo/TorrentLocker.rsc
wget -q -O - http://ransomwaretracker.abuse.ch/downloads/TL_PS_IPBL.txt | awk --posix '/^[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}/ { print "add list=TorrentLocker address=" $1 " comment=TorrentLocker";}' >> $saveTo/TorrentLocker.rsc
 
echo "# Generated by Yakakliker.org" `date` > $saveTo/Aattack30d.rsc
echo "/ip firewall address-list" >> $saveTo/Aattack30d.rsc
wget -q -O - https://raw.githubusercontent.com/firehol/blocklist-ipsets/master/atlas_attacks_30d.ipset | awk --posix '/^[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}/ { print "add list=Aattack30d address=" $1 " comment=Aattack30d";}' >> $saveTo/Aattack30d.rsc

echo "# Generated by Yakakliker.org" `date` > $saveTo/Abotnets30d.rsc
echo "/ip firewall address-list" >> $saveTo/Abotnets30d.rsc
wget -q -O - https://raw.githubusercontent.com/firehol/blocklist-ipsets/master/atlas_botnets_30d.ipset | awk --posix '/^[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}/ { print "add list=Abotnets30d address=" $1 " comment=Abotnets30d";}' >> $saveTo/Abotnets30d.rsc

echo "# Generated by Yakakliker.org" `date` > $saveTo/Afastflux30d.rsc
echo "/ip firewall address-list" >> $saveTo/Afastflux30d.rsc
wget -q -O - https://raw.githubusercontent.com/firehol/blocklist-ipsets/master/atlas_fastflux_30d.ipset | awk --posix '/^[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}/ { print "add list=Afastflux30d address=" $1 " comment=Afastflux30d";}' >> $saveTo/Afastflux30d.rsc

echo "# Generated by Yakakliker.org" `date` > $saveTo/Aphishing30d.rsc
echo "/ip firewall address-list" >> $saveTo/Aphishing30d.rsc
wget -q -O - https://raw.githubusercontent.com/firehol/blocklist-ipsets/master/atlas_phishing_30d.ipset | awk --posix '/^[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}/ { print "add list=Aphishing30d address=" $1 " comment=Aphishing30d";}' >> $saveTo/Aphishing30d.rsc
 
echo "# Generated by Yakakliker.org" `date` > $saveTo/Ascans30d.rsc
echo "/ip firewall address-list" >> $saveTo/Ascans30d.rsc
wget -q -O - https://raw.githubusercontent.com/firehol/blocklist-ipsets/master/atlas_scans_30d.ipset | awk --posix '/^[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}/ { print "add list=Ascans30d address=" $1 " comment=Ascans30d";}' >> $saveTo/Ascans30d.rsc
 
echo "# Generated by Yakakliker.org" `date` > $saveTo/Biany230d.rsc
echo "/ip firewall address-list" >> $saveTo/Biany230d.rsc
wget -q -O - https://raw.githubusercontent.com/firehol/blocklist-ipsets/master/bi_any_2_30d.ipset | awk --posix '/^[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}/ { print "add list=Biany230d address=" $1 " comment=Biany230d";}' >> $saveTo/Biany230d.rsc
 
echo "# Generated by Yakakliker.org" `date` > $saveTo/ciarmy.rsc
echo "/ip firewall address-list" >> $saveTo/ciarmy.rsc
wget -q -O - https://raw.githubusercontent.com/firehol/blocklist-ipsets/master/ciarmy.ipset | awk --posix '/^[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}/ { print "add list=ciarmy address=" $1 " comment=ciarmy";}' >> $saveTo/ciarmy.rsc
 
echo "# Generated by Yakakliker.org" `date` > $saveTo/asproxc2.rsc
echo "/ip firewall address-list" >> $saveTo/asproxc2.rsc
wget -q -O - https://raw.githubusercontent.com/firehol/blocklist-ipsets/master/asprox_c2.ipset | awk --posix '/^[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}/ { print "add list=asproxc2 address=" $1 " comment=asproxc2";}' >> $saveTo/asproxc2.rsc

echo "# Generated by Yakakliker.org" `date` > $saveTo/cybercrime.rsc
echo "/ip firewall address-list" >> $saveTo/cybercrime.rsc
wget -q -O - https://iplists.firehol.org/files/cybercrime.ipset | awk --posix '/^[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}/ sub("\r$", "") { print "add list=cybercrime address=" $1 " comment=cybercrime";}' >> $saveTo/cybercrime.rsc

echo "# Generated by Yakakliker.org" `date` > $saveTo/cybercrime2.rsc
echo "/ip firewall address-list" >> $saveTo/cybercrime2.rsc
wget -q -O - https://iplists.firehol.org/files/cybercrime.ipset | awk --posix '/^[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}/ { print "add list=cybercrime2 address=" $1 " comment=cybercrime2";}' >> $saveTo/cybercrime2.rsc

Liens

http://joshaven.com/resources/tricks/mikrotik-automatically-updated-address-list/

https://iplists.firehol.org/