The implementation of Layer 7 (L7) in MikroTik RouterOS allows you to identify and classify network traffic based on the actual content of the packets, rather than just the IP address or port.

This is useful for filtering, prioritizing, or limiting specific traffic, such as blocking specific websites, prioritizing VoIP traffic, or limiting bandwidth for streaming applications. Here's how to configure Layer 7 rules in MikroTik RouterOS:

1. Define a Layer 7 Pattern

First, you must create a Layer 7 pattern that RouterOS will use to identify specific traffic. This is done in the “IP” menu → “Firewall” and then in the “Layer7 Protocols” tab. Here you can define a new L7 pattern.

/ip firewall layer7-protocol
add name="nombre_protocolo_L7" regexp="expresión_regular"

For example, to identify HTTP traffic that contains the word “facebook” in the packet header, you could use a regular expression like this:

add name="facebook" regexp="facebook.com"

2. Create a Firewall Rule Using the L7 Pattern

After defining the L7 pattern, you can use it in a firewall rule to filter or prioritize traffic. This is done in the “IP” → “Firewall” menu and then in the “Filter Rules” or “Mangle” tab depending on what you want to achieve.

• To block traffic:

/ip firewall filter
add action=drop chain=forward layer7-protocol=nombre_protocolo_L7

• To flag traffic and then apply specific policies (such as rate limiting or prioritization):

/ip firewall mangle
add action=mark-packet chain=forward layer7-protocol=nombre_protocolo_L7 new-packet-mark=marcado_paquete

Important considerations

• Performance: Heavy use of L7 rules can significantly increase the load on the device's CPU, as it requires inspecting the contents of packets. It is important to monitor router performance after implementing these rules, especially on high-traffic networks.
• Accuracy: Regular expressions must be written carefully to ensure that only the desired traffic is captured. A poorly defined regular expression can lead to false positives or negatives.
• Encryption: Today, much Internet traffic uses encryption (such as HTTPS), which can limit the effectiveness of Layer 7-based rules in identifying the specific content of the traffic. For encrypted traffic, consider alternative identification and control methods, such as blocking or prioritization based on IP addresses, ports, or SNI TLS connections.

The Layer 7 configuration in MikroTik RouterOS is a powerful tool for advanced traffic management, allowing network administrators to implement sophisticated network policies based on the actual content of data packets.