Hotspot Users

Hotspot Blacklist to MAC Block — v6 & v7

Companion to the brute-force rules: for every IP in the hotspot_blacklist it finds the MAC address from the ARP table, adds a permanent 'blocked' IP binding for that MAC and removes the IP from the list. Useful when the DHCP lease is short and the attacker gets a new IP.

RouterOS v6 & v7

Script notes

RouterOS v6 & v7 · Where to run: Terminal (creates the script), then System > Scheduler

Note: Works together with the Hotspot Brute-Force Protection rules, which fill the hotspot_blacklist. It runs every minute so it acts before the 3-hour entry expires. A device is blocked only if its MAC is found in the ARP table. To unblock, remove the binding from IP > Hotspot > IP Bindings.

RouterOS v6 و v7 · مكان التشغيل: Terminal (ينشئ السكربت) ثم System > Scheduler

ملاحظة: يعمل مع قواعد Hotspot Brute-Force Protection التي تملأ القائمة hotspot_blacklist. يعمل كل دقيقة ليتصرف قبل انتهاء مدة الـ 3 ساعات. يتم حظر الجهاز فقط إذا وُجد الـ MAC في جدول ARP. لإلغاء الحظر احذف الـ binding من IP > Hotspot > IP Bindings.

/system script add name=hotspot_blacklist_to_mac source={
    # EN: Every dynamic entry in the brute-force blacklist | AR: كل عنصر ديناميكي في القائمة السوداء
    :foreach e in=[/ip firewall address-list find where list=hotspot_blacklist dynamic=yes] do={
        :local ip [/ip firewall address-list get $e address];
        # EN: Find the MAC of this IP in the ARP table | AR: إيجاد الـ MAC لهذا الـ IP من جدول ARP
        :local arp [/ip arp find where address=$ip];
        :if ([:len $arp] > 0) do={
            :local mac [/ip arp get [:pick $arp 0] mac-address];
            # EN: Add the block binding once | AR: إضافة الحظر مرة واحدة فقط
            :if ([:len [/ip hotspot ip-binding find where mac-address=$mac type=blocked]] = 0) do={
                /ip hotspot ip-binding add type=blocked mac-address=$mac comment="blocked by brute-force script";
            }
            /ip firewall address-list remove $e;
            :log warning ("Hotspot: blocked MAC " . $mac . " (" . $ip . ")");
        }
    }
}

# EN: Run it every minute so it acts before the 3h blacklist entry expires | AR: تشغيله كل دقيقة ليعمل قبل انتهاء مدة القائمة السوداء (3 ساعات)
/system scheduler add name=hotspot_blacklist_to_mac interval=1m on-event=hotspot_blacklist_to_mac