Content Filter stop working since Proxy enable

RouterOS General
1

Hi There,

since the first installations, we put the following content filter rules on most of our customers router

36 ;;; Facebook
chain=restricted action=reject reject-with=icmp-host-prohibited protocol=tcp
out-interface=ether1 dst-port=80 content=facebook.com
time=9h-17h,mon,tue,wed,thu,fri,sat

37 ;;; Twitter
chain=restricted action=reject reject-with=icmp-host-prohibited protocol=tcp
out-interface=ether1 dst-port=80 content=twitter.com time=9h-17h,mon,tue,wed,thu,fri,sat

38 X ;;; YouTube
chain=restricted action=reject reject-with=icmp-host-prohibited protocol=tcp
out-interface=ether1 dst-port=80 content=youtube.com time=9h-17h,mon,tue,wed,thu,fri,sat

39 ;;; Jump to restricted chain
chain=forward action=jump jump-target=restricted

But since the proxy enable, all the above rules got ignored. The proxy rules put are as follows :

ip proxy pr
enabled: yes
src-address: 0.0.0.0
port: 8080
parent-proxy: 0.0.0.0
parent-proxy-port: 0
cache-administrator: “webmaster”
max-cache-size: unlimited
cache-on-disk: no
max-client-connections: 600
max-server-connections: 600
max-fresh-time: 1d
serialize-connections: no
always-from-cache: no
cache-hit-dscp: 4
cache-drive: system

ip fi na pr
Flags: X - disabled, I - invalid, D - dynamic
0 chain=dstnat action=redirect to-ports=8080 protocol=tcp dst-port=80

1 chain=srcnat action=masquerade out-interface=ether1

I believe something should be altered, perhaps on filter rules but I do not know which part.

Can someone assist me ?

TIA

Paul

2

Proxy traffic isn’t in the forward chain, it’s in the output chain. So jump from output to restricted. Alternatively - and this is far more elegant - make proxy rules that deny the same traffic. That’s much lighter than inspecting all traffic on layer 7. See the wiki for details: http://wiki.mikrotik.com/wiki/How_to_Block_Websites_%26_Stop_Downloading_Using_Proxy