To restrict access to a specific list of websites from a MikroTik device, you can use the firewall in conjunction with the Layer7 Protocols functionality to create a sort of blacklist.

This setting allows you to block traffic to certain websites based on the domain name. Here's how to configure it:

Step 1: Define Layer7 Protocols

First, you need to create a Layer7 rule that identifies traffic to the websites you want to block.

1. Go to IP > Firewall and select the tab Layer7 Protocols.
2. Click the add button (+) to create a new rule.
3. In the countryside Name, give your rule a descriptive name.
4. In the countryside Regexp, enter a regular expression that matches the domain names you want to block. For example, to block “example.com”, you can use: ^.+example\.com.*$If you want to block multiple sites, you can separate them with | (which means OR in regular expressions). For example: ^.+(example\.com|anotherexample\.com).*\$

Step 2: Create a Firewall Rule to Block Traffic

Now, you must create a rule in the firewall that uses the Layer7 rule you just defined to block traffic to those sites.

1. Still in IP > Firewall, go to the tab Filter Rules.
2. Click the add button (+) to create a new rule.
3. Select the tab General and set Chain a forward.
4. Go to the tab Advanced and field Layer7 Protocol, select the Layer7 rule you created earlier.
5. Switch to tab Action, Select Action as drop to block traffic.

Step 3: Apply and Test

After configuring the rules, apply the changes and test to ensure that access to the specified sites is effectively blocked. Try accessing blocked websites from a device on your network to confirm that the block is working as expected.

Important considerations

• HTTPS and Limitations: This method may not be effective for HTTPS sites, since the traffic is encrypted, and MikroTik does not inspect encrypted content without additional configurations such as an HTTP or HTTPS proxy. For effective HTTPS blocking, consider using a Web Proxy or DNS.
• DNS usage: Another option is to block websites at the DNS level, restricting resolution of specific domain names or redirecting them to an invalid IP address. However, this requires that all clients on your network use the DNS configured on the MikroTik.
• Maintenance: The website list and regular expressions will need regular maintenance and updates to ensure that blocking remains effective.

Remember that blocking access to websites must be done in accordance with acceptable use policies and respecting local and international privacy and censorship laws.