Mikrotik Layer 7 Regexp List

MikroTik Layer 7 Protocol (L7) filtering is a powerful feature used for deep packet inspection. It enables MikroTik routers to identify and manage traffic based on patterns in the data payload, such as URLs, specific applications, or protocols. By using Layer 7 regular expressions (regex), administrators can create advanced rules to monitor or control traffic effectively. This guide will walk you through everything you need to know about MikroTik Layer 7 Regexp Lists, how to create them, and their practical applications.

What Is Layer 7 Filtering?

Layer 7 filtering operates on the application layer of the OSI model. Unlike traditional filtering, which relies on IPs, ports, or protocols, Layer 7 uses regex patterns to analyze the content of packets. This makes it ideal for:

• Blocking specific websites or applications.

• Managing bandwidth usage for certain traffic types.

• Prioritizing or deprioritizing traffic based on patterns.

How Does Layer 7 Filtering Work in MikroTik?

When a Layer 7 rule is created in MikroTik, the router inspects the data packets and matches them against predefined patterns. If a match is found, the rule executes the specified action, such as blocking, throttling, or redirecting the traffic.

Benefits of Using Layer 7 Filtering

1. Granular Control: Fine-tune traffic management with application-level specificity.

2. Enhanced Network Security: Block unwanted applications or malicious traffic.

3. Bandwidth Optimization: Identify and limit bandwidth-heavy applications.

Getting Started with MikroTik Layer 7 Regexp Lists

To use Layer 7 filtering, you’ll need to define regex patterns that match the traffic you want to target. These patterns are stored in Layer 7 Protocols.

Step 1: Access MikroTik Router

Log in to your MikroTik router via Winbox or an SSH session. Ensure you have admin privileges.

Step 2: Add a Layer 7 Protocol

Navigate to IP > Firewall > Layer 7 Protocols.

1. Click the “+” button to add a new Layer 7 protocol.

2. Define a name for the protocol (e.g., block_youtube).

3. Enter a regex pattern in the “Regexp” field.

Example to block YouTube:

^.+(youtube.com|ytimg.com).*$

This regex matches traffic containing "youtube.com" or "ytimg.com".

Step 3: Create Firewall Rules

After defining Layer 7 protocols, you can apply them to firewall rules:

1. Go to IP > Firewall > Filter Rules.

2. Create a new rule and set the following:

   • Chain: Choose forward to apply the rule to forwarded traffic.

   • Advanced: In the “Layer 7 Protocol” field, select the protocol you just created.

   • Action: Choose an action, such as drop to block traffic.

Example script:

/ip firewall filteradd chain=forward layer7-protocol=block_youtube action=drop comment="Block YouTube Traffic"

Step 4: Test the Rule

Verify that the rule works by attempting to access the targeted application or website. Monitor the firewall logs to ensure the traffic is being blocked or filtered correctly.

Common Layer 7 Regexp Patterns

Below are some commonly used regex patterns for Layer 7 filtering:

1. Block Social Media Platforms

To block Facebook:

^.+(facebook.com|fbcdn.net).+$

To block Instagram:

^.+(instagram.com|cdninstagram.com).+$

2. Block File-Sharing Applications

To block BitTorrent traffic:

^.*(torrent|peer_id|announce|info_hash).*$

3. Block Video Streaming

To block Netflix:

^.+(netflix.com|nflxvideo.net).+$

Managing Bandwidth with Layer 7 Filtering

MikroTik Layer 7 filtering can also be used for queue management to limit or prioritize bandwidth for specific traffic types.

Step 1: Create a Layer 7 Protocol

Define a regex for the application you want to manage. For example, to limit YouTube:

^.+(youtube.com|ytimg.com).*$  

Step 2: Create Mangle Rules

Mangle rules mark packets for further processing.

Example script:

/ip firewall mangleadd chain=forward layer7-protocol=block_youtube action=mark-connection new-connection-mark=youtube_conn passthrough=yesadd chain=forward connection-mark=youtube_conn action=mark-packet new-packet-mark=youtube_packet passthrough=no

Step 3: Set Up Queues

Create a queue to limit YouTube traffic.

Example script:

/queue simpleadd name="YouTube Limit" packet-marks=youtube_packet max-limit=2M/2M

This limits YouTube traffic to 2 Mbps.

Best Practices for Using Layer 7 Filtering

1. Optimize Regex Patterns

Use efficient regex patterns to avoid overloading the router’s CPU. Complex patterns may slow down performance.

2. Combine with Other Rules

Layer 7 filtering works best when combined with IP-based or port-based filtering to reduce processing load.

3. Monitor Router Performance

Inspect the router’s CPU and memory usage regularly to ensure Layer 7 filtering does not negatively impact performance.

4. Regularly Update Patterns

Websites and applications may change their domain names or traffic patterns. Keep your regex patterns updated to maintain effectiveness.

Limitations of Layer 7 Filtering

While Layer 7 filtering is powerful, it has some limitations:

• CPU-Intensive: Processing regex patterns requires significant CPU resources, especially in high-traffic networks.

• Encrypted Traffic: Layer 7 filtering may not work effectively on HTTPS or encrypted traffic.

• Dynamic Content: Applications that use dynamic IPs or domains can bypass Layer 7 filtering.

To address these limitations, consider using additional tools like MikroTik Web Proxy or external DPI (Deep Packet Inspection) solutions.

Troubleshooting Common Issues

1. Layer 7 Rules Not Working

• Ensure the regex pattern is correct and matches the targeted traffic.

• Verify that the firewall rule is properly configured and placed in the correct chain.

2. High CPU Usage

• Simplify regex patterns to reduce processing load.

• Limit Layer 7 filtering to critical traffic only.

3. Traffic Still Getting Through

• Check if the application or website is using encrypted traffic (HTTPS). Consider blocking IP ranges associated with the service.

MikroTik Layer 7 filtering provides network administrators with advanced capabilities to monitor and control traffic based on application-layer data. By using regular expressions effectively, you can block unwanted traffic, optimize bandwidth, and enhance security.

While Layer 7 filtering has its limitations, combining it with other MikroTik features, such as mangle rules and queues, allows you to create a robust and efficient network management strategy. Always keep your patterns updated, monitor router performance, and test your configurations regularly to maintain an optimized network.