Hello
I want to block just www.facebook.com or facebook.com sites. (I do NOT Want to block sites by IP address, as they can be avoided by anonymous surfing)
How can I block this sites ONLY.
There are some sites, which have links to www.facebook.com.
When I block the sites by content (/ip firewall filter add chain=forward content="facebook.com" accion=drop), the site which contains link to facebook, can not be opened.
I can not use proxy. what can I use, is only Layer7 or content.

Waiting for Reply

Thanks
Regards Karapet Aznavuryan

Personally, I would use the built-in web proxy, but this is just my preference.

That being said, you could also use a DNS static entry for all *.facebook.com and redirect to your router IP, or 127.0.0.1. The Mikrotik Wiki has a good entry on this topic.

Hope this helps,

Personally, I would use the built-in web proxy, but this is just my preference.

That being said, you could also use a DNS static entry for all *.facebook.com and redirect to your router IP, or 127.0.0.1. The Mikrotik Wiki has a good entry on this topic.

Hope this helps,

Thanks bro, its very helpfull for me.

but Your Users can use facebook using anonymous proxies.

Thats wrong, because if you block facebook using this way (web proxy) they can access it throw anonymous proxies.
The best thing is to drop facebook.com ip addresses:
Name: facebook.com
Addresses: 69.63.181.12, 69.63.189.11, 69.63.189.16
Add those ip's to and address list called facebook
Go to IP-Firewall-Filter then add a "input" with "drop" rule and select the src address list named facebook

Thats wrong, because if you block facebook using this way (web proxy) they can access it throw anonymous proxies.
The best thing is to drop facebook.com ip addresses:
Name: facebook.com
Addresses: 69.63.181.12, 69.63.189.11, 69.63.189.16
Add those ip's to and address list called facebook
Go to IP-Firewall-Filter then add a "input" with "drop" rule and select the src address list named facebook

When You drop by IP address it won't block if you use anonymous proxy, as the IP address of anonymous proxy is NOT the same with facebook IP address. Only way is layer7 or content.
I have done my setup using content filter.

so drop 69.63.189.0/24

so drop 69.63.189.0/24

will not work )
As say my proxy server is from address 72.XX.XX.XX/24 range)

Why are you blocking just facebook? Just curious...
OK, don't tell me. Let me guess instead!
1) You work for MySpace.
2) It is a business and you have lost control of your employees.
3) It is a school and you would rather them visit porn sites.
4) The Armenian government has banned social networking sites.

That is all I could come up with in 20 seconds...

ADD: If the reason is #2, this is what I recommend to my customers:
http://en.wikipedia.org/wiki/Pink_slip_%28employment%29

Nothing personal against facebook tho.This is also what I recommend if one of my customers catches one of their employees with a CD, memory stick, or any other type of memory device at work.