Multiple files in firewall content rules

RouterOS General
1

Is there anyway possible to merge file contents in firewall rules (filter, nat, mangle)?
for example when i try to filter .exe and .zip files I have to make 2 separates rules.

/ip firewall filter add chain=forward src-address=192.168.0.0/24 protocol=tcp content=.exe action=add-dst-to-address-list address-list=downloads
/ip firewall filter add chain=forward src-address=192.168.0.0/24 protocol=tcp content=.zip action=add-dst-to-address-list address-list=downloads

I have many file types to filter and therefore i made over hundred rules simply because i couldn’t merge all file types in one rule.

I’ve tried using commas (,), spaces ( ), and other special characters ( / \ | ) with no luck.

Any help is appreciated thx.

2

You can’t. “content” matches exact expression inside packet’s payload.

You can try with L7. L7 supports regular expressions.

3

/ip firewall layer7-protocol add comment=“” name=“file” regexp=“\.(exe|zip)”

/ip firewall filter add chain=forward src-address=192.168.0.0/24 layer7-protocol=file action=add-dst-to-address-list address-list=downloads

are these right settings to replace my previous content rules?

I tried using it but didn’t work.

4

Actually those settings did work, however some file connections are not detected by L7 and i have to add extra rules to be able to capture them. Thanks for your help.