layer7 doesn't work on ip firewall filter (ros 3.28)

awarmanf · Tue May 04, 2010 9:52 am

I already write this layer7 rule on ip firewall mangle and it works perfectly to "catch" request to a trojan link:

/ip firewall mangle print
chain=prerouting action=add-dst-to-address-list protocol=tcp src-address-list=users address-list=virus-ym \
   address-list-timeout=3d layer7-protocol=virus-ym in-interface=lan dst-port=80
/ip firewall layer7-protocol print
1 virus-ym                                            ^get./image.php[ -~\t-\r]*host:.bflmages.com
:foreach x in=[ /ip firewall address-list find list="virus-ym" ] do={ :local a [ /ip firewall address-list get $x address ]; :put $a; }
69.147.83.187
98.136.50.138

When I write layer7 rule on ip firewall filter it doesn't work, actually cann't "catch" packet at all:

/ip firewall filter print
chain=forward action=drop protocol=tcp src-address-list=users layer7-protocol=virus-ym in-interface=lan dst-port=80

Is it supposed that layer7 works only on ip firewall mangle ?

Thanks.