This is possible, why answer "no" after I first said it was possible? In the real world "5 website on internet" are not own hosted blogs. You can't separate https traffic from/to cloud hosters. But all web services use both of them: encryption and clouds. So, you need a DNS filt...

i want to restrict only 2 users ip for access only 5 website on internet, is this possible on mikrotik?

no

but how can i pass through my vpn port and protocol from mikrotik ? l2tp uses random free UDP port at both sides see RFC 2662, section 8.1: L2TP uses the registered UDP port 1701 [RFC1700]. The entire L2TP packet, including payload and L2TP header, is sent within a UDP datagram. The initiator of an...

3) In case firewall filters are used to drop some traffic you must be sure that forward packets which belong to natted connection are accepted: /ip firewall filter add chain=forward action=accept in-interface=wan_interface connection-nat-state=dstnat connection-state=established,related In my case ...

is any way to block upload file by extension type example block uploading ,jpg or .mp4 ?

No. It is not.

So MAC is only available on the side of the switch in the Mikrotik and not at the router side/outside.

There are not sides in thr Mikrotik. They are levels of the protocol stack.

No, it isn't possible. You can filter by ip address.

you are wrong. this is only needed for accessing router's services

It work in hundreds installations. - Just check howtos from Google search and comments to them.

As I understand, you want use routers 2 and 3 as transparent access pionts.

easiest way:
Turn off DHCP-server on routers 2 and 3.
Use bridged port (not 1st in default configuration) for connection.

But CAPsMAN is more effective.

The diagram is a part of wiki. I have studied it.
My sample is a sample, not a problem. I want to know a real 'paclet flow' in RouterOS. It solve all my problems.

define custom DHCP option for local DNS
set this option for selected leases

busla
this conversation is not in any way related to this "New packet Flow Diagram"

Why?
I create rules based on packet flow. Rules don't work. Either the diagram is wrong or diagram need some comments.

Documentation is wrong. You must add allow rule to the input chain of ip->firewall->filter.

The redirect is not enough. You must reconfigure proxy to transparent mode.

I have service at 192.168.0.2:12345 I added the rule: ip firewall nat add chain=forward action=dst-nat protocol=udp port=12345 to-addresses=192.168.0.2 in-interface=ether1 log=yes but the log remains empty Dst-NAT rule doesn't work when it isn't allow rule in input chain of filter: ip firewall filte...

It is a classic way: use separated network for public servers. You can find more info by words: "DMZ", "demilitarized zone", "demilitarized network". 1) disable brige 2) plug directly server C into Mikrotik 3) set ip 139.1.2.1 for 3th interface 4) define routes 5) check...

As described in the diagram RouterOS must apply dst-nat rules before filter rules. But it does not. Why?