Hi,
I did need to block all P2P and did sort of like Chupaka said. My basic setup i based on http://wiki.mikrotik.com/wiki/Dmitry_on_firewalling But I have made some modifications. My setup tagges also encrypted packages (SSL) on non SSL ports.
This will however not block P2P that uses 443. But there are not many at the moment.
I have done some tests and i have not yet been able to make Bittorrent work. I use a RB1000 to back up my rule set. ![]()
Mangel
2 chain=prerouting action=jump jump-target=p2p-service layer7-protocol=DIRECTCONNECT
3 chain=prerouting action=jump jump-target=p2p-service p2p=all-p2p
4 chain=prerouting action=jump jump-target=p2p-service layer7-protocol=BITTORRENT2
5 chain=prerouting action=jump jump-target=tcp-services connection-state=new protocol=tcp dst-port=443
6 chain=prerouting action=jump jump-target=p2p-service connection-state=new protocol=tcp layer7-protocol=HTTPS dst-port=!443
7 chain=prerouting action=jump jump-target=tcp-services tcp-flags=syn connection-state=new protocol=tcp
8 chain=prerouting action=jump jump-target=udp-services connection-state=new protocol=udp
9 chain=prerouting action=jump jump-target=other-services connection-state=new
10 chain=p2p-service action=mark-connection new-connection-mark=p2p passthrough=no
26 chain=tcp-services action=mark-connection new-connection-mark=https passthrough=no protocol=tcp src-port=1024-65535 dst-port=443
Filter
5 ;;; Drop and log all P2P
chain=forward action=add-src-to-address-list src-address-list=local-addr address-list=p2p-users address-list-timeout=4w3d connection-mark=p2p
6 chain=forward action=log connection-mark=p2p log-prefix=“P2P”
7 chain=forward action=jump jump-target=drop connection-mark=p2p
L7
HTTPS: Regexp
^(.?.?\x16\x03.\x16\x03|.?.?\x01\x03\x01?.\x0b)
BITTORRENT2: Regexp
^(\x13bittorrent protocol)
DIRECTCONNECT: Regexp
^($mynick |$lock |$key )