A RouterOS 7 automation described by Alik Khilazhev in a 23 September 2026 article can keep a Cloudflare-hosted site reachable during reported LaLiga match-time blocks in Spain, but only by sending every new LAN connection to a listed Cloudflare address through an existing policy-based VPN while the block signal is active. It removes a manual step. It does not target the one site that failed, and the trigger it relies on is an observation rather than an official blocklist.
Why one website fails during a match
The article’s account is that some pirate streams are served from behind Cloudflare, where a single IP address can front many unrelated websites. It says Spanish ISPs block IP addresses during matches under a court order, and that legitimate sites sharing an affected Cloudflare address then fail too. That is the author’s explanation. The article does not cite a court record, ISP notice, regulator statement, or Cloudflare comment for these points, so treat them as the author’s account rather than established fact.
As an Amazon Associate I earn from qualifying purchases.
The practical symptom is a site that loads normally at other times and fails only during a match window. The article’s workaround is built around that pattern.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →The trigger: a DNS observation, not a blocklist
The router does not read a blocklist. It queries the A records for blocked.dns.hayahora.futbol, a DNS signal that the author associates with reported match-time blocking. The query goes through Google Public DNS’s JSON endpoint rather than a plain RouterOS lookup, because the author found that RouterOS :resolve returns one record in this use case, while the script needs the full answer set to apply its threshold.
#1 Best Overall
- hEX also known as RB750Gr3 is a five port Gigabit Ethernet router for locations where wireless connectivity is not required
- The device has a full size USB port. This new updated revision of the hEX brings several improvements in performance
- It is affordable, small and easy to use, but at the same time comes with a very powerful dual core 880MHz CPU and 256MB RAM
- IPsec hardware encryption (~470 Mbps) and The Dude server package is supported, microSD slot on it provides improved r/w speed for file storage and Dude
- Dimensions: 113x89x28mm; Storage size: 16 MB; Passive PoE (PoE in); PCB temperature monitor, Voltage monitor and Mode button
The article’s own wording on the signal is the clearest statement of its limits:
“The DNS data is an observation, not an official blocklist.”
Rank #2
- MikroTik RouterBOARD C52iG-5HaxD2HaxD-TC-US (US Version) hAP ax (WiFi6) Quad-Core IPQ-6010 864 MHz, RAM 1GB, RouterOS, License level 4 It's time to supercharge your home network with the Generation
- hAP ax has everything you might need in a primary home access point - and more
- Forget endless reviews and comparisons - this is the perfect device for 99% of homes
- Wireless signal is now stronger than ever
- Here are the two main ingredients of hAP ax's success: a state-of-the-art dual-band, dual-chain 4-4
That line is by Alik Khilazhev, identified on his profile as a Cloud Infrastructure Engineer and Software Engineer. Treat the signal as a heuristic. It can be wrong, and nothing in the article shows it tracks any official enforcement schedule.
How the router workaround is assembled
The method has three parts, each of which the author describes as a separate RouterOS object:
Rank #3
- Wired Gigabit Router – 5x Gigabit Ethernet ports, 2.5G SFP, PoE-Out, USB, powered by RouterOS
- A daily scheduler refreshes an address list. The script rebuilds a firewall address list named
cloudflare-ipsfrom a Cloudflare IP-range import once a day. The author uses Davie3’s list and says another maintained import could be substituted. The article does not validate that list’s maintenance or accuracy. - A prerouting mangle rule marks traffic. A rule that is disabled by default marks new connections from the LAN to destinations in
cloudflare-ipswith the VPN connection mark. Enabling it sends matching traffic into the tunnel. - A five-minute script toggles the rule. Every five minutes the script fetches the DNS JSON response and enables or disables the mangle rule based on the DNS status and the number of returned answers.
The trigger condition in the example is DNS status zero plus more than ten returned answers. When it is met, the rule is enabled. When it is not, the rule is disabled.
What the author’s settings are, and what they are not
Every number in the setup is the author’s configuration choice for his own network. None is presented as a validated default or a population statistic.
Rank #4
- 【Five Gigabit Ports】1 Gigabit WAN Port plus 2 Gigabit WAN/LAN Ports plus 2 Gigabit LAN Port. Up to 3 WAN ports optimize bandwidth usage through one device.
- 【One USB WAN Port】Mobile broadband via 4G/3G modem is supported for WAN backup by connecting to the USB port. For complete list of compatible 4G/3G modems, please visit TP-Link website.
- 【Abundant Security Features】Advanced firewall policies, DoS defense, IP/MAC/URL filtering, speed test and more security functions protect your network and data.
- 【Highly Secure VPN】Supports up to 20× LAN-to-LAN IPsec, 16× OpenVPN, 16× L2TP, and 16× PPTP VPN connections.
- Security - SPI Firewall, VPN Pass through, FTP/H.323/PPTP/SIP/IPsec ALG, DoS Defence, Ping of Death and Local Management. Standards and Protocols IEEE 802.3, 802.3u, 802.3ab, IEEE 802.3x, IEEE 802.1q
| Setting | Value in the article | What it means for you |
|---|---|---|
| Signal check interval | Every 5 minutes | A block can start and end between checks; the article does not state how quickly the script reacts in practice. |
| Trigger threshold | DNS status 0 and more than 10 A-record answers | The author says the same threshold appears in a TRMNL LaLiga plugin. Your threshold can differ; the article gives no basis for a universal value. |
| Address list refresh | Daily, from a Cloudflare IP-range import (Davie3’s list in the author’s setup) | Ranges can change; the article does not say how often the upstream list is updated. |
| Mangle rule default | Disabled; enabled only by the script | No traffic is redirected until the trigger fires. |
| VPN connection mark | “NordVPN”, as an example name | Substitute your own working IPsec connection mark. The name does not imply a subscription is required. |
Prerequisites
- A MikroTik router running RouterOS 7. The article does not test or compare hardware models, and it does not state which devices support the scripts across versions.
- A working policy-based IPsec VPN connection, already marked for routing. The article tells you to get this working first; the workaround only adds the automatic switch.
- A LAN interface list, which the firewall rules reference.
- A maintained Cloudflare IP-range list to populate
cloudflare-ips.
What the rule affects while it is active
The scope is the central trade-off. Once the rule is enabled, every new connection from the LAN to a Cloudflare address in the list is sent through the VPN, not only the site that failed. Unrelated Cloudflare-hosted sites and services take the same detour for as long as the rule stays on.
Existing connections keep their previous route until they reconnect, so a long-running session may stay on the ISP path even after the rule switches. The switch takes effect on new connections only.
Best Value
- Mikrotik hEX S (RB760iGS) is a five port Gigabit Ethernet router for locations where wireless connectivity is not required.
- It comes with a very powerful dual core 880 MHz CPU and 256 MB RAM, capable of all the advanced configurations that RouterOS supports.
- The device has a USB 2.0, PoE output for Ethernet port #5 and a 1.25Gbit/s SFP cage.
- 5x Gigabit Ethernet, SFP, Dual Core 880MHz CPU, 256MB RAM, USB, microSD, RouterOS L4, IPsec hardware encryption support and The Dude server package.
- IPsec hardware encryption (~470 Mbps) and The Dude server package is supported, microSD slot on it provides improved r/w speed for file storage and Dude.
| Approach | Which traffic moves | What triggers the route change | Dependencies |
|---|---|---|---|
| Manual rule enablement (the step this script replaces) | Whatever the rule matches when you turn it on | You enable the rule | RouterOS 7 and a working VPN |
| The author’s automated workaround | Every new LAN connection to a listed Cloudflare IP | DNS status 0 and more than 10 answers, checked every 5 minutes | RouterOS 7, a working IPsec policy VPN, a maintained IP list, and a working DNS query path |
| No router-side automation | Nothing is rerouted by the router | Not applicable | None beyond normal routing |
Limits to know before you copy it
- Over-broad routing. Traffic to unrelated Cloudflare-hosted services is also sent through the VPN while the rule is active.
- Signal dependence. The trigger is an observation of DNS answers, not an enforcement record. A false positive or missed block changes the route anyway, or fails to change it.
- Stale connections. Sessions opened before the switch keep their old path until reconnection.
- Author-specific thresholds. The 10-answer threshold and five-minute interval are the author’s configuration, not validated settings.
- Unverified background. The court order, ISP blocking practices, and Cloudflare address sharing are described in the article without an independent source attached.
Bottom line
The method is a narrow piece of router automation: it watches a DNS signal, and when that signal crosses the author’s threshold it routes new Cloudflare-bound LAN connections through an existing VPN. It is useful if you already run a working RouterOS 7 IPsec policy and accept that the detour applies to all matching Cloudflare traffic while it is active. It is not a targeted fix for one website, and nothing in the article shows it is accurate beyond the author’s own network.
The article also mentions a TRMNL display plugin that uses the same threshold. That plugin is not needed to run the MikroTik workaround.
Quick Recap
The Bottom Line
“”
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Free tools Windows power users keep installed
One-click scans. No signup required.
