Address Lists in MikroTik: Static and Dynamic Lists

Address Lists in RouterOS

Address lists are one of the most powerful and flexible features in RouterOS. They let you group IP addresses together and then reference that group in firewall rules, routing policies, or other configurations. This eliminates the need to write repetitive rules for each individual IP.

What is an Address List?

An address list is simply a named collection of IP addresses, ranges, or subnets. Instead of writing a firewall rule for each address individually, you write one rule that references the list.

Creating Static Address Lists

Adding Single IPs

/ip firewall address-list add list=trusted-admins address=192.168.1.10 comment="Admin workstation"
/ip firewall address-list add list=trusted-admins address=192.168.1.11 comment="Backup admin laptop"

Adding Subnets

/ip firewall address-list add list=internal-networks address=192.168.1.0/24
/ip firewall address-list add list=internal-networks address=192.168.2.0/24
/ip firewall address-list add list=internal-networks address=10.0.0.0/8

Adding IP Ranges

/ip firewall address-list add list=blocked-users address=192.168.1.100-192.168.1.120

Viewing Address Lists

/ip firewall address-list print

To filter by list name:

/ip firewall address-list print where list=trusted-admins

Using Address Lists in Firewall Rules

Once you have a list, reference it with src-address-list or dst-address-list in firewall rules:

/ip firewall filter add chain=input src-address-list=trusted-admins action=accept comment="Allow admin access"
/ip firewall filter add chain=input src-address-list=blocked-users action=drop comment="Block restricted users"

Blocking an Entire List from Internet Access

/ip firewall filter add chain=forward src-address-list=blocked-users out-interface=pppoe-out1 action=drop comment="Block internet for restricted users"

Dynamic Address List Entries

Dynamic entries are added and removed automatically, either by firewall rules or by other RouterOS features. They are identified by a D flag in the address list.

Adding Entries Dynamically via Firewall

You can add IPs to an address list dynamically using the add-src-to-address-list or add-dst-to-address-list action in firewall rules.

Example — detect port scanners and block them:

/ip firewall filter add chain=input protocol=tcp psd=21,3s,3,1 action=add-src-to-address-list address-list=port-scanners address-list-timeout=1d comment="Detect port scanners"
/ip firewall filter add chain=input src-address-list=port-scanners action=drop comment="Drop port scanners"

The first rule adds any IP that triggers the port scan detector to the port-scanners list for 1 day. The second rule drops all traffic from that list.

Timeout-Based Dynamic Entries

The address-list-timeout parameter controls how long a dynamically added entry stays in the list:

• address-list-timeout=30m — entry expires after 30 minutes.
• address-list-timeout=1d — entry expires after 1 day.
• address-list-timeout=00:00:00 or 0 — entry never expires (permanent dynamic entry).

Brute Force Protection Example

Block IPs that attempt too many SSH connections:

/ip firewall filter add chain=input protocol=tcp dst-port=22 connection-state=new src-address-list=ssh-blacklist action=drop comment="Drop SSH brute force"
/ip firewall filter add chain=input protocol=tcp dst-port=22 connection-state=new src-address-list=ssh-stage3 action=add-src-to-address-list address-list=ssh-blacklist address-list-timeout=10d comment="Stage 3 to blacklist"
/ip firewall filter add chain=input protocol=tcp dst-port=22 connection-state=new src-address-list=ssh-stage2 action=add-src-to-address-list address-list=ssh-stage3 address-list-timeout=1m
/ip firewall filter add chain=input protocol=tcp dst-port=22 connection-state=new src-address-list=ssh-stage1 action=add-src-to-address-list address-list=ssh-stage2 address-list-timeout=1m
/ip firewall filter add chain=input protocol=tcp dst-port=22 connection-state=new action=add-src-to-address-list address-list=ssh-stage1 address-list-timeout=1m

This creates a staged system: after 3 new SSH connections within 1 minute, the IP is blacklisted for 10 days.

Removing Entries

Remove a specific static entry:

/ip firewall address-list remove [find list=blocked-users address=192.168.1.105]

Remove all entries in a list:

/ip firewall address-list remove [find list=port-scanners]

Address Lists and NAT

You can also use address lists in NAT rules:

/ip firewall nat add chain=srcnat src-address-list=internal-networks action=masquerade out-interface=pppoe-out1

This applies NAT masquerade for all subnets in the internal-networks list.

Address Lists for Routing

Address lists can feed into routing marks using mangle:

/ip firewall mangle add chain=prerouting src-address-list=vip-users action=mark-routing new-routing-mark=vip-route

Common Use Cases Summary

• Whitelist: Allow specific IPs to access management services.
• Blacklist: Block known bad IPs or dynamic attackers.
• Port scanner detection: Auto-block scanners.
• Brute force protection: Stage-based SSH/Winbox brute force blocking.
• Group NAT: Apply NAT to multiple subnets via one list.
• Policy routing: Route specific users through different WAN links.

Summary

• Create lists with /ip firewall address-list add list=name address=...
• Reference lists in firewall rules with src-address-list or dst-address-list.
• Add dynamic entries using add-src-to-address-list action.
• Control lifetime with address-list-timeout.
• Use lists to simplify complex firewall policies and enable automated security responses.