用 RouterOS 限制 IPv6 出海访问 让海外应用回落 IPv4#

1
/ipv6 firewall filter
2
add action=accept chain=input comment="Allow established/related" connection-state=established,related,untracked
3
add action=drop chain=input comment="Drop invalid" connection-state=invalid
4
add action=accept chain=input comment="Allow ICMPv6" protocol=icmpv6
5
add action=accept chain=input comment="Allow DHCPv6-PD" dst-port=546 protocol=udp src-address=fe80::/10
6
add action=accept chain=input comment="Allow LAN to router" in-interface-list=LAN
7
add action=drop chain=input comment="Drop WAN to router" in-interface-list=WAN
8
add action=accept chain=forward comment="Allow established/related" connection-state=established,related,untracked
9
add action=drop chain=forward comment="Drop invalid" connection-state=invalid
10
add action=accept chain=forward comment="Allow ICMPv6" protocol=icmpv6
11
add action=accept chain=forward comment="Allow China IPv6" dst-address-list=CN_IPv6 in-interface-list=LAN
12
add action=drop chain=forward comment="Block non-China IPv6" in-interface-list=LAN out-interface-list=WAN
13
add action=accept chain=forward comment="Allow LAN outbound" disabled=yes in-interface-list=LAN
14
add action=drop chain=forward comment="Drop unsolicited WAN to LAN" in-interface-list=WAN

1
add action=accept chain=forward comment="Allow China IPv6" dst-address-list=CN_IPv6 in-interface-list=LAN
2
add action=drop chain=forward comment="Block non-China IPv6" in-interface-list=LAN out-interface-list=WAN

1
# ============================================================
2
# Update China IPv6 address-list from IPdeny
3
# RouterOS 7.14+
4
# ============================================================
5

6
:local url "https://www.ipdeny.com/ipv6/ipaddresses/aggregated/cn-aggregated.zone"
7
:local fileName "cn-ipv6.zone"
8
:local targetList "CN_IPv6"
9
:local stageList "CN_IPv6_STAGE"
10
:local chunkSize 32768
11

12
:log info "CN-IPv6: starting update"
13

14
# 删除旧下载文件
15
:if ([:len [/file find name=$fileName]] > 0) do={
16
    /file remove [find name=$fileName]
17
}
18

19
# 删除上次残留的临时列表
20
/ipv6 firewall address-list remove [find list=$stageList]
21

22
# 下载
23
:do {
24
    /tool fetch \
25
        url=$url \
26
        dst-path=$fileName \
27
        keep-result=yes \
28
        duration=30s
29
} on-error={
30
    :log error "CN-IPv6: download failed"
31
    :error "Download failed"
32
}
33

34
:delay 1s
35

36
:if ([:len [/file find name=$fileName]] = 0) do={
37
    :log error "CN-IPv6: file not found"
38
    :error "File not found"
39
}
40

41
:local fileSize [/file get [find name=$fileName] size]
42

43
:log info ("CN-IPv6: downloaded, size=" . $fileSize)
44

45
# 文件异常保护
46
:if ($fileSize < 10000) do={
47
    /file remove [find name=$fileName]
48
    :log error "CN-IPv6: downloaded file too small"
49
    :error "Invalid file"
50
}
51

52
# ============================================================
53
# 分块解析
54
# 文件内容本身就是：
55
#
56
# 2001:xxxx::/32
57
# 2400:xxxx::/32
58
# ...
59
#
60
# ============================================================
61

62
:local offset 0
63
:local pending ""
64

65
:while ($offset < $fileSize) do={
66

67
    :local result [/file/read \
68
        file=$fileName \
69
        offset=$offset \
70
        chunk-size=$chunkSize \
71
        as-value]
72

73
    :local data ($result->"data")
74

75
    :if ([:len $data] = 0) do={
76
        :set offset $fileSize
77
    } else={
78

79
        :local buffer ($pending . $data)
80
        :local pos 0
81
        :local nl [:find $buffer "\n" $pos]
82

83
        :while ([:typeof $nl] != "nil") do={
84

85
            :local line [:pick $buffer $pos $nl]
86

87
            # 去掉 CR
88
            :if ([:len $line] > 0) do={
89
                :if ([:pick $line ([:len $line] - 1) [:len $line]] = "\r") do={
90
                    :set line [:pick $line 0 ([:len $line] - 1)]
91
                }
92
            }
93

94
            :if ([:len $line] > 2) do={
95

96
                :do {
97
                    /ipv6 firewall address-list add \
98
                        list=$stageList \
99
                        address=$line \
100
                        comment="CN-IPdeny"
101
                } on-error={
102
                    :log warning ("CN-IPv6: failed " . $line)
103
                }
104
            }
105

106
            :set pos ($nl + 1)
107
            :set nl [:find $buffer "\n" $pos]
108
        }
109

110
        :set pending [:pick $buffer $pos [:len $buffer]]
111

112
        :set offset ($offset + [:len $data])
113
    }
114
}
115

116
# 最后一行
117
:if ([:len $pending] > 2) do={
118

119
    :do {
120
        /ipv6 firewall address-list add \
121
            list=$stageList \
122
            address=$pending \
123
            comment="CN-IPdeny"
124
    } on-error={}
125
}
126

127
# ============================================================
128
# 检查结果
129
# ============================================================
130

131
:local count [/ipv6 firewall address-list print count-only where list=$stageList]
132

133
:log info ("CN-IPv6: parsed prefixes=" . $count)
134

135
# 防止下载异常导致清空旧列表
136
:if ($count < 100) do={
137

138
    :log error ("CN-IPv6: invalid list, count=" . $count)
139

140
    /ipv6 firewall address-list remove [find list=$stageList]
141

142
    :if ([:len [/file find name=$fileName]] > 0) do={
143
        /file remove [find name=$fileName]
144
    }
145

146
    :error "CN IPv6 update rejected"
147
}
148

149
# ============================================================
150
# 替换正式列表
151
# ============================================================
152

153
/ipv6 firewall address-list remove [find list=$targetList]
154

155
:foreach id in=[/ipv6 firewall address-list find list=$stageList] do={
156
    /ipv6 firewall address-list set $id list=$targetList
157
}
158

159
# 删除下载文件
160
/file remove [find name=$fileName]
161

162
:local finalCount [/ipv6 firewall address-list print count-only where list=$targetList]
163

164
:log info ("CN-IPv6: update completed, prefixes=" . $finalCount)