Because Microsoft has gone rouge and malicious I want to block the entire microsoft.com domain preventing updates and all contact with microsoft. YES I realize the downsides.
My method seemed simple, but it does not work. I guess I dont know how to use a wildcard via a static DNS entry.
/ip dns static
add address=127.0.0.1 name=".*\\.microsoft\\..*"
add address=127.0.0.1 name="^microsoft\\..*"
You will need to force all DNS requests to go through your router for the local clients, or at least make sure their DNS settings are pointed only at you.
tried to browse to microsoft and does not load.
also tried windows update from my windows 8.1 and error appear! nice for blocking windows updates for bandwidth saving in hotspots!
How much of a performance hit is there doing this ? Obviously a CCR would be a big help here. The more cores the better
This is obviously less of a performance hit then using Layer 7 ? Obviously less secure as any machine on the other side could simply drop in their own DNS lookups to circumvent this trick. Anyone reading this should be aware of the downsides of this trick.
As the Wiki says “Regular expression matching is significantly slower than of the plain entries, so it is advised to minimize the number of regular expression rules and optimize the expressions themselves.”
I could see a heavily loaded single core router becoming suddenly unresponsive by just adding one regex in the DNS. So I would use this with caution.
Regex is itself a art form. Ive seen regex that I could have never thought of on my own. Long ones can be mind bending but far better performance.
Glad you found a solution that worked Indeed MikroTik routers are full of possibilities.
Either way is valid for you to do this. I tend to prefer L7 firewall rules because invariably, you will need block or restrict traffic on more and more things and it can all be managed from one place.
The other reason I like the L7 FW rule is that it’s much harder for the savvy user to work around via statically setting a DNS server on the host that isn’t the router. While you can mitigate using hotspot or DNS based FW rules, the amount of complexity continues to increase and sometimes it isn’t worth it.
It all comes down to your use case and what works well for you. Happy MikroTikking
In current ROS .\*.somewebsite.net is what works to block the top domain as well the subdomains.somewebsite.net. So the solution you claim to work, does not work, or at least, no longer works.
I know, I tested it in RoS v6.37 and no dice using your examples.
I thought It appropriate to post this for anybody else looking for the answer on how to block subdomains with static dns regex in mikrotik routeros.
I have MT router.
It’s not connected to net.
The users just can see the hotspot page. If they type something else in URL it shows hotspot page.
In static dns I managed *.com and .org ---->hotspot page
what I am facing is that when something like this msn.com/sport or totally ./
is typed error 404 page appears.
what should I in this case , that the users see the hotspot page not error page.
