MikroTik

Hello Everybody

I use a RB750GL RouterOS 5v.
I want to block acertain group of users from using facebook olso i want to allow others to use it to>

I used the webproxy to block it but it blocked everyone.
this is what I did

enabled proxy transparent and set the access rule.
/ip proxy access
add dst-host=www.facebook.com action=deny
a friend here sent me this:
make a new access list rule with the src-address of the customer that needs access, then specify the address of the page, and rule 'allow'. the generic rule will block all people, but this one rule will make an exception for specific IP.

I deployed it as here:


the ip I want allow is 3
and I want to block from 192.168.1.20 to 192.168.1.90

please support
Thanks in advance

try this

create a profile with address-list where the Facebook is blocked then add user to this profile
please follow this

/ip hotspot user profile
add address-list=facebook idle-timeout=none keepalive-timeout=2m name=blocked \
shared-users=1 status-autorefresh=1m transparent-proxy=no

/ip firewall nat
add action=redirect chain=dstnat comment="" disabled=no dst-address-type="" \
protocol=tcp src-address-list=facebook to-ports=9999

/ip proxy
set port=8080,9999

/ip proxy access
add action=deny comment="" disabled=no dst-host=www.facebook.com local-port=9999

here is example user with 22 name and pass added to the profile
/ ip hotspot user add name=22 password=22 profile=blocked

/ip firewall nat
add action=redirect chain=dstnat comment="" disabled=no dst-address-type="" \
protocol=tcp src-address-list=facebook to-ports=9999

before i say it work or not
where i should find it
dst-address-type="" \

Thanks in advance

/ip firewall nat
add action=redirect chain=dstnat comment="" disabled=no dst-address-type="" \
protocol=tcp src-address-list=facebook to-ports=9999

before i say it work or not
where i should find it
dst-address-type="" \

Thanks in advance

I did not got you
dst-address-type is empty
as simple as that

/ip firewall nat
add action=redirect chain=dstnat comment="" disabled=no dst-address-type="" \
protocol=tcp src-address-list=facebook to-ports=9999

before i say it work or not
where i should find it
dst-address-type="" \

Thanks in advance

I did not got you
dst-address-type is empty
as simple as that

thanks but it did not work too

/ip firewall nat
add action=redirect chain=dstnat comment="" disabled=no dst-address-type="" \
protocol=tcp src-address-list=facebook to-ports=9999

before i say it work or not
where i should find it
dst-address-type="" \

Thanks in advance

I did not got you
dst-address-type is empty
as simple as that

thanks but it did not work too

I did it before and i will tell you what i did, may be that will help you!

1. i created a layer-7 protocol rule........(you can find the regex for facebook very easily on the net)
2. then i created the firewall rule to block all the user
3. then i specified that allow those user to access the facebook.


still if you need any help/configuration, just tell me, i will send you all my configuration through mail...

I did it before and i will tell you what i did, may be that will help you!

1. i created a layer-7 protocol rule........(you can find the regex for facebook very easily on the net)
2. then i created the firewall rule to block all the user
3. then i specified that allow those user to access the facebook.


still if you need any help/configuration, just tell me, i will send you all my configuration through mail...

Thanks for your reply

plz I am a kind of beginner so plz if you can detail the firewall rules allow and block.
i created the layer7 protocol
but the firewall rules i failed doing it

thanks again

no problem, can you tell me your email so that i will send you the complete step by step procedure.

or wait couple of days, i will post here.

no problem, can you tell me your email so that i will send you the complete step by step procedure.

or wait couple of days, i will post here.

sorry I am in a deep prblm coz of it

this is my mails
kamel.pcs@gmail.com
kamel.mohamed@live.com

thanks

thank you all for help

but i found a way to block for every single ip address not using user

in src address type the ip
and in dst host type the website
and select deny

only the ip you add will be blocked from using the website

well done...............

do one more thing, just go to the advance tab of this rule that you created and select the layer7 protocol that you created and play little bit more, meanwhile i will send you the complete configuration.

waiting for you

thanks for your help

arbabnazar...thanks for your support dude, can you send it to me also? your guide.

verywellwisher_2000@yahoo.com

TIA

Can someone please forward this complete complete configuration to me too. I have same problem, meanwhile, I am trying what isaw in the thread for now.


kolutola@gmail.com

Hi !

I'm very interrested for this guide too. arbabnazar, or someone please forward that guide to me:

mladen.bruck@avrbit.com

Thank you !

sorry for late reply, I will post it on public forum and will share it with all of you.

here is the link for your problem..........sorry for late reply.......

http://rbgeek.wordpress.com/2012/05/29/ ... s-layer-7/

here is the link for your problem..........sorry for late reply.......

http://rbgeek.wordpress.com/2012/05/29/ ... s-layer-7/

Hello,
i came into this tropic when you already solved and you have shown good instruction.

but i am problem with my user. i want to block specific user based. my office have 150 employee. for everyone have hotspot access. any one some time sit on one computer, some time another computer. he log on his hotspot user, and he get access.

so i want some guys facebook access, some not. sorry to say i am not too much expart , so please give me step by step configuration wll be very helpful. my email is
riajul74@hotmail.com

sorry for late reply, I will post it on public forum and will share it with all of you.

Hi arbab nazar
I tried this solve in RB951UI with Winbox 5.25, it is not working to me , i can block facebook but i can´t allow for some ips. Is it way only working in Winbox 3.30?

I did it before and i will tell you what i did, may be that will help you!

1. i created a layer-7 protocol rule........(you can find the regex for facebook very easily on the net)
2. then i created the firewall rule to block all the user
3. then i specified that allow those user to access the facebook.


still if you need any help/configuration, just tell me, i will send you all my configuration through mail...

Send me the configuration through mail