I am simply trying to detect all but two subdomains for a specific domain in layer 7 (for DNS forwarding). This should return true for all subdomains of example.com except for sub1.example.com and sub2.example.com.

I've tried for hours different combinations using negative lookaheads and lookbehinds, but this does not seem to be supported for some reason. I just get the error "bad regex: ?+* follows nothing". Can anyone suggest a regex that will negate two subdomains? Thank you!

Paste your try.

Could probably be structured better, but it doesn't work in RouterOS to begin with.

Any thoughts on this? I'm at a total loss here.

got lookaheads to work.
will match anything not containing /

got lookaheads to work.

Code: Select all

^[^/]+\$

will match anything not containing /

Look, the user has been waiting impatiently for your "reply" for 9 years...

Look, the user has been waiting impatiently for your "reply" for 9 years...

will never understand these passive-aggressive replies.

the reason i found this was because i googled it. and the reason i registered it here was in part due to answering myself and helping anyone else that has to google it in the future.

will never understand these passive-aggressive replies.

the reason i found this was because i googled it. and the reason i registered it here was in part due to answering myself and helping anyone else that has to google it in the future.

will never understand these useless-obvious replies.

the reason I reply on that way was because your answering is completely uselessly, not for the timing, but for context, and not helping anyone else that has to google it in the future.


If someone on the forum asks for help solving an equation, is there any point in telling them that 1+1 equals 2?


I don't know why in 2014 I didn't notice that he had replied to me.
Ignoring that by now everything is encrypted and it makes very little sense to continue using layer7,
and considering that RouterOS does not support RegEx extended syntax like lookaheads and lookbehinds, but only basic functions,
answer the problem, with some help...

Create a RegEx Layer 7 with these requirements:

Legend:
* zero or more dns valid characters or dot
? exactly one dns valid characters or dot
anything is any combination of dns valid characters and dot (.)

Must match exactly example.com

Must not match anythingexample.com or example.comanything or anythingexample.comanything
BUT must match all the previous 3 example if the string end with .example.com

Must match ?.example.com and ??.example.com and ???.example.com

Must match *?????.example.com

When is exactly ????.example.com must match everything, except when "????" is equal to sub1 or sub2

it's important because at least 1 person came here from google: me.

if the forum moderators would prefer that people don't post on old threads, they can very easily block threads after a certain age. reddit does it.

regarding your attitude, i'd recommend going out and touching some grass.

I, also, found this thread interesting + useful years after the fact and believe I have something also useful to leave behind for others. I do not find the answers to this question to be obvious and hope that folks continue to read and contribute to this forum in constructive ways.

Mikrotik appears to use POSIX Regex (see https://wiki.mikrotik.com/wiki/Manual:R ... xpressions) which does not appear to include support for negative lookaheads https://en.wikibooks.org/wiki/Regular_E ... xpressions

It does appear it could be possible to do a version of this in Mikrotik's regex's though via a very, very verbose regex though -- see https://stackoverflow.com/questions/153 ... 6_15377532

I think the point was there is no negative lookahead or lookbehind. The only negation is for a char... e.g. you say some position is NOT a char... so while possible so look for all the derivatives with an OR ( | ), like ([^s]ub1|s[^u]b1||....) the sequence gets long, quickly & since it could be shorter than 4 chars, you need even more OR's | for those too. And this be only for the abstract case of sub1 and sub2 - longer or different sequences be even harder/longer.

To @rextended point, if your problem is Layer7 firewall rules... There are otherways to skin the cat... You can just use two Layer7 regex, one with the "allows" and another for the "drop" ones, and use corresponding in two firewall filter rules.