I was wondering if it would be possible to create a filter that activates based on accumulated time, and not clock time.
Example. We'll use Facebook as the website. So, I have created a Layer 7 filter that blocks Facebook on a certain group of IPs between 7a and 5p. But, I was wondering if I could modify that filter to run based on how long they were on the site, not just a blanket "7a-5p". So if they went to Facebook at 10am, and I gave them a 1 hour allowance, the Mikrotik kept track, and when IP address 192.x.x.1 had been on the website for an hour, the filter kicked in, and then at midnight, the 1 hour reset.
Now the monkey wrench, if the IP address spent 30 minutes on FB, and then got off. 2 hours later, they went back to FB, they should only have 30 minutes left.
I have no idea if this is even possible, just thinking out loud.