Domain blocking can be done using address list first so that the domain names can be resolved and those address lists can be converted into a rule that allows blocking clients who would like to go to those pages.

The MikroTik RouterOS firewall is capable of blocking access to specific web pages using various techniques. This type of filtering is usually done through the firewall rules in the Layer 7 Protocol (Layer 7 Protocol) and/or DNS address filtering. Here I explain how:

Locking via Layer 7 (L7) Protocol

This technique involves creating a Layer 7 Protocol rule that identifies traffic to the specific web page you want to block and then applying a firewall rule that uses this classification to block the traffic.

1. Create a Layer 7 Protocol Rule:
   • Go to IP → Firewall → Layer7 Protocols and click + to add a new rule.
   • In the countryside Name, give it an identifying name.
   • In the countryside Regexp, enter a regular expression that matches the domain name of the web page. For example, ^.+(example\.com).*\$ to block “example.com”.
2. Create a Firewall Rule:
   • Go to IP → Firewall → Filter Rules and add a new rule.
   • Set the Chain in “forward”.
   • En Advanced, set the Layer7 Protocol to the name of the rule you created.
   • En Action, select “drop” to block traffic.

Blocking via DNS Filtering

DNS filtering is another effective technique, especially useful for blocking all addresses associated with a domain name. This is done by intercepting DNS requests for the specific domain and preventing them from being resolved correctly.

1. Configure Static DNS:
   • Go to IP → DNS → Static and add a new record.
   • In the countryside Name, enter the domain name you want to block.
   • In the countryside Address, you can enter an invalid IP address (such as “0.0.0.0”) or the address of a warning page if you have one configured.

Considerations

• Effectiveness: These methods may not be effective against all encrypted (HTTPS) traffic without also intercepting SSL traffic, which requires additional configuration and privacy and security considerations.
• Maintenance: Domain names and IP addresses may change. Blocklists may need regular updates to remain effective.
• Privacy & Security: Intercepting and filtering HTTPS traffic to block specific sites involves decrypting the traffic, which raises important privacy and security considerations and requires user consent.

The MikroTik firewall offers a powerful tool for network administrators seeking to control and restrict access to specific content on the network, although it should always be used responsibly and in accordance with applicable privacy and security policies.