need to exclude certain IPs from a rule I made in the Mangle

RouterOS General
1

hii guys ,

I put some extensions in the layer7 ,
then made a mangle rule with settings : (action : mark packet ) with passthrough checked on ,
then added a new queue in the Queue tree with the packet name to put a limit speed for it & ( Parent : global-out )

now the extensions I put had been excluded from the “simple queues” limits

I wanna re-limit it for a certain IPs , How to do that ?

2

Hello!

you have to play with ip/firewall/filter or mangle.. with ip/address lists (you can make list of address here, allowed or not allowed..) and later you can select in a mangle rule (for example) in advanced you have src.address list or dst. addresss list. If you need to control what is comming from or to this address list. Also you can mark the “!” in mangle rules parameters that means the oposite or “no”


I hope this helps.

3

Sorry for my late respond ,

I couldn’t follow your instructions to make the rules ( I’m still a beginner at Mikrotik world :smiley: )

can you assist me with the necessary rules to put into the system ?

or it would be easier to export the rules I would make the changes into first ?

4

export please.

5

here is the new rules I wanna exclude certain IPs from :

/ip firewall layer7-protocol
add comment="" name=browsing_pages regexp=\
    "\\.(html)|\\.(htm)|\\.(xml)|\\.(php)|\\.(ico)|\\.(css)|\\.(js)"
add comment="" name=browsing_pics regexp=\
    "\\.(bmp)|\\.(png)|\\.(gif)|\\.(jpeg)|\\.(jpg)"

/ip firewall mangle
add action=mark-packet chain=forward comment=\
    "\D1\E6\E1 \DD\D5\E1 \C7\E3\CA\CF\C7\CF\C7\CA \C7\E1\D5\DD\CD\C7\CA" \
    disabled=no layer7-protocol=browsing_pages new-packet-mark=\
    browsing_pages_packet passthrough=yes
add action=mark-packet chain=forward comment=\
    "\D1\E6\E1 \DD\D5\E1 \C7\E3\CA\CF\C7\CF\C7\CA \C7\E1\D5\E6\D1" disabled=\
    no layer7-protocol=browsing_pics new-packet-mark=browsing_pics_packet \
    passthrough=yes

/queue tree
add burst-limit=0 burst-threshold=0 burst-time=0s disabled=no limit-at=0 \
    max-limit=0 name=browsing_pages_queue packet-mark=browsing_pages_packet \
    parent=global-out priority=6 queue=default
add burst-limit=0 burst-threshold=0 burst-time=0s disabled=no limit-at=0 \
    max-limit=0 name=browsing_pics_queue packet-mark=browsing_pics_packet \
    parent=global-out priority=7 queue=default
6

1: create IP/firewall/address list

2: in your mangle rules ADD in ip/firewall/mangle/advanced:
source address list (select your address list containing the IPs you added) and mark the square at the begining with a tick (it means “NO”).

7

2: in your mangle rules ADD in ip/firewall/mangle/advanced:
source address list (select your address list containing the IPs you added) and mark the square at the begining with a tick (it means “NO”).

the new mangle I add it with all other details from the original rules ?
or just the IP with the tick mark ?

& the order of this rule above or under the original rule ?

8

sorry man , I reread your post and understood what you mean :slight_smile: ,
will try it tomorrow and post the results .

9

I’ve tried to apply the rules :




but it didn’t work :frowning: !!