internet restriction from time A till time B

You only have that one NAT rule? There are no NAT rules at all in the srcnat chain?

Edit: undone, posting below.

Yes, all subnets are static, and all with real DHCP IP addrs.

I think it is showing your public IP there because somehow traffic is matching your redirect rule, and the proxy works as intended and builds a connection to the web server that hosts the reminder. It looks like that web server is outside your network, so the proxy is using the router’s public IP address to do so.

Sniff the traffic on the inside interface or look at connections in the firewall connection tracking facility and see if you can find out where it’s coming from.

Site is realy on the second router, but, can’t understand why torrents redirects there ?!
I imagine real DOS attack to my web :smiley: it was down twice today :frowning:

it is impossible to spit all traffic, Utorrents distributing their user lists thrue 80 port :frowning: maybe I need to use l7 features ?

I think I need this rule, because Utorr uses src port 80 = to dst (UPORT)
chain=dstnat action=redirect to-ports=8080 protocol=tcp
src-address-list=!known_users in-interface=!Public src-port=!80
dst-port=80 connection-mark=http

I found the way ! Thanks to this article http://www.mikrotik.com/testdocs/ros/3.0/pnp/proxy.php

chain=dstnat action=redirect to-ports=8080 protocol=tcp
src-address-list=gues_who dst-address-list=!local-addr
in-interface=!Public dst-port=80

I created rule that collects all of these non known IP’s,

;;; Excluding Remained IP’s to trash
chain=forward action=jump jump-target=remained
src-address-list=!known_users in-interface=ether2 out-interface=Public
;;; Excluding Remained IP’s to trash
chain=forward action=jump jump-target=remained
src-address-list=!known_users in-interface=ether3 out-interface=Public
;;; Excluding Remained IP’s to trash
chain=forward action=jump jump-target=remained
src-address-list=!known_users in-interface=ether4 out-interface=Public

and put them into different chain :slight_smile:

;; Trash for non payed
chain=remained action=add-src-to-address-list address-list=gues_who
address-list-timeout=0s
chain=remained action=accept src-address-list=gues_who in-interface=ether2
out-interface=Public connection-mark=http
chain=remained action=accept src-address-list=gues_who in-interface=ether3
out-interface=Public connection-mark=http
chain=remained action=accept src-address-list=gues_who in-interface=ether4
out-interface=Public connection-mark=http
chain=remained action=accept protocol=udp src-address-list=gues_who
dst-port=53
X chain=remained action=log log-prefix=“DROP”
chain=remained action=drop src-address-list=gues_who

And Fewi thanks to you, for the help :slight_smile: Now there is an order in my network ! :slight_smile: