lambert, in my case identifying youtube IPs is crazy.
If you’d like to target YouTube’s IPs (overall; not just video content), you can use something like this utility in PHP (running on Windows) to keep the IPs updated.
Dear boen_robot, thanks for the idea but PHP is not my cup of tea. Searching for a way to do the job.. I’ll let you all know if I find something
Here is what I use in my boards and it is working perfect. Just to clarify I found the rules somewhere on the internet or even this forum, but I don’t remember exactly where to credit them atm.
The idea is to inspect the header of the packets and see if they contain the keyword we need, in this case youtube, but can be substituted for other streaming site :
/ip firewall mangle add action=add-dst-to-address-list address-list=Youtube address-list-timeout=10m chain=prerouting comment=youtube content=youtube.com dst-port=80,443 protocol=tcp
This puts the ip’s in an address list, next we mark the packets :
/ip firewall mangle add action=mark-packet chain=forward comment=youtube new-packet-mark=Youtube passthrough=no src-address-list=Youtube
Now we have marked all the packets. And you can use that for queue’s or whatever you need.
This even works for https, because the GET query goes to the server in plain text.
Dear CyberTod, Thanks a lot nice idea man. I think now I’m getting all the youtube ips, Cool. Thanks again. I’ll let you know if I can fulfill my purpose with your rules.
Dear CyberTod, is the mark-packet chain would be forward or prerouting?
CyberTod,
/ip firewall mangle add action=add-dst-to-address-list address-list=Youtube address-list-timeout=10m chain=prerouting comment=youtube content=youtube.com dst-port=80,443 protocol=tcp
But how to save the address-list, few addresses happens to gone from the list, how to save the ip list forever
Remove this from the command :
address-list-timeout=10m
But is really not needed. When someone requests again some ip it is again added to the list. Otherwise the list could become quite long, but if this is not a problem for you go ahead with this change.
Dear CyberTod, I have found a problem with your add-dst-to-address-list rules, it grabs other than youtube.com IPs and for that I can’t do what I wanna do with that rules. But don’t know why it’s grabing other ips than youtube!?
You can try changing this part :
It’s rather generic I know, but it works well enough for me. I havent tried inspecting a tcp session to youtube to see some more specific string to type there. But that is the thing you can play with to fix it for you.
with ros 6.25 not work more ?
I see marked packets on a board with v6.25 so it should be working.
this first rule for me not working:
/ip firewall mangle add action=add-dst-to-address-list address-list=Youtube address-list-timeout=10m chain=prerouting comment=youtube content=youtube.com dst-port=80,443 protocol=tcp
marking packet is work because I have list …
EDIT sory it work my mistake … im litle modify
Entered.
Doesnt work.
Im 6.28 OS.
What means “It doesn´t work”?
I say it does. This is a very simple L7 rule, why should it have stopped working?