Hi Everyone I’m trying to allow only www.messenger.com and block www.facebook.com but I encountered a problem using layer 7 regex allow ^.+(messenger.com).$ and deny ^.+(facebook.com).$ but messenger doesn’t load the username and password. I think that messenger.com is connected to facebook.com. What regex should i allow and deny. Thank you in advanced
The effective way of using layer 7 regex to block sites is by using mangle to mark the layer 7 regex site on TCP and UDP port 53 (connection and packet marking) then aply a filter rule on it.
Can you paste the code of how you did yours?
Sent from my LG-H810 using Tapatalk
Thank you for the reply sir.
Currently i don’t have the code but nextweek i’ll paste it here.I’ll explain what I did, first i create a regex ^.+(messenger.com).$ to allow messenger.com and regex ^.+(facebook.com).$ to deny facebook.com. then in my firewall rules is regex for messenger and second is deny facebook. I can access messenger.com but i’t doesn’t show the username and password field
I’m afraid your assumption is correct and the messenger web page/application accesses facebook.com for authentication, so if access to facebook.com is denied, you cannot use messenger. Packet sniffing on Mikrotik (using /tool sniffer) or on the PC (using Wireshark) will remove any doubt.
I tried using wireshark to get it’s regex but I failed. I only see the encryted data part I just know basic stuff in wireshark. Maybe you can test it sir and let me know. 
. But I’ll try the mikrotik tool sniffer
What I had in mind was not to look into the packets (the very purpose of encryption is to prevent this 
), but to see whether, if you close all facebook.com pages and the messenger and then open the messenger application or page, the Wireshark will show you a new TCP session to be established (or just attempted to be established if your L7 rule is in place) towards facebook.com IP address. Depending on the DNS response TTL, you may see a DNS query on facebook.com in the capture or not - in my area, the TTL is just 5 minutes, so it should be sufficient to wait for 5 minutes between closing everything facebook- and messenger-related to have the DNS query in the capture.
I cannot do that myself as I don’t use facebook
so it should be sufficient to wait for 5 minutes between closing everything facebook- and messenger-related to have the DNS query in the capture.
I’ve seen the DNS query the messenger ask and there response. Here are the list:
1.)messenger.com and www.messenger.com
2.) fbcdn-dragon-a.akamaihd.net
3.) connect.facebook.net
4.) scontent.fceb2-1.fna.fbcdn.net
5.) static.xxfbcdn.net
6.) www.facebook.com
I have a regex deny facebook.com which is found on dns query of messenger is there a work around on this one sir ?
The only idea which comes to my mind is not to deny the DNS query to www.facebook.com but to connection-mark the https sessions to www.facebook.com (using the tls-host matcher) and use action=reject reject-with=tcp-reset on sessions exceeding a value of connection-bytes which you find to be sufficient for messenger authentication. The Wireshark capture should help you determine that value.
However, you may also find out that the messenger opens the session to www.facebook.com permanently and only works while that session is active; if that is the case, there is no way to permit messenger and deny facebook simultaneously. I leave aside the possibility that the messenger connects to facebook.com on other port than https because it seems unlikely to me; the Wireshark capture taken when facebook.com is permitted should remove any doubt here too.
exceeding a value of > connection-bytes > which you find to be sufficient for messenger authentication
i need to study how connection bytes work sir. Thank you for the idea.
Is the trend already find the way to allow the messenger while facebook deny? who tried this activities and working properly? I need to implement this kind of setups. thanks in advance.