Block Websites and Torrents On Mikrotik 951Ui 2HnD

djeniuss · Tue Feb 07, 2017 2:27 pm

I know this topic has been posted several times in the forum but it doesn't work for me. When i apply the rules either via terminal window or via Layer 7 regexp, no success. The websites i blocked still opens and torrent download are still going on. Please i need help. It's my first time of using Mikrotik Router.

Thanks

erlinden · Tue Feb 07, 2017 6:03 pm

Can you please provide us with the settings you used?

djeniuss · Wed Feb 08, 2017 1:00 pm

kikikakuku · Thu Feb 09, 2017 8:20 pm

http://phallaccmt.blogspot.co.ke/2016/0 ... t-bit.html
http://phallaccmt.blogspot.co.ke/2016/0 ... nt_31.html
For websites use opendns

MarkMaina · Sun Feb 26, 2017 1:56 pm

Any one with the correct way to block torrent downloads on my mikrotik?

MarkMaina · Sun Feb 26, 2017 1:57 pm

I know this topic has been posted several times in the forum but it doesn't work for me. When i apply the rules either via terminal window or via Layer 7 regexp, no success. The websites i blocked still opens and torrent download are still going on. Please i need help. It's my first time of using Mikrotik Router.

Thanks

did you get the right way?\

blajah · Thu Mar 02, 2017 11:11 am

Regarding websites, have you tried to create access list and add url's then drop that access list ( ROS will resolve url's to IP's ) ? Its relative new feature in firewall.

janus20 · Fri Mar 03, 2017 10:48 pm

Hi,

Any one with the correct way to block torrent downloads on my mikrotik?

Here is a config that is working for me, tested on rb750gr3, rb3011UiAS, rb951g-2hnd. I can not remember from where i have implemented it, most likely from this forum or an outside link from a post.
It stops .torrent file download from browser as well as seeding or downloading inside torrent client (uTorrent, Vuze etc ).

1. define layer7 bit torrent regex table

/ip firewall layer7-protocol
add comment="Block Bit Torrent - tabela regex" name=layer7-bittorrent-exp regexp=\
    "^(\\x13bittorrent protocol|azver\\x01\$|get /scrape\\\?info_hash=get /announce\\\?info_hash=|get /client/bitcomet/|GET /data\\\?fid=)|d1:ad2:id20:|\\x08'7P\\)[RP]"

2. add "ofender" ip to a list with timeout set to 5 minutes

/ip firewall filter
add action=add-src-to-address-list address-list=Torrent-Conn address-list-timeout=5m chain=forward comment="Block torrent trafic" layer7-protocol=layer7-bittorrent-exp \
    log-prefix=torr-conn src-address={lan_network_range} src-address-list=!allow-bit
add action=add-src-to-address-list address-list=Torrent-Conn address-list-timeout=5m chain=forward comment="Block p2p" log-prefix=torr-conn p2p=all-p2p src-address={lan_network_range} \
    src-address-list=!allow-bit

where src-address={lan_network_range} is local lan network range ( Ex.: 192.168.0.0/24 )
You can see blocked ips running command:
/ip firewall address-list print

3. drop traffic for non-standard ports ( some of them ) for ips inside Torrent-Conn list ( see 2. )

/ip firewall filter
add action=drop chain=forward dst-port=!0-1024,3389,5222,5800,5900,8291,14147,59905 protocol=tcp \
    src-address-list=Torrent-Conn
add action=drop chain=forward dst-port=!0-1024,3389,5222,5800,5900,8291,14147,59905 protocol=udp \
    src-address-list=Torrent-Conn
add action=drop chain=forward out-interface={local-lan-interface} content="\r\nContent-Type: application/x-bittorrent" protocol=tcp src-port=80 comment=".torrent \r\nContent-Type...."

where out-interface={local-lan-interface} might be: ether2 or bridge1. For example, if on rb951g-2hnd you have ether2(master) and wlan as ports inside a bridge, named bridge1, then out-interface is bridge1

4. mark torrent traffic packets

/ip firewall mangle
add action=mark-packet chain=postrouting comment="p2p download" disabled=no layer7-protocol=layer7-bittorrent-exp new-packet-mark="p2p download" passthrough=no

5. drop torrent traffic

/ip firewall filter
add action=drop chain=forward disabled=no p2p=all-p2p
add action=drop chain=forward in-interface={WAN_interface} comment="torrent dht out magnet" content=d1:ad2:ad20 disabled=no dst-port=1025-65535 packet-size=95-190 protocol=udp
add action=drop chain=forward in-interface={WAN_interface} comment=info_hash content=info_hash disabled=no dst-port=2170,80 protocol=tcp
add action=drop chain=forward out-interface={local-lan-interface} content="\r\nContent-Type: application/x-bittorrent" protocol=tcp src-port=80 comment=".torrent \r\nContent-Type...."

where in-interface={WAN_interface} is your WAN interface ( Ex.: ether1 or pppoe-out1 )
and
out-interface={local-lan-interface} might be: ether2 or bridge1. For example, if on rb951g-2hnd you have ether2(master) and wlan as ports inside a bridge, named bridge1, then out-interface is bridge1

P.S. MOST IMPORTANT: in order to make it work DISABLE fasttrack, if you had enabled it or has left enabled by default configuration! ( https://wiki.mikrotik.com/wiki/Manual:IP/Fasttrack )

Hope it helps.

kind regards,

alejosalmon · Wed May 30, 2018 6:53 pm

Hello these rules are ok but how to prevent blocking games like dota 2,fornite,etc.My question is due to the ports which are not listed.Thanks

anav · Wed May 30, 2018 7:36 pm

Hopefully 2frogs will chime in here, he can solve it using whitelists.

Block Websites and Torrents On Mikrotik 951Ui 2HnD

Block Websites and Torrents On Mikrotik 951Ui 2HnD

Re: Block Websites and Torrents On Mikrotik 951Ui 2HnD

Re: Block Websites and Torrents On Mikrotik 951Ui 2HnD

Re: Block Websites and Torrents On Mikrotik 951Ui 2HnD

Re: Block Websites and Torrents On Mikrotik 951Ui 2HnD

Re: Block Websites and Torrents On Mikrotik 951Ui 2HnD

Re: Block Websites and Torrents On Mikrotik 951Ui 2HnD

Re: Block Websites and Torrents On Mikrotik 951Ui 2HnD

Re: Block Websites and Torrents On Mikrotik 951Ui 2HnD

Re: Block Websites and Torrents On Mikrotik 951Ui 2HnD

Who is online