Blocked domains cannot be opened from the customer network; on v7 the gambling/ad lists update themselves from the internet (adlist).

Every customer is forced to use the router's DNS (DNS requests to other servers are redirected), and the router answers blocked domains with an empty address. RouterOS v7.15+ has adlist: the router downloads lists of thousands of domains (ads, malware, gambling) and refreshes them itself. On v6 domains are written one by one as static DNS. Sites stay blocked even over HTTPS, because the name is blocked, not the content.

• The router's DNS needs upstream servers (/ip dns servers) and port 53 from the WAN must be closed (Router Hardening generator), because of allow-remote-requests=yes.
• v7: check /ip dns adlist print: match-count and name-count show the list was downloaded. The router downloads the lists again regularly.
• DNS blocking does not stop VPNs or apps with their own DNS. For a customer who needs another DNS, exclude their IP from the paksa-dns rules.
• Gambling domain lists change every day. Domains not on the list yet can be added by hand under Extra domains.

How to use: Copy the script, open Winbox → New Terminal, paste. Or Download .rsc, upload it in Files, then run /import file-name=blokir-situs-dns.rsc.

RouterOS v6 / v7 (adlist v7.15+) · added 11 November 2026