How to mark youtube IPs

lambert, in my case identifying youtube IPs is crazy.

If you’d like to target YouTube’s IPs (overall; not just video content), you can use something like this utility in PHP (running on Windows) to keep the IPs updated.

Dear boen_robot, thanks for the idea but PHP is not my cup of tea. Searching for a way to do the job.. I’ll let you all know if I find something :slight_smile:

Here is what I use in my boards and it is working perfect. Just to clarify I found the rules somewhere on the internet or even this forum, but I don’t remember exactly where to credit them atm.
The idea is to inspect the header of the packets and see if they contain the keyword we need, in this case youtube, but can be substituted for other streaming site :

/ip firewall mangle add action=add-dst-to-address-list address-list=Youtube address-list-timeout=10m chain=prerouting comment=youtube content=youtube.com dst-port=80,443 protocol=tcp

This puts the ip’s in an address list, next we mark the packets :

/ip firewall mangle add action=mark-packet chain=forward comment=youtube new-packet-mark=Youtube passthrough=no src-address-list=Youtube

Now we have marked all the packets. And you can use that for queue’s or whatever you need.
This even works for https, because the GET query goes to the server in plain text.

Dear CyberTod, Thanks a lot nice idea man. I think now I’m getting all the youtube ips, Cool. Thanks again. I’ll let you know if I can fulfill my purpose with your rules.

Dear CyberTod, is the mark-packet chain would be forward or prerouting?

CyberTod,

/ip firewall mangle add action=add-dst-to-address-list address-list=Youtube address-list-timeout=10m chain=prerouting comment=youtube content=youtube.com dst-port=80,443 protocol=tcp

But how to save the address-list, few addresses happens to gone from the list, how to save the ip list forever :slight_smile:

Remove this from the command :
address-list-timeout=10m

But is really not needed. When someone requests again some ip it is again added to the list. Otherwise the list could become quite long, but if this is not a problem for you go ahead with this change.

Dear CyberTod, I have found a problem with your add-dst-to-address-list rules, it grabs other than youtube.com IPs and for that I can’t do what I wanna do with that rules. But don’t know why it’s grabing other ips than youtube!? :frowning:

You can try changing this part :

content=youtube.com

It’s rather generic I know, but it works well enough for me. I havent tried inspecting a tcp session to youtube to see some more specific string to type there. But that is the thing you can play with to fix it for you.

with ros 6.25 not work more ?

I see marked packets on a board with v6.25 so it should be working.

this first rule for me not working:

/ip firewall mangle add action=add-dst-to-address-list address-list=Youtube address-list-timeout=10m chain=prerouting comment=youtube content=youtube.com dst-port=80,443 protocol=tcp

marking packet is work because I have list …

EDIT sory it work :open_mouth: my mistake … im litle modify :confused:

Entered.
Doesnt work.
Im 6.28 OS.

What means “It doesn´t work”?
I say it does. This is a very simple L7 rule, why should it have stopped working?