In this article, I will describe one functional use for the layer-7Â filters that MikroTik offers.Â This feature can be very useful if used with caution.Â The main problem with L7 filters is that they require much more processor time than many of the firewall functions.Â I am not saying this just to “scare” you away from using them, but you need to be aware of this issue.Â The scripts in this article have been tested and DO work as written.Â They are in no way complete, but they are certainly functional as posted.
First things first.Â I am only listing 5 specific protocols to match here.Â You can find more of them at the Layer 7 project page.Â If you look at the examples on that page and compare them with the regexp values here, you can see easily how to add more of these into your router.Â You can also get some from Mikrotik’s wiki, though it’s been a while since I’ve seen this updated.
Now, on with the tutorial.Â The text below is a simple script that creates 4 new layer 7 filters.Â What you are adding here is a list of filters that will allow you to use a “match” parameter in the “/ip firewall filter add” portion of your router configuration.Â In other words, Mikrotik will, by default, allow you to match on things like “src-address” and “dst-address”.Â Â More on the match option below.
/ip firewall layer7-protocol add name="YahooIM" regexp="^(ymsg|ypns|yhoo).\?.\?.\?.\?.\?.\?.\?[lwt].*\C0\80" comment="Yahoo Instant Messenger" add name="MSNMESSENGER" regexp="ver [0-9]+ msnp[1-9][0-9]\? [\09-\0D -~]*cvr0\0D\0A\$|usr 1 [!-~]+ [0-9. ]+\0D\0A\$|ans 1 [!-~]+ [0-9. ]+\0D\0A\$" comment="MSN Messenger" add name="AIM" regexp="^(\\*[\01\02].*\03\0B|\\*\01.\?.\?.\?.\?\01)|flapon|toc_signon.*0x" comment="AIM" add name="IRC" regexp="^(nick[\09-\0D -~]*user[\09-\0D -~]*:|user[\09-\0D -~]*:[\02-\0D -~]*nick[\09-\0D -~]*\0D\0A)" comment="IRC Chat"
Now that we have added the protocol matchers, we can use them as a matcher in the firewall as follows:
/ip firewall filter add chain=forward layer7-protocol="YahooIM" action=drop add chain=forward layer7-protocol="MSNMESSENGER" action=drop add chain=forward layer7-protocol="AIM" action=drop add chain=forward layer7-protocol="IRC" action=drop
I hope this article has been helpful to you.Â If it has, then please “DIGGÂ it”!