How to mangle HTTPS and SSTP traffic separately?

RouterOS General
1

Hi,

I’m working with queue tree and would like to differentiate SSTP traffic from HTTPS as both are using the same TCP port 443.
I have setup mangle rule to capture HTTP traffic on ports 80,443 so SSTP traffic also match in this rule, I want it to be a separate rule for VPN connections, is this possible?

Thanks

2

You will likely need to go into L7 filtering territory to identify HTTP traffic specifically, as relying on protocol and port is obviously not going to be unique enough.
It will also require more resources to identify that traffic.

The other alternatives are very specific to your setup, such as can you identify it by interface pairs (in/out) differently etc.

3

Do you mean to identify SSTP traffic specifically?

How to identify SSTP traffic other than specifying 443 port, I’m wondering.

No, there are no rules depending on the interface.

4

I repeat my answer:

You will likely need to use L7 filter rules to try and identify either SSTP or HTTP so you can separate them.

That is unless you have some other unique way to identify SSTP traffic from your HTTP traffic (Such as inbound on WAN ports only)

5

I will repeat my question then :slight_smile:

“You will likely need to use L7 filter rules to try and identify either SSTP or HTTP so you can separate them.”

How to do this? Is there existing SSTP L7 matching Regex already created by someone?

6

I linked you the guide on using L7 rules, im sure there are other examples out there. SSTP might not be the right one to identify, may be easier to detect HTTP?

I’ve given you the tools, if you’d like me to engineer a solution I can send you my contract rates.