Is there any way I can mark traffic for youtube ?
(so that i can route it to second gateway)

I saw few posts on forum as well but most guys telling that not working. any working solution for it?

Use layer 7 protocol to find youtube connections and mangle to mark them.
Or use layer 7 name direct in NAT rule.

Try this:
P.S. You may need to restart your router.

Try this:

Code: Select all

/ip firewall layer7-protocol add name=youtube regexp="^.+(youtube.com).*$"
/ip firewall filter add chain=forward protocol=tcp dst-port=80,443 layer7-protocol=youtube action=drop comment="Block YouTube"

.

its giving following error

Try

I'm not sure if it's still needed now, in 2017, but this is my solution, which I was developing for several days to make everything work nicely.

First, switch on the IP firewall: Then, add some YouTube networks to a new access list (just some you're sure belong to YouTube): Add layer-7 protocol to determine YouTube traffic: Add mangle rule to add found IP addresses of YouTube to address-list (with timeout of 30 mins): Add mangle rule to mark YouTube traffic at last. The first rule marks a connection to youtube and then all the packets inside the connection are marked: Viola! All the Youtube traffic is now marked.

Some addition to my previous post - it appeared that Opera uses UDP for YouTube traffic (i guess any browser which still uses flash player does so, or it's due to this QUIC protocol usage by google, read about it on wikipedia), and you should mark it as well.
Keeping this in mind, your mangle rules for marking YouTube traffic are like this (no changes for the rest):

NO, nothing gets marked as youtube when accessing youtube.com with above! (all counters stay on 0)
And as nothing is marked, I can not process it in firewall (in any way)

I'm not sure if it's still needed now, in 2017, but this is my solution, which I was developing for several days to make everything work nicely.

First, switch on the IP firewall:

Code: Select all

/interface bridge settings
set use-ip-firewall=yes

Then, add some YouTube networks to a new access list (just some you're sure belong to YouTube):

Code: Select all

/ip firewall address-list
add address=208.117.224.0/24 list=youtube
add address=208.117.225.0/24 list=youtube
add address=208.117.228.0/24 list=youtube
add address=208.117.229.0/24 list=youtube
add address=208.117.232.0/24 list=youtube
add address=208.117.233.0/24 list=youtube
add address=208.117.234.0/24 list=youtube
add address=208.117.238.0/24 list=youtube
add address=208.65.152.0/24 list=youtube
add address=208.65.153.0/24 list=youtube
add address=208.65.154.0/24 list=youtube
add address=64.15.112.0/20 list=youtube
add address=208.117.236.0/24 list=youtube
add address=74.125.96.0/19 list=youtube
add address=72.14.221.0/24 list=youtube

Add layer-7 protocol to determine YouTube traffic:

Code: Select all

/ip firewall layer7-protocol
add name=youtube regexp="^.*(youtube\\.com|googlevideo\\.com).*\$"

Add mangle rule to add found IP addresses of YouTube to address-list (with timeout of 30 mins):

Code: Select all

/ip firewall mangle
add action=add-dst-to-address-list address-list=youtube address-list-timeout=30m chain=prerouting layer7-protocol=youtube protocol=tcp

Add mangle rule to mark YouTube traffic at last. The first rule marks a connection to youtube and then all the packets inside the connection are marked:

Code: Select all

/ip firewall mangle
add action=mark-connection chain=forward connection-state=new dst-address-list=youtube dst-port=80 new-connection-mark=youtube passthrough=yes protocol=tcp
add action=mark-connection chain=forward connection-state=new dst-address-list=youtube dst-port=443 new-connection-mark=youtube passthrough=yes protocol=tcp
add action=mark-packet chain=forward connection-mark=youtube new-packet-mark=youtube passthrough=no

Viola! All the Youtube traffic is now marked.

Very good. Thanks Man.