Community discussions

 
piseth168
just joined
Topic Author
Posts: 5
Joined: Mon Jul 02, 2012 11:41 am

How to deny/allow website by IP address in RB750 router?

Mon Jul 02, 2012 11:47 am

Any friend can tell me how we can block website by IP address some of client we don't allow to access youtube or facebook.

How to deny/allow website by IP address in RB750 router?
 
User avatar
lordkappa
Member Candidate
Member Candidate
Posts: 133
Joined: Wed May 16, 2012 1:53 pm
Location: Vancouver, Canada

Re: How to deny/allow website by IP address in RB750 router?

Mon Jul 02, 2012 2:25 pm

You could block by IP, but many sites like youtube have a slew of ip's.

Use the "Content" option in the firewall to filter based on a keyword. "Facebook.com" or "Youtube.com".
/ip firewall filter 
add chain=forward action=reject reject-with=tcp-reset protocol=tcp content="Host: www.facebook.com" 
You could simply drop the traffic, but the TCP Reset option will immediately dump the client to an error screen, and not just leave the browser retrying the connection over and over.
 
piseth168
just joined
Topic Author
Posts: 5
Joined: Mon Jul 02, 2012 11:41 am

Re: How to deny/allow website by IP address in RB750 router?

Tue Jul 03, 2012 5:18 am

Hi, As your comment we can block all in network. As I need I want to block by IP address. Some user I don't allow to access website.

You could block by IP, but many sites like youtube have a slew of ip's.

Use the "Content" option in the firewall to filter based on a keyword. "Facebook.com" or "Youtube.com".
/ip firewall filter 
add chain=forward action=reject reject-with=tcp-reset protocol=tcp content="Host: www.facebook.com" 
You could simply drop the traffic, but the TCP Reset option will immediately dump the client to an error screen, and not just leave the browser retrying the connection over and over.
 
User avatar
lordkappa
Member Candidate
Member Candidate
Posts: 133
Joined: Wed May 16, 2012 1:53 pm
Location: Vancouver, Canada

Re: How to deny/allow website by IP address in RB750 router?

Tue Jul 03, 2012 6:50 am

Hi, As your comment we can block all in network. As I need I want to block by IP address. Some user I don't allow to access website.
I'm confused. Did you solve the problem?

If my rule didn't work as written, see http://wiki.mikrotik.com/wiki/Manual:IP/Firewall/Filter regarding how to write firewall rules. You can change it for your specific needs.
 
tjc
Member Candidate
Member Candidate
Posts: 279
Joined: Sun Jul 10, 2011 3:08 am

Re: How to deny/allow website by IP address in RB750 router?

Wed Jul 04, 2012 6:47 pm

It sounds like piseth168 wants to filter by originating user as well as destination.

So the answer is half the solution needed, and just needs a src-address or src-address-list which covers the machines that you're interested in limiting.
 
piseth
just joined
Posts: 21
Joined: Tue Mar 06, 2012 11:47 am
Location: Phnom Penh
Contact:

Re: How to deny/allow website by IP address in RB750 router?

Thu Jul 05, 2012 3:24 am

Dear tjc,

You thing is correct. Could you share me current configure?

regards.
It sounds like piseth168 wants to filter by originating user as well as destination.

So the answer is half the solution needed, and just needs a src-address or src-address-list which covers the machines that you're interested in limiting.
 
User avatar
lordkappa
Member Candidate
Member Candidate
Posts: 133
Joined: Wed May 16, 2012 1:53 pm
Location: Vancouver, Canada

Re: How to deny/allow website by IP address in RB750 router?

Thu Jul 05, 2012 4:52 am

 
nerwin43
just joined
Posts: 3
Joined: Thu May 03, 2012 9:02 am

Re: How to deny/allow website by IP address in RB750 router?

Thu Jul 05, 2012 9:40 am

better block the website on the PC itself. You can do it by adding www.facebook.com on the host file.

This i how your host file should look like.

# Copyright (c) 1993-2009 Microsoft Corp.
#
# This is a sample HOSTS file used by Microsoft TCP/IP for Windows.
#
# This file contains the mappings of IP addresses to host names. Each
# entry should be kept on an individual line. The IP address should
# be placed in the first column followed by the corresponding host name.
# The IP address and the host name should be separated by at least one
# space.
#
# Additionally, comments (such as these) may be inserted on individual
# lines or following the machine name denoted by a '#' symbol.
#
# For example:
#
# 102.54.94.97 rhino.acme.com # source server
# 38.25.63.10 x.acme.com # x client host

# localhost name resolution is handled within DNS itself.
127.0.0.1 localhost
::1 localhost
127.0.0.1 www.facebook.com
127.0.0.1 www.youtube.com




hope it help.
 
User avatar
shahbazian
Trainer
Trainer
Posts: 166
Joined: Fri Sep 09, 2011 6:22 pm
Location: Iran
Contact:

Re: How to deny/allow website by IP address in RB750 router?

Thu Jul 05, 2012 11:42 pm

Hi
For permit access to some of web sites, you can do it by adding this commands
/ ip proxy set enabled=yes
/ ip proxy access add dst-host=facebook.com action=deny
/ ip proxy access add dst-host=*.facebook.com action=deny
/ip firewall nat add chain=dstnat protocol=tcp dst-port=80 src-address-list=webclients action=redirect to-ports=8080 comment=Transparent_web_proxy
/ip firewall address-list add list=webclients address=first_client_ip_address
/ip firewall address-list add list=webclients address=2nd_client_ip_address
/ip firewall address-list add list=webclients address=3rd_client_ip_address
Learn MikroTik to improve your network.
( MTCNA, MTCRE, MTCWE, MTCTCE, MTCUME, MTCIPv6E, MTCINE )
MikroTik Certified Trainer & Consultant
RIPE NCC Trainer
 
jandafields
Forum Guru
Forum Guru
Posts: 1514
Joined: Mon Sep 19, 2005 6:12 pm

Re: How to deny/allow website by IP address in RB750 router?

Sun Jul 08, 2012 9:51 pm

You could block by IP, but many sites like youtube have a slew of ip's.

Use the "Content" option in the firewall to filter based on a keyword. "Facebook.com" or "Youtube.com".
/ip firewall filter 
add chain=forward action=reject reject-with=tcp-reset protocol=tcp content="Host: www.facebook.com" 
You could simply drop the traffic, but the TCP Reset option will immediately dump the client to an error screen, and not just leave the browser retrying the connection over and over.
This solution just gives you a false sense of security. It's too easy to circumvent by going to https://facebook.com (because https is encrypted so you can't read the host headers and it won't get caught).

The best way to do this with mikrotik is to block based on content to port 53udp (DNS), this way it can't even look it up. you should also transparently reroute all dns traffic to the mikrotik, so users can't use their own dns settings and get around it.

Of course, they could edit their host file and still get to facebook. This is one bad limitation of mikrotik that cisco can easily do. Mikrotik can't firewall based on url, but cisco can. That would be great if it could!!!!

Otherwise, it's impossible to block websites because of the https issue.
 
User avatar
lordkappa
Member Candidate
Member Candidate
Posts: 133
Joined: Wed May 16, 2012 1:53 pm
Location: Vancouver, Canada

Re: How to deny/allow website by IP address in RB750 router?

Mon Jul 09, 2012 1:59 am

You could block by IP, but many sites like youtube have a slew of ip's.

Use the "Content" option in the firewall to filter based on a keyword. "Facebook.com" or "Youtube.com".
/ip firewall filter 
add chain=forward action=reject reject-with=tcp-reset protocol=tcp content="Host: www.facebook.com" 
You could simply drop the traffic, but the TCP Reset option will immediately dump the client to an error screen, and not just leave the browser retrying the connection over and over.
This solution just gives you a false sense of security. It's too easy to circumvent by going to https://facebook.com (because https is encrypted so you can't read the host headers and it won't get caught).

The best way to do this with mikrotik is to block based on content to port 53udp (DNS), this way it can't even look it up. you should also transparently reroute all dns traffic to the mikrotik, so users can't use their own dns settings and get around it.

Of course, they could edit their host file and still get to facebook. This is one bad limitation of mikrotik that cisco can easily do. Mikrotik can't firewall based on url, but cisco can. That would be great if it could!!!!

Otherwise, it's impossible to block websites because of the https issue.
There's always some way around any solution... The most surefire way, then, would be to only allow HTTP traffic through a proxy that you control.
 
Prajeesh
just joined
Posts: 1
Joined: Mon Jul 22, 2013 8:17 am

Re: How to deny/allow website by IP address in RB750 router?

Mon Jul 22, 2013 8:20 am

Try with Layer 7 protocol

^.+(facebook.com).*$

it works for both http/https
 
jandafields
Forum Guru
Forum Guru
Posts: 1514
Joined: Mon Sep 19, 2005 6:12 pm

Re: How to deny/allow website by IP address in RB750 router?

Sat Jul 27, 2013 1:37 am

Try with Layer 7 protocol

^.+(facebook.com).*$

it works for both http/https
That is a HORRIBLE thing to do. You will end up blocking LOTS of other websites! (I just tried it, and several websites that have a facebook button on them would not load, or woud halfway load). Any website that has facebook code built in ("like us on facebook, etc"). Those pages will load until they get to the facebook code, then they will hang while waiting for facebook to build the "like" link.
 
ojeysky
Frequent Visitor
Frequent Visitor
Posts: 68
Joined: Tue Mar 10, 2009 2:04 pm

Re: How to deny/allow website by IP address in RB750 router?

Mon Nov 04, 2013 3:05 pm

You could block by IP, but many sites like youtube have a slew of ip's.

Use the "Content" option in the firewall to filter based on a keyword. "Facebook.com" or "Youtube.com".
/ip firewall filter 
add chain=forward action=reject reject-with=tcp-reset protocol=tcp content="Host: www.facebook.com" 
You could simply drop the traffic, but the TCP Reset option will immediately dump the client to an error screen, and not just leave the browser retrying the connection over and over.
This solution just gives you a false sense of security. It's too easy to circumvent by going to https://facebook.com (because https is encrypted so you can't read the host headers and it won't get caught).

The best way to do this with mikrotik is to block based on content to port 53udp (DNS), this way it can't even look it up. you should also transparently reroute all dns traffic to the mikrotik, so users can't use their own dns settings and get around it.

Of course, they could edit their host file and still get to facebook. This is one bad limitation of mikrotik that cisco can easily do. Mikrotik can't firewall based on url, but cisco can. That would be great if it could!!!!

Otherwise, it's impossible to block websites because of the https issue.
Actually this way worked for me....https traffic delivers an unreachable error while my squid handles the http part with a nice connection failed message ;)
 
timteka
just joined
Posts: 3
Joined: Wed Dec 14, 2011 11:41 am

Re: How to deny/allow website by IP address in RB750 router?

Mon Apr 07, 2014 9:42 am

This is one bad limitation of mikrotik that cisco can easily do. Mikrotik can't firewall based on url, but cisco can. That would be great if it could!!!!
Guys, any news on the topic? Maybe there's already a Feature Request for the firewall based url content filtering?

Who is online

Users browsing this forum: MSN [Bot] and 20 guests