类别: AI技术分享    来源：www.nanyuetong.com

摘要：# ========================================== # [配置 1] 黑名单域名 # ========================================== :local BlackList {"4399.com"; "florr.io"; "7k7k.com"; "bilibili.com"} # ========================================== # [配置 2] 白名单 IP (老板特权) # 格式：{"IP1"; "IP2"} # ====...

# ==========================================
# [配置 1] 黑名单域名
# ==========================================
:local BlackList {"4399.com"; "florr.io"; "7k7k.com"; "bilibili.com"}

# ==========================================
# [配置 2] 白名单 IP (老板特权)
# 格式：{"IP1"; "IP2"}
# ==========================================
:local WhiteListIPs {"192.168.2.203"}

# ==========================================
# [逻辑区域]
# ==========================================

# --- 1. 更新白名单列表 ---
/ip firewall address-list
remove [find list="DNS-Allow-List"]
:foreach IP in=$WhiteListIPs do={
    add list="DNS-Allow-List" address=$IP comment="Script-Added-Whitelist"
    :put ("已添加白名单 IP: " . $IP)
}

# --- 2. 配置 NAT 劫持策略 (核心修复部分) ---
/ip firewall nat

# 2.1 清理旧规则
remove [find comment="Force-DNS-To-Router"]
remove [find comment="Force-Allow-External"]

# 2.2 [特权规则] 白名单 IP -> 强制转发给阿里 DNS (223.5.5.5)
# 这样它就不会用到路由器的黑名单，也不会因为电脑设错DNS而无法上网
add chain=dstnat src-address-list=DNS-Allow-List protocol=udp dst-port=53 action=dst-nat to-addresses=223.5.5.5 to-ports=53 comment="Force-Allow-External" place-before=0
add chain=dstnat src-address-list=DNS-Allow-List protocol=tcp dst-port=53 action=dst-nat to-addresses=223.5.5.5 to-ports=53 comment="Force-Allow-External" place-before=0

# 2.3 [普通规则] 其他人 -> 强制劫持给路由器 (进入黑名单流程)
add chain=dstnat src-address-list=!DNS-Allow-List protocol=udp dst-port=53 action=redirect to-ports=53 comment="Force-DNS-To-Router"
add chain=dstnat src-address-list=!DNS-Allow-List protocol=tcp dst-port=53 action=redirect to-ports=53 comment="Force-DNS-To-Router"

# --- 3. 部署黑名单 (保持不变) ---
/ip dns static
:local oldRules [find comment="GAME-BLOCK"]
:if ([:len $oldRules] > 0) do={ remove $oldRules }

:foreach Domain in=$BlackList do={
    add name=$Domain address=127.0.0.1 ttl=1m disabled=yes comment="GAME-BLOCK"
    add regexp=(".*" . $Domain) address=127.0.0.1 ttl=1m disabled=yes comment="GAME-BLOCK"
    :put ("已更新黑名单: " . $Domain)
}

# --- 4. 刷新缓存 ---
/ip dns cache flush
:put "修复完成！白名单 192.168.2.203 现在会被强制指向 223.5.5.5。"

第二步：创建“一键封锁”脚本 (Block-ON)

以后你想封杀网络时，不用再敲代码了。 去 System -> Scripts，点加号，名字叫Block-ON，内容填入：

# --- 开启封锁 ---
# 1. 找到所有标记为 GAME-BLOCK 的规则，并启用
/ip dns static enable [find comment="GAME-BLOCK"]

# 2. 必须清空缓存，否则刚才访问过的人还能继续玩
/ip dns cache flush

:log info "游戏封锁已开启！(Game Block Enabled)"

第三步：创建“一键解封”脚本 (Block-OFF)

去 System -> Scripts，点加号，名字叫Block-OFF，内容填入：

# --- 关闭封锁 ---
# 1. 找到所有标记为 GAME-BLOCK 的规则，并禁用
/ip dns static disable [find comment="GAME-BLOCK"]

# 2. 同样必须清空缓存，让正确的 IP 立即生效
/ip dns cache flush

:log info "游戏封锁已解除！(Game Block Disabled)"