Hey there guys. I have a question regarding blocking facebook, youtube and such.
I m administrating network in one VOIP (Call center company). I have blocked some IP range of facebook, YT etc (guide I found somewhere on Google) and it’s working really well.
Only problem I have is that I want to let my company director can still use those services on his computer.
Is there a way to allow one PC (mac or IP) not to go through these restrictions ? Something like making his IP static and adding some rule to bypass the address list and the blocked ip ranges ? So basically I want those rules to apply to whole network and not to his computer.
create a new ‘whitelist’ address list, add your guy to that whitelist and then add a new filter rule to accept his connection. Make sure the whitelist rule is higher up in the order and it will then be accepted and skip the other rules.
The problem comes if someone figures you are doing it based on source Ip and then when the boss has gone home and he’s turned off his PC, they change their IP But I guess you already got that covered, right? If not, consider locking his MAC address to that IP in the ARP table. Of course, if the bad guy then changes his MAC address as well…
Does this rule in address list has to be first in address list window ? Accept rule is first in filter list but do I have to make it first in address list too cause it seams I can’t drag it up ?
Also, do I need to add subnet mask to the ip address above ? I made his address static so I think it should work ?
Yes, except you’ve got dst-address instead of src-address, otherwise that should work. You are trying to match requests for access based upon the source of the request. In this case ‘Vaso’? The nat masquerade rule will automatically direct the traffic back to his PC. The rest of your blocking rules are testing for destination IP, which is still correct.
The address list has no importance of order. It only matches the name and the IP, it does not care where in the list it is. Just that it is there.
With the address list entry set to a /32 single IP, then yes, only that one IP will get through the block. If you do not enter a subnet mask, Mikrotik assumes you means /32.
if you slide the Director’s accept rule down the list of block rules, you can even make some types of sites blocked, those that are above his rule, but allow him to get to the remaining types, those below his rule.
As you can see I made this rules to allow some user with privilege from accessing facebook and denying regular users. But now when everyone can access https:\facebool.com. Help!
I think that in your case HTTP facebook will work to, just as HTTPS do. Your rules are looking dst-addresses (facebook servers) and blocking the traffic (doesnt matter is it http or https, it will became matter e.g. if you are using web proxy). I think that you are not hitting the rules anymore, try to ping http://www.facebook from MKT or local computer and see what ip address is resolved, i am guessing that resolved ip is not from above ranges?
I think that in your case HTTP facebook will work to, just as HTTPS do. Your rules are looking dst-addresses (facebook servers) and blocking the traffic (doesnt matter is it http or https, it will became matter e.g. if you are using web proxy). I think that you are not hitting the rules anymore, try to ping > http://www.facebook > from MKT or local computer and see what ip address is resolved, i am guessing that resolved ip is not from above ranges?
Actually the ip resolved is 173.252.100.16 and I just checked http and shows me the same message
Didn't see that IP on your facebook IP address list. Anyway, I just want to share here how I setup my filtering and will use facebook as an example of the site to be filtered here since we're talking facebook as the subject.
As you can see I've created two address-list group, one for facebook addresses that I'm blocking and one for users that I am allowing to access facebook.
I then added a filter rule that says, everyone that is trying to access facebook will be blocked except for the addresses listed in the address-list named fwall-x.
I'm doing it this way so I will only have a single rule on my filter list which is practically easier to manage/maintain. And if I want to remove or allow a user's access to facebook then I just have to add it to the allowed list. Also, if want to block additional facebook ip then I just have to add that ip address to the fb address-list group. Oh, don't forget that comment too as it will help you with identifying who has access to what.
Also, if you want to block the entirety of facebook this might interest you. Take note of the Network Resources section as you will see their assigned network block.
But I guess you already got that covered, right? If not, consider locking his MAC address to that IP in the ARP table. Of course, if the bad guy then changes his MAC address as well…
