TLS 1.3 has been around since August 2018,
As of 2026, between 70% and 75% of all top websites are now using quic with Tls1.3,
and quic now become eaiser to create, I'm afraid that will used for illegal move
and currently routerOS TLS-Host didn't able to block domain for UDP Http and Tls1.3,
we don't have any proper way to do the blocking,
could you added this feature to your feature update update road map for blocking domain from UDP as Quic?
I think there is more important parts in RouterOS for MikroTik to invest their development resource into. The TLS-Host matcher in FW is already becoming more and more useless with ECH spreading. And sites that deploy HTTP/3 probably more often than not also embrace ECH. For example, if they use Cloudflare, that's only a switch that needs to be toggled.
Buy dedicated hardware that does DPI.
RouterOS is not the right choice.
It's like trying to change a tire on a car and only using one screwdriver to do everything.
Stop spying on your users.
Right...
What about Adlist w/ i.e. IPFire DBL? It's at least better than nothing.
Otherwise you'll need a proper firewall/proxy.