Mikrotik How To

If your broadband network operates through a MiktroTik router, then you can block your children and others in your household from accessing Facebook. To do this, you must have WinBox, a console application that allows you to fine-tune all your MikroTik router settings.
With it, you can log directly into your router via your computer and then submit specific terminal commands to block any and all Facebook Internet content. Difficulty:
Easy Instructions

1. Launch WinBox, and log in to your router account. 
2. Click the "New Terminal" button in the left menu. 
3. Type the following commands into the terminal, and press enter after typing each command:

/ip firewall filter add chain=forward content="facebook.com" action=drop comment="Drop Facebook" /ip firewall filter add chain=forward content="www.facebook.com" action=drop comment="Drop Facebook"

/ip firewall filter add chain=forward content="apps.facebook.com" action=drop comment="Drop Facebook"

/ip firewall filter add chain=forward content="facebook" action=drop comment="Drop Facebook" /ip firewall filter add chain=forward content="facebook.*" action=drop comment="Drop Facebook"

(www.wikiopens.com )

• Restrict bandwidth usage for embedded video streaming

Second, marking data packets using firewall mangle:
Then finally, add new rule in simple queue to limit bandwidth usage for http-video packets (in this example, download for embedded video streaming was capped at 64kbps, you can define this to suite your needs).

•  Blocking embedded video streaming with mikrotik

First, add a video content filter at Layer7 protocol:
Second, marking data packets using firewall mangle:
Finally, drop all http-video packets :)

MikroTik Router RB951-2n - If you thought the RB751 couldn’t get any cheaper, MikroTik have specs available for download now for the new RB951-2n.

Smaller and cheaper than the 751. No USB port or external antenna though. No date on release yet, but pre-production samples are available soon to distributors.

Now you can build and improve your network security with mikrotik router without high cost.

The RB951-2n is the home wireless AP you have been waiting for. It has five Ethernet ports and a 802.11b/g/n wireless AP with an antenna built in.

This model is much smaller than the more powerful 2HnD model, the RB951-2n looks exactly like our popular RB750 series. The device is very small and will look good in any home or

office, wall mounting anchor holes are provided. 

Heres the specification of RB951-2n :

CPU Atheros AR9331 300MHz

CPU Memory 32MB

DDR SDRAM onboard memory

Ethernet Five independent 10/100 Ethernet ports

LEDs Power, NAND activity, 5 Ethernet LEDs

Power options PoE:  8-30V DC on Ether1 (Non 802.3af).

Jack: 8-30V DC Dimensions 113x89x28mm.

Weight without packaging and cables: 142g

Power consumption Up to 4W

Operating Temp -20C .. +50C

Operating System MikroTik RouterOS, Level4 license

Package contains RouterBOARD in a plastic case, power adapter

Antennas 1x1 MIMO with two onboard PIF antennas, max gain 1.5dBi

TX power 802.11b: 17dBm @ 11Mbps

802.11g: 15dBm @ 6Mbps to 11 dBm @ 54 Mbps

802.11n: 15dBm @ MCS0 to 9dBm @ MCS7 40MHz

RX sensitivity 802.11g: -92dBm @ 6Mbit/s to -73dBm @ 54Mbit/s

802.11n: –92 dBm @ MCS0 to –67 dBm @ MCS7

Modulations OFDM: BPSK, QPSK, 16 QAM, 64QAM

DSSS: DBPSK, DQPSK, CCK

The port "knock" itself is similar to a secret handshake and can considt of any number of TCP, UDP, or ICMP or other protocol packets to numbered ports on the destination machine.The KNock may also consist of text strings sent to the device being knocked to add additional complexity and security.
Port knocking example :

Host send a connection to the one of router ports, the router stores the requester's IP for an amount of time.If the host send a connection again in the other ports, the router will check to see if the IP is the same IP from the first connection. If the IP is the same and the time between first attemp and second is within a specified time then the requester IP will be allowed to access the router.

/ip firewall filter

add action=add-src-to-address-list address-list=ICMP address-list-timeout=1m chain=input \
  disabled=no protocol=icmp

add action=add-src-to-address-list address-list="ICMP + Http" address-list-timeout=1m chain=input
  disabled=no dst-port=80 protocol=tcp src-address-list=ICMP

add  action=drop chain=input disabled=no dst-port=22,23,8291 protocol=tcp \
  src-address-list="!ICMP + Http"

(youtube/wiki)

Mikrotik Layer 7 Firewall Setup - Layer 7 is the application layer of the OSi system model and allows the Mikrotik router to analyze each and every packet that enters your network, and decide what to do with it.


The first step is to get a script file with the list of the most common Layer 7 protocols. This can be obtained from the Mikrotik Wiki via the following link :

http://www.mikrotik.com/download/l7-protos.rsc

We can now copy this script file into the Mikrotik 'Files' list.

Once you have the script file copied into the 'Files' window we can now proceed to import it via the terminal.
To make sure the script file imported properly, head to the 'IP' -> 'Firewall' menu and go to the 'Layer 7 Protocol' tab. You should now have a list ofthe most common types of traffic found within a network.

We can now create a firewall rule to block any type of Layer 7 traffic we choose. Go to the 'Filter' tab and add a new Firewall rule. Leave the chain set to 'forward'.

In the ' Advanced' tab you may now choose the Layer 7 traffic type you would like to block/allow.

Once the Layer 7 traffic type has been selected, proceed to the 'Action' tab and define the action of your choice. Drop is the most common action to stop a certain type off traffic flowing through your network.

The bane of most ISPs is Peer to Peer traffic(p2p). If you run hotels or apartments, especially apartments full of students, p2p will be your main source of issues. In some cases, extreme measure must be taken. So how does one go about taking back their network? The first thing to do is to find the offending traffic.
Mikrotik has some built in matching functionality for p2p traffic. You can use this in mangle rules or firewall rules. In mangle, you can mark the packets and then lower their precedence, or stick them in a smaller queue. In the firewall, you can block them all together.