Most websites now use https and blocking https websites is much more difficult with MikroTik RouterOS version lower than 6.41. But starting with RouterOS v6.41, MikroTik Firewall introduces a new property called TLS Hos t which is able to match https websites very easily. 

Therefore, blocking https websites like Facebook, YouTube, etc. It can be easily done with MikroTik Router if the RouterOS version is higher than 6.41. 

Filtering based on host names

You can use “tls-host” in firewall rules to filter traffic based on hostnames instead of IP addresses. This can be beneficial if the IP addresses of the servers you communicate with are prone to changing and you prefer to use hostnames that remain constant.

/ip firewall filter add chain=forward dst-port=443 protocol=tcp tls-host=example.com action=accept

In this example, the rule will allow outbound TLS traffic to port 443 destined for “example.com.”

Certificate and hostname management

By using the “tls-host” option, you can make it easier to manage SSL/TLS certificates on your network. If the certificates change or are renewed and the hostname remains the same, you will not need to update the firewall rules with new IP addresses.

Reducing dependency on fixed IP addresses

In some cases, especially when interacting with cloud-hosted services or with service providers that may change assigned IP addresses, using “tls-host” provides an abstraction layer that reduces reliance on fixed IP addresses.

/ip firewall filter add chain=forward dst-port=8443 protocol=tcp tls-host=cloud-service.com action=accept

Here, outgoing TLS traffic to port 8443 destined for “cloud-service.com” will be allowed regardless of the current IP address of the service.

It is important to note that for the “tls-host” option to be effective, the remote service must support the use of host names instead of IP addresses. Not all services or applications allow this flexibility, so it is crucial to review the documentation for the specific service you are using.

 How to Block HTTPS Websites with TLS Host Matcher

1. Go to the IP > Firewall menu item and click the Filtering Rules tab and then click the PLUS SIGN (+). The New Firewall Rule window appears.
2. Choose forward from the String drop-down menu.
3. Choose tcp from the Protocol drop-down menu.
4. Click Dst. Port and port entry box 443.
5. Click on the Advanced tab and click on the TLS Host input box and put the domain name you want to block (such as *.facebook.com) in this box.
6. Click the Action tab and choose drop from the Action drop-down menu.
7. Click Apply and the OK button.

Firewall rule by Command

/ip firewall filter add chain=forward dst-port=443 protocol=tcp tls-host=*.facebook.com action=drop