Layer 7 website blocking using Mikrotik

There are a couple of ways that you can block websites on Mikrotik Routers. One of the easiest and resource efficient ways to do this on a MT is by using Layer 7 inspection.



1. Open up Winbox and connect to your router.
1.1 On the left menu, select IP->Firewall

---

2. On the Firewall Windows, click on the "Layer 7 Protocols" tab

---

3. Click on the Add button
3.1 Under the "Name" field, type "Block"
3.2 Under the Regex field, put the text below. You can add more sites by typing in the Domain, and separating them with the pipe "|" symbol.

^.+(youtube.com|facebook.com).*$

---

4. Click on the "Filter Rules" tab in the "Firewall" window.
4.1 On the "General" tab, make sure that the "Forward" chain is selected.

---

5. On the "Advanced" tab, under "Layer 7 Protocol" select the "Block" item that we created earlier.

---

6. On the "Action" tab, select "reject" as the action, and then click "OK" to finish.

---

An alternative way to set up the blocking, is by typing (or pasting) the following in a terminal window:

/ip firewall layer7-protocol
add name=Block regexp="^.+(youtube.com|facebook.com).*\$"
/ip firewall filter
add action=reject chain=forward layer7-protocol=Block

Make sure you test everything before putting it in production. Also note that there are ways to bypass this, if your users are clever or determined enough.