Network
Block Common VPN Servers (Address List) — v6 & v7

Creates an address list called VPN with about 90 known VPN server ranges and adds a drop rule at the top of the forward chain. Safe to run again - existing entries are skipped.
RouterOS v6 & v7
# EN: Address-list name | AR: اسم قائمة العناوين
:local listName "VPN";

# EN: Known VPN server ranges | AR: نطاقات سيرفرات VPN المعروفة
:local ranges {
        "68.183.223.0/24"; "172.241.140.0/24"; "176.31.211.0/24"; "207.180.230.0/24";
        "78.108.178.0/24"; "188.138.9.0/24"; "149.202.5.0/24"; "51.15.84.0/24";
        "109.169.53.0/24"; "40.113.161.0/24"; "52.155.93.0/24"; "207.148.83.0/24";
        "149.56.107.0/24"; "46.4.24.0/24"; "104.104.54.0/24"; "178.32.136.127";
        "51.159.3.0/24"; "51.15.78.0/24"; "40.113.162.0/24"; "104.104.55.0/24";
        "198.16.78.0/24"; "185.209.179.0/24"; "198.16.76.0/24"; "217.138.197.0/24";
        "157.230.100.0/24"; "138.68.240.0/24"; "195.154.225.0/24"; "163.172.28.0/24";
        "194.124.33.0/24"; "198.16.66.0/24"; "198.16.70.0/24"; "167.71.137.0/24";
        "142.93.42.0/24"; "209.97.183.0/24"; "37.139.20.0/24"; "196.53.10.0/24";
        "104.243.213.0/24"; "63.246.135.0/24"; "186.233.185.0/24"; "3.93.187.0/24";
        "34.228.145.0/24"; "117.121.211.170"; "51.75.169.0/24"; "51.15.129.0/24";
        "67.220.180.0/24"; "185.209.178.0/24"; "196.53.0.0/24"; "104.243.212.0/24";
        "63.246.128.0/24"; "34.243.86.0/24"; "3.121.223.0/24"; "15.223.57.0/24";
        "46.51.134.0/24"; "107.158.144.0/24"; "34.242.105.0/24"; "18.216.110.0/24";
        "3.94.163.0/24"; "3.8.215.0/24"; "35.183.186.0/24"; "34.250.168.0/24";
        "34.242.35.0/24"; "3.8.122.0/24"; "3.88.182.0/24"; "54.242.248.0/24";
        "37.48.76.0/24"; "37.48.80.0/24"; "149.56.28.0/24"; "51.15.62.0/24";
        "109.169.66.0/24"; "78.108.180.0/24"; "68.183.36.0/24"; "193.108.118.0/24";
        "38.143.66.0/24"; "62.210.88.0/24"; "38.75.137.0/24"; "5.180.79.0/24";
        "51.38.81.0/24"; "116.203.100.0/24"; "104.248.113.0/24"; "5.183.102.0/24";
        "54.37.204.0/24"; "103.124.107.0/24"; "178.62.98.0/24"; "195.154.27.240";
        "179.43.189.82"; "134.209.172.240"; "165.227.112.0/24"; "198.16.74.0/24";
};

# EN: Add each range (existing ones are skipped) | AR: إضافة كل نطاق (الموجود مسبقاً يتم تخطيه)
:foreach r in=$ranges do={
    :do { /ip firewall address-list add list=$listName address=$r comment="vpn-range" } on-error={}
}

# EN: Shared CDN ranges, kept DISABLED so normal sites are not blocked | AR: نطاقات CDN مشتركة موقوفة حتى لا تُحظر مواقع عادية
:foreach r in={"151.101.18.0/24"; "151.101.38.0/24"} do={
    :do { /ip firewall address-list add list=$listName address=$r disabled=yes comment="vpn-range (cdn, disabled)" } on-error={}
}

# EN: Drop rule, placed at the top of the forward chain | AR: قاعدة الحظر في أعلى سلسلة forward
/ip firewall filter add place-before=0 chain=forward dst-address-list=VPN action=drop comment="Block VPN address-list"