It is not really wrong. Maybe we're both right 50%
Maybe it is best to block both ways. Block initiated connection from both inside and outside.

How to setup a script to add all list in firewall filter ??

Hi, you only need to make a address-list containing the folowing addresses:

(taken from http://www.whatsapp.com/cidr.txt)

31.13.69.240/32
31.13.70.49/32
31.13.71.49/32
31.13.73.49/32
31.13.74.49/32
31.13.76.81/32
31.13.77.49/32
50.22.75.192/27
50.22.93.192/27
50.22.198.204/30
50.22.210.32/30
50.22.210.128/27
50.22.225.64/27
50.22.235.248/30
50.22.240.160/27
50.23.90.128/27
50.97.57.128/27
75.126.39.32/27
108.168.174.0/27
108.168.176.192/26
108.168.177.0/27
108.168.180.96/27
108.168.254.65/32
108.168.255.224/32
108.168.255.227/32
158.85.0.96/27
158.85.5.192/27
158.85.46.128/27
158.85.48.224/27
158.85.58.0/25
158.85.61.192/27
158.85.224.160/27
158.85.233.32/27
158.85.249.128/27
158.85.249.224/27
158.85.254.64/27
169.53.29.128/27
169.53.250.128/26
169.54.2.160/27
169.54.210.0/27
169.54.222.128/27
173.192.162.32/27
173.192.219.128/27
173.192.222.160/27
173.192.231.32/27
173.193.205.0/27
173.193.230.96/27
173.193.230.128/27
173.193.230.192/27
173.193.239.0/27
174.36.208.128/27
174.36.210.32/27
174.36.251.192/27
174.37.199.192/27
174.37.217.64/27
174.37.231.64/27
174.37.243.64/27
174.37.251.0/27
184.173.73.176/28
184.173.136.64/27
184.173.147.32/27
184.173.161.64/32
184.173.161.160/27
184.173.173.116/32
184.173.179.32/27
184.173.195.32/27
184.173.201.32/27
184.173.204.32/27
192.155.212.192/27
198.11.193.182/31
198.11.212.0/27
198.11.217.192/27
198.11.251.32/27
198.23.80.0/27
198.23.86.224/27
198.23.87.64/27
208.43.115.192/27
208.43.117.79/32
208.43.117.136/32
208.43.122.128/27
2607:f0d0:1b01:d4::/64
2607:f0d0:3004:136::/64
2607:f0d0:3005:183::/64
2607:f0d0:3006:84::/64
2607:f0d0:3006:af::/64

Hard mode: Try using the packet sniffer on the router to find how whatsapp communicates and then block it with the firewall.

I haven't used the packet sniffer on RouterOS, but looking at it quickly, I would set whatsapp up on a control device and then filter the packet sniffer on the interface you're connecting to and the MAC address of your control device.

When you're sniffing, start sending messages and making calls etc etc. That should give you enough information to block it through the firewall.

This guy....love it!

# Try my Whatsapp Blocker Script #

# IMPORTANT ! THIS SCRIPT ONLY WORKS WITH STATIC DNS CONFIGURATION #
# if you use the dhcp-client, go to and uncheck the field ,, use-peer-dns"#
# then go to ip dns and set your static dns server #
# 8.8.8.8 or 8.8.4.4 , Google DNS #
# Whatsapp Finder Script RouterOS v6.33rc33 #
# This here is the Version for New Terminal #
# add to Scheduler and run with Time Interval 00:01:00 #
{
# STEP 1 set your prefered List Name here or leave it as it is #
:global lst "Whatsapp";
# Use DNS Entrys and add dst Address to the Firewall Address-list #
:foreach i in=[/ip dns cache all find where (name~"whatsapp" || name~"whatscom") && (type="A") ] do={
:local tmpAddress [/ip dns cache get $i address];
delay delay-time=10ms
# prevent script from using all cpu time #
:if ( [/ip firewall address-list find where address=$tmpAddress] = "") do={
:local cacheName [/ip dns cache get $i name] ;
:log info ("added entry: $cacheName $tmpAddress");
/ip firewall address-list add address=$tmpAddress list="$lst" comment=$cacheName;
}
}
}

# Whatsapp Blocker RouterOS v6.33rc33 #
# This here is the Version for New Terminal #
# add to Scheduler and run with Time Interval 01:00:00 #
{
# STEP 2 set your in-interface here #
:local iif "bridge";
# STEP 3 set your jump target name for fw-mangle here, the same name will be the new chain or leave it as it is #
:local jt "whatsapp_mangle";
# STEP 4 set your jump rule comment here or leave it as it is #
:local jtc "Jump to Whatsapp Chain";
# STEP 5 set dst-address-here, you must get the same name which from STEP 1 or leave it as it is #
:local dal "Whatsapp";
# STEP 6 set your new-connection-mark name here or leave it as it is #
:local ncm "whats_con";
# STEP 7 determine the size in bytes here, connection is determined as valid after reaching size #
:local size "100";
# STEP 8 set your prefered connection-mark comment here or leave it as it is #
:local cmc "Whatsapp Connection";
# STEP 9 set your prefered src-address-list Name here or leave it as it is, this list will display your client IP addresses #
:local sal "Whatsapp User";
# STEP 10 set your prefered add-src-to-address-list comment here or leave it as it is #
:local sl "Whatsapp Add Src to Address List";
# STEP 11 set your own comment for drop rule, after reached Limit of STEP 7 the Malware connection will be closed #
:local mwc "Drop Whatsapp Con";
# STEP 12 set your jump target name for fw-filter here, the same name will be the new chain or leave it as it is #
:local fwf "whatsapp_chain";
# DO NOT EDIT NOTHING BELOW, THIS CAN BREAK THE SCRIPT !!! #
:log warning ("Removing old Mangle=$jtc " . "Mangle=$cmc " . "Mangle=$sl " . "and Filter $jtc " . "else $mwc");
:put ("Removing old Mangle=$jtc " . "Mangle=$cmc " . "Mangle=$sl " . "and Filter $jtc " . "else $mwc");
/ip firewall mangle remove [ find comment="$jtc" ];
/ip firewall mangle remove [ find comment="$cmc" ];
/ip firewall mangle remove [ find comment="$sl" ];
/ip firewall filter remove [ find comment="$jtc" ];
/ip firewall filter remove [ find comment="$mwc" ];
:log warning ("Adding new Mangle=$jtc " . "Mangle=$cmc " . "Mangle=$sl " . "and Filter $jtc " . "else $mwc");
:put ("Adding new Mangle=$jtc " . "Mangle=$cmc " . "Mangle=$sl " . "and Filter $jtc " . "else $mwc");
/ip firewall mangle
add chain="forward" protocol=tcp in-interface=$iif action=jump jump-target="$jt" comment="$jtc"
add chain="$jt" protocol=tcp in-interface=$iif connection-state=established,new dst-address-list="$dal" \
action=mark-connection new-connection-mark="$ncm" connection-bytes="$size-0" passthrough=yes comment="$cmc"
add chain="$jt" dst-address-list="$dal" action=add-src-to-address-list address-list="$sal" address-list-timeout=6h \
connection-mark="$ncm" comment="$sl"
/ip firewall filter
add chain=forward protocol=tcp in-interface=$iif connection-mark="$ncm" action=jump jump-target="$fwf" comment="$jtc"
add chain="$fwf" protocol=tcp dst-port=80 connection-mark="$ncm" action=drop dst-address-list="$dal" src-address-list="$sal" comment="$mwc"
add chain="$fwf" protocol=tcp dst-port=443 connection-mark="$ncm" action=drop dst-address-list="$dal" src-address-list="$sal" comment="$mwc"
add chain="$fwf" protocol=tcp dst-port=5222-5228 connection-mark="$ncm" action=drop dst-address-list="$dal" src-address-list="$sal" comment="$mwc"
}

means no need to turn DSL into bridge mode.? then how filters will be applied on users direct connected to NAT ports of DSL router.

all consumers - connect to DNS-resolved resources.
which in turn thanks to static DNS override and DNS bypassing/forwarding blocking combo - ensure that Nobody can access something w/o 3rd party DNS-alike service/replacement(from host-files to various "services", like used in darknet or by govt spies and various p2p/adhoc replacements for DNS(with or witout "DNS Sub" to mimic it in deployment).

# Copy and Paste the above to WinBox New Terminal #

/system scheduler
add comment="Whatsapp Blocker" interval=2m name="Whatsapp Blocker" on-event="#\
\_Use DNS Entrys and add Address to the Firewall Address-list #\r\
\n:foreach i in=[/ip dns cache all find where (name~\"whatsapp\") && (type\
=\"A\") ] do={\r\
\n :local tmpAddress [/ip dns cache get \$i address];\r\
\ndelay delay-time=10ms\r\
\n# prevent script from using all cpu time #\r\
\n :if ( [/ip firewall address-list find where address=\$tmpAddress] = \
\"\") do={ \r\
\n :local cacheName [/ip dns cache get \$i name] ;\r\
\n :log info (\"added entry: \$cacheName \$tmpAddress\");\r\
\n /ip firewall address-list add address=\$tmpAddress list=Whatsapp co\
mment=\$cacheName;\r\
\n}\r\
\n}" policy=ftp,reboot,read,write,policy,test,password,sniff,sensitive \
start-time=startup

/ip firewall filter add chain=forward action=drop dst-address-list=Whatsapp disabled=no comment="Whatsapp Blocker"

Thanks
what you mean that
interval=2m in /system scheduler ?

interval=2m ????

yes, interval 2 minutes

yes, interval 2 minutes

Whats difference between interval 2 m
Or change to equal interval 10 m?

you can set your prefered interval time, I think when you set menor interval time the script works better in the first hours

Hi, you only need to make a address-list containing the folowing addresses:

(taken from http://www.whatsapp.com/cidr.txt)

31.13.69.240/32
31.13.70.49/32
31.13.71.49/32
31.13.73.49/32
31.13.74.49/32
31.13.76.81/32
31.13.77.49/32
50.22.75.192/27
50.22.93.192/27
50.22.198.204/30
50.22.210.32/30
50.22.210.128/27
50.22.225.64/27
50.22.235.248/30
50.22.240.160/27
50.23.90.128/27
50.97.57.128/27
75.126.39.32/27
108.168.174.0/27
108.168.176.192/26
108.168.177.0/27
108.168.180.96/27
108.168.254.65/32
108.168.255.224/32
108.168.255.227/32
158.85.0.96/27
158.85.5.192/27
158.85.46.128/27
158.85.48.224/27
158.85.58.0/25
158.85.61.192/27
158.85.224.160/27
158.85.233.32/27
158.85.249.128/27
158.85.249.224/27
158.85.254.64/27
169.53.29.128/27
169.53.250.128/26
169.54.2.160/27
169.54.210.0/27
169.54.222.128/27
173.192.162.32/27
173.192.219.128/27
173.192.222.160/27
173.192.231.32/27
173.193.205.0/27
173.193.230.96/27
173.193.230.128/27
173.193.230.192/27
173.193.239.0/27
174.36.208.128/27
174.36.210.32/27
174.36.251.192/27
174.37.199.192/27
174.37.217.64/27
174.37.231.64/27
174.37.243.64/27
174.37.251.0/27
184.173.73.176/28
184.173.136.64/27
184.173.147.32/27
184.173.161.64/32
184.173.161.160/27
184.173.173.116/32
184.173.179.32/27
184.173.195.32/27
184.173.201.32/27
184.173.204.32/27
192.155.212.192/27
198.11.193.182/31
198.11.212.0/27
198.11.217.192/27
198.11.251.32/27
198.23.80.0/27
198.23.86.224/27
198.23.87.64/27
208.43.115.192/27
208.43.117.79/32
208.43.117.136/32
208.43.122.128/27
2607:f0d0:1b01:d4::/64
2607:f0d0:3004:136::/64
2607:f0d0:3005:183::/64
2607:f0d0:3006:84::/64
2607:f0d0:3006:af::/64

are you tried this all ip range ?
blocked whatsapp or working ?

From Whatsapp cidr...

Always works, both to QoS or block it

Cheers.

Hi, you only need to make a address-list containing the folowing addresses:

(taken from http://www.whatsapp.com/cidr.txt)

31.13.69.240/32
31.13.70.49/32
31.13.71.49/32
31.13.73.49/32
31.13.74.49/32
31.13.76.81/32
31.13.77.49/32
50.22.75.192/27
50.22.93.192/27
50.22.198.204/30
50.22.210.32/30
50.22.210.128/27
50.22.225.64/27
50.22.235.248/30
50.22.240.160/27
50.23.90.128/27
50.97.57.128/27
75.126.39.32/27
108.168.174.0/27
108.168.176.192/26
108.168.177.0/27
108.168.180.96/27
108.168.254.65/32
108.168.255.224/32
108.168.255.227/32
158.85.0.96/27
158.85.5.192/27
158.85.46.128/27
158.85.48.224/27
158.85.58.0/25
158.85.61.192/27
158.85.224.160/27
158.85.233.32/27
158.85.249.128/27
158.85.249.224/27
158.85.254.64/27
169.53.29.128/27
169.53.250.128/26
169.54.2.160/27
169.54.210.0/27
169.54.222.128/27
173.192.162.32/27
173.192.219.128/27
173.192.222.160/27
173.192.231.32/27
173.193.205.0/27
173.193.230.96/27
173.193.230.128/27
173.193.230.192/27
173.193.239.0/27
174.36.208.128/27
174.36.210.32/27
174.36.251.192/27
174.37.199.192/27
174.37.217.64/27
174.37.231.64/27
174.37.243.64/27
174.37.251.0/27
184.173.73.176/28
184.173.136.64/27
184.173.147.32/27
184.173.161.64/32
184.173.161.160/27
184.173.173.116/32
184.173.179.32/27
184.173.195.32/27
184.173.201.32/27
184.173.204.32/27
192.155.212.192/27
198.11.193.182/31
198.11.212.0/27
198.11.217.192/27
198.11.251.32/27
198.23.80.0/27
198.23.86.224/27
198.23.87.64/27
208.43.115.192/27
208.43.117.79/32
208.43.117.136/32
208.43.122.128/27
2607:f0d0:1b01:d4::/64
2607:f0d0:3004:136::/64
2607:f0d0:3005:183::/64
2607:f0d0:3006:84::/64
2607:f0d0:3006:af::/64

are you tried this all ip range ?
blocked whatsapp or working ?

From Whatsapp cidr...

Always works, both to QoS or block it

Cheers.

Ok
Any idea to block psiphon vpn program?