Community discussions

MUM Europe 2020
 
elkolo23
Frequent Visitor
Frequent Visitor
Topic Author
Posts: 69
Joined: Mon May 28, 2007 9:30 pm

Layer 7

Fri Oct 05, 2007 9:13 pm

Would like more info about layer 7 and how could it help us specially for p2p
 
User avatar
normis
MikroTik Support
MikroTik Support
Posts: 24361
Joined: Fri May 28, 2004 11:04 am
Location: Riga, Latvia

Re: Layer 7

Mon Oct 08, 2007 10:13 am

p2p can be filtered just like that, without using l7. example:
/ip firewall filter add chain=forward p2p=all-p2p action=drop
l7 is for other advanced applications.
No answer to your question? How to write posts
 
boardman
Member Candidate
Member Candidate
Posts: 260
Joined: Fri May 28, 2004 11:10 pm
Location: Mexico
Contact:

Re: Layer 7 - Layer 3 - RouterOS 3.0RC14 Something wrong

Tue Jan 15, 2008 7:17 pm

p2p can be filtered just like that, without using l7. example:
/ip firewall filter add chain=forward p2p=all-p2p action=drop
l7 is for other advanced applications.
In a new-fresh installed RouterOS 3.0RC14 just doing NAT, nothing else configured in it except the obvious IP's for interfaces public and local, and route to gateway, then I put the following code :
/ip firewall filter add chain=forward p2p=all-p2p action=drop
, after that i connected my laptop directly to the router local interface, then I started my Limewire P2P Software, searched for a mp3 song downloaded it at full speed without any restriction. !!!!!

Why? , Is Gnutella (limewire) encrypted? Or is it p2p L3 matchers of RC14 not working?

Jorge Boardman
http://www.laredonet.com

P.D. After that I tried the same with L7 Gnutella Regexp matcher, same deal didn't worked out.
 
boardman
Member Candidate
Member Candidate
Posts: 260
Joined: Fri May 28, 2004 11:10 pm
Location: Mexico
Contact:

Re: Layer 7

Wed Jan 16, 2008 12:05 am

Anybody?
 
boardman
Member Candidate
Member Candidate
Posts: 260
Joined: Fri May 28, 2004 11:10 pm
Location: Mexico
Contact:

Re: Layer 7

Fri Jan 18, 2008 4:53 am

Anybody having an explanation for this?

Best

Jorge Boardman
 
CarulloS
Member
Member
Posts: 406
Joined: Thu Feb 02, 2006 5:52 am

Re: Layer 7

Fri Jan 18, 2008 7:01 am

Sure, its because the traffic looks like normal traffic... http transfer, encrypted etc...

L7 rules would help detect this, there are entire websites devoted to layer 7 rules to find particular application layer items.

It is and always will be a constant battle. There are numerous posts about how you may obtain the desired results (whatever they are) by other methods than L7 rules as well.

Scott
 
boardman
Member Candidate
Member Candidate
Posts: 260
Joined: Fri May 28, 2004 11:10 pm
Location: Mexico
Contact:

Re: Layer 7

Tue Apr 22, 2008 9:43 pm

Yes, but Normis says:

p2p can be filtered just like that, without using l7. example:

Code:
/ip firewall filter add chain=forward p2p=all-p2p action=drop


l7 is for other advanced applications.
 
CarulloS
Member
Member
Posts: 406
Joined: Thu Feb 02, 2006 5:52 am

Re: Layer 7

Wed Apr 23, 2008 4:50 am

There is a lot of p2p traffic that can be caught by l7 that slips right through the built in firewall filter. I would consider any l7 filter an advanced application :)

Scott
 
pedja
Long time Member
Long time Member
Posts: 684
Joined: Sat Feb 26, 2005 5:37 am

Re: Layer 7

Wed Apr 23, 2008 9:50 pm

p2p can be filtered just like that, without using l7. example:
/ip firewall filter add chain=forward p2p=all-p2p action=drop
I have a problem that occasionally plain DC++ connections avoid this filter. No encription and not even any intention to disquise connection. It just does not get filtered.
 
User avatar
normis
MikroTik Support
MikroTik Support
Posts: 24361
Joined: Fri May 28, 2004 11:04 am
Location: Riga, Latvia

Re: Layer 7

Thu Apr 24, 2008 11:55 am

in that case yes, you can use l7 if my mentioned rule doesn't help. just make a new l7 definition, and then make a firewall rule based on that defition. here is more info:

http://wiki.mikrotik.com/wiki/L7
No answer to your question? How to write posts
 
Jeeva
newbie
Posts: 37
Joined: Fri Sep 01, 2006 12:53 am
Location: Stellenbosch, South Africa
Contact:

Re: Layer 7

Thu Mar 12, 2009 3:19 am

Want to limit DC++ traffic, running Layer7, but it doesn't detect or catch any packets.... does nothing.

Is there some new REGEX code that I can use?

It is quite crucial, want to limit the DC++ users during certain times.

Who is online

Users browsing this forum: nevlax, rogerking1 and 100 guests