This site will give you up-to-date Mikrotik address lists for use in firewall. Query the site with ?country= and the contry code, eg. ?country=no for the Norwegian list. You can also create combined lists by adding countries separated by ,. E.g. ?country=no,dk,se for Norway, Denmark and Sweden.
Add &family= to choose the address family. It defaults to ipv4, so existing schedulers keep getting exactly what they got before.
/ip firewall address-list. The default./ipv6 firewall address-list.
IPv4 and IPv6 address lists are separate namespaces in RouterOS, so both use the same list name — one name to reference from a firewall rule of either family. Note that the IPv6 removal command is /ipv6 firewall address-list remove, not /ip; a script refreshing both needs both lines.
The following script will automatically download and periodically refresh the list for Norway, Sweden and Denmark:
/system scheduler
add interval=22h24m name=RefreshAddressList on-event=RefreshAddressList policy=\
ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon \
start-date=may/23/2017 start-time=08:43:27
/system script
add dont-require-permissions=yes name=RefreshAddressList owner=admin policy=read,write,test,sensitive source="/tool fetch url=\"https://mtworldlists.hvatum.net/\?country=no,dk,se\" mode=https output=file dst-path=country_list.rsc\r\
\n\r\
\n:log info \"Downloaded country_list.rsc from mtworldlists.hvatum.net\";\r\
\n \r\
\n/ip firewall address-list remove [find where comment ~ \"Country: no\"]\r\
\n/ip firewall address-list remove [find where comment ~ \"Country: dk\"]\r\
\n/ip firewall address-list remove [find where comment ~ \"Country: se\"]\r\
\n/import file-name=country_list.rsc;\r\
\n:log info \"Removed old country records and imported new list\";"
If you are using this list to add entries to e.g. a blacklist, remember to deactivate and reactivate that rule during list refresh.
# these are examples, do not import as stated # rule for creating blacklist /ip firewall nat add action=add-src-to-address-list address-list=blacklist address-list-timeout=1d chain=dstnat comment="add to blacklist" src-address-list=!country_no_dk_se to-addresses=10.20.30.40 # add to script RefreshAddressList, before remove statements and after import statement /ip firewall nat disable [find where comment ~ "add to blacklist"] /ip firewall nat enable [find where comment ~ "add to blacklist"]