Block "ethash.poolbinance.com" on MikroTik

Question

Can you explain me. How I can block this address from firewall on MikroTik.

I just try to add the rules with only "poolbinance.com" and other rule with "ethash.poolbinance.com"

But it is not working.

Thank you for help.

full address looks like tcp://ethash.poolbinance.com:1800

Answer 1

If your router is a DNS server for your clients, you can poll regularly DNS cache for poolbinance and block the corresponding IP:

Schedule this script every 10 seconds or so:

:global addIP do={
  :if ([:len [/ip firewall address-list find address="$nouvelleIP" and list="blockedIPs"]] = 0) do={
    /ip firewall address-list add list="blockedIPs" address=$nouvelleIP timeout=02:00:00
  }
}

:local myServers { "poolbinance" }
/ip dns cache all {
  :foreach i in=$myServers do={
    :foreach j in=[find where (name~$i)] do={
      :local myName [get $j name]
      :local myType [get $j type]
      :local myData [get $j data]
      :if ($myType = "A") do={
        $addIP nouvelleIP=$myData
       }

      :if ($myType = "CNAME") do={
        :local ipResolue [:resolve "$myData"];
         $ajouteIP nouvelleIP=$ipResolue
      }
    }
  }
}

And then add a firewall rule to block all traffic from blockedIPs list:

/ip firewall filter add action=drop src-address-list=blockedIPs