Yes, it is possible to perform category locks on MikroTik devices using several techniques. This type of blocking is useful for managing access to specific types of content on a network, such as social media sites, adult content, online games, among others.

We explain some methods in detail:

1. Layer 7 Protocols (L7)

MikroTik allows the creation of Layer 7 Protocol rules, which are used to identify specific patterns in the network traffic passing through the device.

For example, you can create a filter that detects certain keywords or specific domains associated with a content category, such as “social media” or “streaming.” Once the patterns are identified, you can apply firewall rules that block that traffic.

Create an L7 filter

1. Access WinBox or SSH terminal of your MikroTik.
2. Navigate to IP -> Firewall -> Layer7 Protocols.
3. Create a new rule, adding the desired pattern. For example, to block YouTube, you could use a pattern like: ^.+(youtube.com).*$.
4. You then use this L7 rule in a firewall rule to block the traffic.

2. Web Proxy

MikroTik also includes a Web Proxy that can be used to block URLs based on keywords. The proxy can be configured to intercept all HTTP traffic and apply filtering rules that block access to certain categories of websites.

Web Proxy Configuration

1. Enable Web Proxy under IP -> Web Proxy.
2. Configure the port and IP address of the proxy.
3. En Access, add rules to block specific URLs or keywords related to the categories you want to block.

3. DNS

A simple way to block websites by category is to manipulate DNS responses so that specific sites are not resolved correctly, or are redirected to a “block” page.

This can be done by using MikroTik's DNS server to intercept DNS queries and respond with specific IP addresses.

Configure DNS blocking

1. Go to IP -> DNS -> Static.
2. Add entries for the domains you want to block, redirecting them to an IP address that displays an error page or information about the internet usage policy.

4. MikroTik RouterOS Scripts

For more dynamic and automated management, you can write scripts in RouterOS that apply blocking rules based on updated lists of content categories, and that can adapt to changes or updates to blocked categories.

These techniques can be combined and adjusted according to the specific needs of your network, offering robust control over the type of content that users on your MikroTik network can access.