Manual:IP/Firewall/Address list

From CableFree RadioOS
Jump to navigation Jump to search

Applies to RadioOS: 2.9, v3, v4 +


Sub-menu: /ip firewall address-list

Firewall address lists allow a user to create lists of IP addresses grouped together under a common name. Firewall filter, mangle and NAT facilities can then use those address lists to match packets against them.

The address list records can also be updated dynamically via the action=add-src-to-address-list or action=add-dst-to-address-list items found in NAT, Mangle and Filter facilities.


Property Description
address (IP address/netmask | IP-IP; Default: ) A single IP address or range of IPs to add to address list. You can input for example, '' and it will auto modify the typed entry to on saving.
list (string; Default: ) Name for the address list of the added IP address


The following example creates a dynamic address list of people that are connecting to port 23 (telnet) on the router and drops all further traffic from them for 5 minutes. Additionally, the address list will also contain one static address list entry of (

/ip firewall address-list add list=drop_traffic address=
/ip firewall address-list print
Flags: X - disabled, D - dynamic
 #   LIST         ADDRESS
 0   drop_traffic
/ip firewall mangle add action=add-src-to-address-list address-list=drop_traffic \
    address-list-timeout=5m chain=prerouting dst-port=23 protocol=tcp
/ip firewall filter add action=drop chain=input src-address-list=drop_traffic
/ip firewall address-list print
Flags: X - disabled, D - dynamic
 #   LIST         ADDRESS
 0   drop_traffic
 1 D drop_traffic
 2 D drop_traffic

As seen in the output of the last print command, two new dynamic entries appeared in the address list (marked with a status of 'D'). Hosts with these IP addresses tried to initialize a telnet session to the router and were then subsequently dropped by the filter rule.

[ Top | Back to Content ]