Cara Blokir Website & File Extention Dengan Web Proxy Pada Mikrotik

Sebagai pengguna teknologi informasi, tidak asing bagi kita dengan istilah “proxy”. Secara umum arti dari proxy adalah sebuah komputer server atau program komputer yang dapat bertindak sebagai komputer lainnya untuk melakukan request terhadap content dari Internet atau intranet. Dengan kata lain proxy merupakan sebuah media keamanan bagi akses jaringan internet kita.

Terdapat beberapa macam tipe proxy, diantaranya SSL Proxy, Web Proxy, Intercepting Proxy, Reverse Proxy, dll. Setiap tipe proxy memiliki fungsi masing-masing. Nah, kali ini kita akan membahas salah satu proxy yang merupakan fitur dari RouterOS MikroTik, yaitu Web Proxy.

Dalam pembahasan ini kita akan menekankan bagaimana cara melakukan pemblokiran website menggunakan “Web Proxy Access”. Contoh kasus, kita akan memblokir akses internet dari client ke www.playboy.com

Aktifkan web-proxy

Pertama, aktifkan terlebih dulu service dari web-proxy pada MikroTik dengan pengaturan pad menu IP -> Web Proxy.

Centang pilihan Enable, dan tentukan pada port berapa proxy bekerja. By default web-proxy akan bekerja pada port 8080.

Sampai langkah ini, web-proxy pada Router Mikrotik sudah aktif sebagai Regular HTTP Proxy. Dengan kata lain jika PC Client ingin menggunakan service proxy ini, maka harus disetting secara manual pada web browser masing-masing client dengan menunjuk ip-mikrotik port 8080.

Agar tidak perlu setting web-browser client satu per satu, ubah web-proxy Mikrotik agar berfungsi sebagai Transparent Proxy. Implementasinya, gunakan fitur NAT untuk membelokan semua traffic browsing HTTP (tcp 80) yang berasal dari client ke fitur internal web-proxy yang sudah diaktifkan sebelumnya.

Untuk membuatnya masuk pada menu IP->Firewall->NAT->Klik “+”.

Selanjutnya, karena semua traffic HTTP dari client sudah masuk ke web-proxy, maka bisa dilakukan manajemen. Salah satunya adalah melakukan blocking akses client ke website tertentu.

Block Website

Untuk melakukan block akses client ke website tertentu dapat dilakukan pada menu Webproxy -> Access

Tambahkan rule web-proxy access baru. Dalam contoh ini, client tidak diperbolehkan akses ke www.playboy.com

Definisikan website yang akan diblock pada parameter dst-host dengan action=deny.

Jika  diperhatikan, penulisan dst-host tidak menggunakan alamat website lengkap akan tetapi menggunakan tanda bintang (*) di depan dan belakang nama/alamat website. Tanda * dimaksudkan sebagai wildcard untuk menggantikan semua karakter. Dengan ditambahkan wildcard, traffic client yang menuju ke website yang URL-nya terdapat kata "playboy" akan diblock.

Coba browsing ke alamat www.playboy.com , maka secara otomatis Web-Proxy MikroTik akan melakukan pemblokiran terhadap website tersebut dan menampilkan pesan error pada browser client.

Block & Redirect Website

Kita juga bisa memodifikasi rule-nya dengan me-redirect ke situs lain. Misalnya ketika ada Client yang mengakses www.playboy.com maka akan langsung dialihkan (redirect) ke www.mikrotik.co.id

Block File extention

Selain bisa melakukan blocking berdasarkan nama domain/URL , web-proxy Mikrotik juga dapat melakukan pemblokiran berdasarkan extention file yang ada pada sebuah halaman web.

Kemampuan ini dapat dimanfaatkan untuk melakukan blocking traffic client yang akan melakukan download untuk extention file tertentu, misal .iso, .exe, .zip, dsb.

Jika blocking URL didefinisikan pada parameter dst-host, pemblokiran file extention dapat didefinisikan pada parameter Path dengan action=deny. Gunakan wildcard (*) untuk menggantikan semua karakter di depan dan belakang file extention.

Sama halnya dengan Firewall Filter, NAT, Simple Queue, dsb, rule web-proxy access akan dibaca secara berurutan mulai dari rule no. 0.

Penyimpanan Cache Proxy

Disamping fungsi filtering, web-proxy juga dapat digunakan untuk penyimpanan object cache. Content pada sebuah website akan disimpan dan diberikan kembali ke client jika ada yang melakukan akses pada object/content yang sama, sehingga tidak perlu langsung mengambil dari internet dan menggunakan bandwidth.

Definisikan kapasitas storage yang digunakan untuk penyimpanan cache pada parameter Max-Cache-Size. Centang opsi Cache-On-Disk agar cache disimpan pada storage Router.

Konsep penyimpanan cache akan lebih baik diterapkan jika Router mempunyai storage tambahan, sehingga cache tidak disimpan pada system disk. 

Sumber: http://mikrotik.co.id/artikel_lihat.php?id=123 dengan beberapa perbaikan.

How to make ping icmp high Priority on Mikrotik Routher

Mikrotik Queuing is heuristic , means every packet leaving mikrotik destined to your IP is capped, even ICMP too.
So when you do browsing or downloading any data , there will be less or no bandwidth available for PING/ ICMP packets and ping form client to mikrotik OR to internet will face frequent timeout and high latency in case of full usage of allowed bandwidth.
As showed in the image below …

NOTE:
It is recommended to block the ICMP/PING protocol on every network to avoid flooding and un wanted queries from the client end. (You can exempt your admin pc or other from this restriction via source address list)

Or if you still want to allow icmp , then simply mark icmp packets and and create a queue that allows more bandwidth to icmp marked packets.

---

1- EXAMPLE OF PING/ICMP QUEUE USING SIMPLE QUEUE [overall capping]

/ip firewall mangle add chain=prerouting protocol=icmp action=mark-connection new-connection-mark=icmp-con passthrough=yes comment="" disabled=no add chain=prerouting protocol=icmp connection-mark=icmp-con action=mark-packet new-packet-mark=icmp-pkt passthrough=no comment="" disabled=no /queue simple add max-limit=128k/128k name=ICMP_Priority packet-marks=icmp-pkt target=""

---

Result after implementing above code.

---

2- SECOND EXAMPLE OF PING/ICMP QUEUE USING PCQ TREE | (FOR PER USER DISTRIBUTION)

The following script will mark icmp packets and will allow 32k per user for icmp traffic via PCQ / QUEUE TREE

1 2 3 4 5 6 7 8 9 10 11 12

/ip firewall mangle add action=mark-packet chain=prerouting comment="Mark ICMP I" new-packet-mark=ping_pkts_i protocol=icmp add action=mark-packet chain=postrouting comment="Mark ICMP O" new-packet-mark=ping_pkts_o protocol=icmp   /queue type add kind=pcq name="ping_pkts_i_32K" pcq-classifier=dst-address pcq-dst-address6-mask=64 pcq-rate=32k pcq-src-address6-mask=64 add kind=pcq name="ping_pkts_o_32K" pcq-classifier=src-address pcq-dst-address6-mask=64 pcq-rate=32k pcq-src-address6-mask=64     /queue tree add name=ping_pkts_i packet-mark=ping_pkts_i parent=global-out queue="ping_pkts_i_32K" add name=ping_pkts_o packet-mark=ping_pkts_o parent=global-out queue="ping_pkts_o_32K"

---

TIP: You can also use PRIORITY base queuing to give priority to ICMP packets from user own queue over other protocols.

Full Bandwidth Management Parent Queue Tree Mikrotik

Full Bandwidth Management Parent Queue Tree

This is the combination, continued and completion of bandwidth management methods previously using parent queue tree about to handle all sorts of purposes in an internet network that is more complex. Perhaps if you do not want to think too hard, you simply apply the simple queue to limit bandwidth that so powerful and assertive to limit bandwidth per client on your internet network. The problem is if we share the bandwidth with a simple queue is stiffness, and it's hard for me to divide into many clients normally. It would be appropriate to be applied to the kind of dedicate internet connection.


For example If I have a totally the bandwidth internet connection is up to 2M, after i have tested by speed test, the bandwidth average is 512 kbps. It means that if I have 6 clients, be 512/6 = 86 kbps/clients normally, the ideal number is very small inappropriate for our client. If the bandwidth of up to 2 M calculated with 2000/6 to be around 334 kbps /clients, it can makes browsing and online game stuck if just only one client there who download and play streaming video, because the client spend almost all the average speed (512kbps) other clients will be especially problematic just for browsing or online game. In this case we need the priority to the fourth packets.

Full Bandwidth Management with the parent queue tree complete the lack of packets connection per client, especially to handle the internet network with many clients. The principle is equally divide the bandwidth to all the clients with bandwidth greater than that should be given as the limit bandwidth on each clients, in which we set Online Games, Browsing, Download, Video Streaming packets, connection packets. Well, for now I will make the Full BandwidthManagement using the parent queue tree. For more easily to make the complex rule, I will work with the scripts for more quickly.

Situation and Conditions:

Total Bandwidth = Up to 2 M

8 Clients that I have :

Billing : 192.168.1.11
Client1    : 192.168.1.17
Client2    : 192.168.1.16
Client3    : 192.168.1.15
Client4    : 192.168.1.14
Client5    : 192.168.1.20
Client6    : 192.168.1.21
Master    : 192.168.1.8 

In-Interface = ether1
Out-Interface = wlan1

/ip firewall address-list
add address=192.168.1.0/24  disabled=no list=MikroTik comment=""

1.      Marking all the connection out and in of the interface Mikrotik router, and create the connection

The connection that we will use is All-Outconn as the above scripts with the connection chain=forwardout-interface=wlan1, which we subsequently differentiate into different connections to produce different connection packets.

2. Take the connections of All-Outconn then divide it into the connections to every client, and make connection packets every client that will captured by the queue tree per client.
Here are the following scripts :

/ip firewall mangle

addaction=mark-connectionchain=forwardcomment="Billing"disabled=nodst-address=192.168.1.11 new-connection-mark=Billing-conn passthrough=yes connection-mark=All-Outconn

addaction=mark-connectionchain=forwardcomment="Client1"disabled=nodst-address=192.168.1.17 new-connection-mark=Client1-conn passthrough=yes connection-mark=All-Outconn

addaction=mark-connectionchain=forwardcomment="Client2"disabled=nodst-address=192.168.1.16 new-connection-mark=Client2-conn passthrough=yes connection-mark=All-Outconn

addaction=mark-connectionchain=forwardcomment="Client3"disabled=nodst-address=192.168.1.15 new-connection-mark=Client3-conn passthrough=yes connection-mark=All-Outconn

addaction=mark-connectionchain=forwardcomment="Client4"disabled=nodst-address=192.168.1.14 new-connection-mark=Client4-conn passthrough=yes connection-mark=All-Outconn

addaction=mark-connectionchain=forwardcomment="Client5"disabled=nodst-address=192.168.1.20 new-connection-mark=Client5-conn passthrough=yes connection-mark=All-Outconn

addaction=mark-connectionchain=forwardcomment="Client6"disabled=nodst-address=192.168.1.21 new-connection-mark=Client6-conn passthrough=yes connection-mark=All-Outconn

addaction=mark-connectionchain=forwardcomment="Master"disabled=nodst-address=192.168.1.8 new-connection-mark=Master-conn passthrough=yes connection-mark=All-Outconn

/ip firewall mangle

addaction=mark-packet chain=forwardnew-packet-mark=Billing-pktpassthrough=yes connection-mark=Billing-conn comment="BILLING DOWNSTEAM"

addaction=mark-packet chain=forwardnew-packet-mark=Client1-pkt passthrough=yes connection-mark=Client1-conn comment="CLIENT1 DOWNSTEAM"

addaction=mark-packet chain=forwardnew-packet-mark=Client2-pkt passthrough=yes connection-mark=Client2-conn comment="CLIENT2 DOWNSTEAM"

addaction=mark-packet chain=forwardnew-packet-mark=Client3-pkt passthrough=yes connection-mark=Client3-conn comment="CLIENT3 DOWNSTEAM"

addaction=mark-packet chain=forwardnew-packet-mark=Client4-pkt passthrough=yes connection-mark=Client4-conn comment="CLIENT4 DOWNSTEAM"

addaction=mark-packet chain=forwardnew-packet-mark=Client5-pkt passthrough=yes connection-mark=Client5-conn comment="CLIENT5 DOWNSTEAM"

addaction=mark-packet chain=forwardnew-packet-mark=Client6-pkt passthrough=yes connection-mark=Client6-conn comment="CLIENT6 DOWNSTEAM"

addaction=mark-packet chain=forwardnew-packet-mark=Master-pktpassthrough=yes connection-mark=Master-conn comment="MASTER DOWNSTEAM"

/queue tree

addname=Billing parent=All-Bandwidth packet-mark=Billing-pkt queue=defaultpriority=8 limit-at=256k max-limit=256k burst-limit=720k burst-threshold=192k burst-time=2s

addname=Client1 parent=All-Bandwidth packet-mark=Client1-pkt queue=defaultpriority=8 limit-at=256k max-limit=256k burst-limit=720k burst-threshold=192k burst-time=2s

addname=Client2 parent=All-Bandwidth packet-mark=Client2-pkt queue=defaultpriority=8 limit-at=256k max-limit=256k burst-limit=720k burst-threshold=192k burst-time=2s

addname=Client3 parent=All-Bandwidth packet-mark=Client3-pkt queue=defaultpriority=8 limit-at=256k max-limit=256k burst-limit=720k burst-threshold=192k burst-time=2s

addname=Client4 parent=All-Bandwidth packet-mark=Client4-pkt queue=defaultpriority=8 limit-at=256k max-limit=256k burst-limit=720k burst-threshold=192k burst-time=2s

addname=Client5 parent=All-Bandwidth packet-mark=Client5-pkt queue=defaultpriority=8 limit-at=256k max-limit=256k burst-limit=720k burst-threshold=192k burst-time=2s

addname=Client6 parent=All-Bandwidth packet-mark=Client6-pkt queue=defaultpriority=8 limit-at=256k max-limit=256k burst-limit=720k burst-threshold=192k burst-time=2s

addname=Master parent=All-Bandwidth packet-mark=Master-pkt queue=defaultpriority=8 limit-at=256k max-limit=256k burst-limit=720k burst-threshold=192k burst-time=2s

The scripts above consists with mangle and queue tree rule. From here we are already making the connections per ip address of clients, such as

• Connections Per Client : Billing-conn, Client1-conn, Client2-conn, Client3-conn, Client4-conn, Client5-conn, Client6-conn, Master-conn
• Connection Packets Per Client : Billing-pkt, Client1-pkt, Client1-pkt, Client2-pkt, Client3-pkt, Client4-pkt, Client5-pkt, Client6-pkt, Master-pkt

3. The Connections per client that we have divided will separated into four packets connection such as browsing, online games, download, streaming video per client. Here are the forth part of four different packets connection. If there are any packets that have not been defined I asked for suggestions from those of you that had experience.

Part I : Making the packets per client for download and the queue tree with priority as you wish, here the following scripts:

/ip firewall layer7-protocol

addcomment=""name=download regexp="^.*get.+\\.(exe|rar|iso|zip|7zip|flv|mkv|avi|mp4|3gp|rmvb|mp3|img|dat|mov).*\$"

/ip firewall mangle

addchain=forwardlayer7-protocol=download action=mark-packet new-packet-mark=billing-dpktpassthrough=nopacket-mark=Billing-pkt comment=Billing-Down

addchain=forwardlayer7-protocol=download action=mark-packet new-packet-mark=client1-dpkt passthrough=nopacket-mark=Client1-pkt comment=Client1-Down

addchain=forwardlayer7-protocol=download action=mark-packet new-packet-mark=client2-dpkt passthrough=nopacket-mark=Client2-pkt comment=Client2-Down

addchain=forwardlayer7-protocol=download action=mark-packet new-packet-mark=client3-dpkt passthrough=nopacket-mark=Client3-pkt comment=Client3-Down

addchain=forwardlayer7-protocol=download action=mark-packet new-packet-mark=client4-dpkt passthrough=nopacket-mark=Client4-pkt comment=Client4-Down

addchain=forwardlayer7-protocol=download action=mark-packet new-packet-mark=client5-dpkt passthrough=nopacket-mark=Client5-pkt comment=Client5-Down

addchain=forwardlayer7-protocol=download action=mark-packet new-packet-mark=client6-dpkt passthrough=nopacket-mark=Client6-pkt comment=Client6-Down

addchain=forwardlayer7-protocol=download action=mark-packet new-packet-mark=master-dpktpassthrough=nopacket-mark=Master-pkt comment=Master-Down

  

/queue tree

addname=Billing-Down parent=Billing packet-mark=billing-dpkt queue=defaultpriority=6 limit-at=180k max-limit=180k burst-limit=256k burst-threshold=135k burst-time=2s

addname=Client1-Down parent=Client1 packet-mark=client1-dpkt queue=defaultpriority=6 limit-at=180k max-limit=180k burst-limit=256k burst-threshold=135k burst-time=2s

addname=Client2-Down parent=Client2 packet-mark=client2-dpkt queue=defaultpriority=6 limit-at=180k max-limit=180k burst-limit=256k burst-threshold=135k burst-time=2s

addname=Client3-Down parent=Client3 packet-mark=client3-dpkt queue=defaultpriority=6 limit-at=180k max-limit=180k burst-limit=256k burst-threshold=135k burst-time=2s

addname=Client4-Down parent=Client4 packet-mark=client4-dpkt queue=defaultpriority=6 limit-at=180k max-limit=180k burst-limit=256k burst-threshold=135k burst-time=2s

addname=Client5-Down parent=Client5 packet-mark=client5-dpkt queue=defaultpriority=6 limit-at=180k max-limit=180k burst-limit=256k burst-threshold=135k burst-time=2s

addname=Client6-Down parent=Client6 packet-mark=client6-dpkt queue=defaultpriority=6 limit-at=180k max-limit=180k burst-limit=256k burst-threshold=135k burst-time=2s

addname=Master-Down parent=Master packet-mark=master-dpkt queue=defaultpriority=6 limit-at=180k max-limit=180k burst-limit=256k burst-threshold=135k burst-time=2s

Here we take and use the connections per client and differentiate into connection packets of downloaded by the extension files, so if there are any the extension files that you think is important, just add the the extension files that you want to the layer 7 protocols from the above scripts.

Part II. Making the video packet connection per client complete with the queue tree and priority as you please. Here the following scripts

add comment="" name=streaming regexp="^.*get.+\\.(c.youtube.com|cdn.dailymotion.com|metacafe.com|mccont.com).*\$"

If the above script doesn't works, try the second regexp on the script below!

/ip firewall layer7-protocol

add comment="" name=streaming regexp="videoplayback|video"

/ip firewall mangle

addcomment=Billing-Streams chain=forwardlayer7-protocol=streaming action=mark-packet new-packet-mark=billing-spktpassthrough=nopacket-mark=Billing-pkt

addcomment=Client1-Streams chain=forwardlayer7-protocol=streaming action=mark-packet new-packet-mark=client1-spkt passthrough=nopacket-mark=Client1-pkt

addcomment=Client2-Streams chain=forwardlayer7-protocol=streaming action=mark-packet new-packet-mark=client2-spkt passthrough=nopacket-mark=Client2-pkt

addcomment=Client3-Streams chain=forwardlayer7-protocol=streaming action=mark-packet new-packet-mark=client3-spkt passthrough=nopacket-mark=Client3-pkt

addcomment=Client4-Streams chain=forwardlayer7-protocol=streaming action=mark-packet new-packet-mark=client4-spkt passthrough=nopacket-mark=Client4-pkt

addcomment=Client5-Streams chain=forwardlayer7-protocol=streaming action=mark-packet new-packet-mark=client5-spkt passthrough=nopacket-mark=Client5-pkt

addcomment=Client6-Streams chain=forwardlayer7-protocol=streaming action=mark-packet new-packet-mark=client6-spkt passthrough=nopacket-mark=Client6-pkt

addcomment=Master-Streams chain=forwardlayer7-protocol=streaming action=mark-packet new-packet-mark=master-spktpassthrough=nopacket-mark=Master-pkt

  

/queue tree

addname=Billing-Streams parent=Billing packet-mark=billing-spkt queue=defaultpriority=8 limit-at=220k max-limit=220k burst-limit=256k burst-threshold=165k burst-time=2s

addname=Client1-Streams parent=Client1 packet-mark=client1-spkt queue=defaultpriority=8 limit-at=220k max-limit=220k burst-limit=256k burst-threshold=165k burst-time=2s

addname=Client2-Streams parent=Client2 packet-mark=client2-spkt queue=defaultpriority=8 limit-at=220k max-limit=220k burst-limit=256k burst-threshold=165k burst-time=2s

addname=Client3-Streams parent=Client3 packet-mark=client3-spkt queue=defaultpriority=8 limit-at=220k max-limit=220k burst-limit=256k burst-threshold=165k burst-time=2s

addname=Client4-Streams parent=Client4 packet-mark=client4-spkt queue=defaultpriority=8 limit-at=220k max-limit=220k burst-limit=256k burst-threshold=165k burst-time=2s

addname=Client5-Streams parent=Client5 packet-mark=client5-spkt queue=defaultpriority=8 limit-at=220k max-limit=220k burst-limit=256k burst-threshold=165k burst-time=2s

addname=Client6-Streams parent=Client6 packet-mark=client6-spkt queue=defaultpriority=8 limit-at=220k max-limit=220k burst-limit=256k burst-threshold=165k burst-time=2s

addname=Master-Streams parent=Master packet-mark=master-spkt queue=defaultpriority=8 limit-at=220k max-limit=220k burst-limit=256k burst-threshold=165k burst-time=2s

This is the similar method in making the connection packets like download packets is by using a layer 7 protocols, the content of streaming video other sites that have not been defined, please you add on the layer 7 protocols if you think that is important, and adjust the priority and limit speed on the queue tree as you please.

c. Membuat packets Online game per client lengkapdengan queue treenya, berikutiniadalahscriptsnya :

Part III : Making the Online games packet connection per client complete with the queue tree and priority, here the following scripts:

/ip firewall mangle

addaction=mark-packet chain=forwardpacket-mark=All-Outpkt new-packet-mark=gpktpassthrough=yes protocol=tcpdst-port=5340-5352,6000-6152,10001-10011,14009-14030,18901-18909 comment="Online Game Portal"

addaction=mark-packet chain=forwardpacket-mark=All-Outpkt new-packet-mark=gpktpassthrough=yes protocol=tcp dst-port=39190,27780,29000,22100,10009,4300,15001,15002,7341,7451

addaction=mark-packet chain=forwardpacket-mark=All-Outpkt new-packet-mark=gpktpassthrough=yes protocol=tcpdst-port=40000,9300,9400,9700,7342,8005-8010,37466,36567,8822

addaction=mark-packet chain=forwardpacket-mark=All-Outpkt new-packet-mark=gpktpassthrough=yes protocol=tcpdst-port=47611,16666,20000,5105,29000,18901-18909,9015

addaction=mark-packet chain=forwardpacket-mark=All-Outpkt new-packet-mark=gpktpassthrough=yes protocol=udpdst-port=27005,27015

addaction=mark-packet chain=forwardpacket-mark=All-Outpkt new-packet-mark=gpktpassthrough=yes protocol=udpdst-port=27005-27020,13055,7800-7900,12060-12070

addaction=mark-packet chain=forwardpacket-mark=All-Outpkt new-packet-mark=gpktpassthrough=yes protocol=udpdst-port=8005-8010,9068,1293,1479,9401,9600,30000

addaction=mark-packet chain=forwardpacket-mark=All-Outpkt new-packet-mark=gpktpassthrough=yes protocol=udpdst-port=14009-14030,42051-42052,40000-40050,13000-13080

/ip firewall mangle

addaction=mark-packet chain=forwardnew-packet-mark=billing-gpktpassthrough=nodst-address=192.168.1.11 packet-mark=gpkt comment=Billing-Game

addaction=mark-packet chain=forwardnew-packet-mark=client1-gpkt passthrough=nodst-address=192.168.1.17 packet-mark=gpkt comment=Client1-Game

addaction=mark-packet chain=forwardnew-packet-mark=client2-gpkt passthrough=nodst-address=192.168.1.16 packet-mark=gpkt comment=Client2-Game

addaction=mark-packet chain=forwardnew-packet-mark=client3-gpkt passthrough=nodst-address=192.168.1.15 packet-mark=gpkt comment=Client3-Game

addaction=mark-packet chain=forwardnew-packet-mark=client4-gpkt passthrough=nodst-address=192.168.1.14 packet-mark=gpkt comment=Client4-Game

addaction=mark-packet chain=forwardnew-packet-mark=client5-gpkt passthrough=nodst-address=192.168.1.20 packet-mark=gpkt comment=Client5-Game

addaction=mark-packet chain=forwardnew-packet-mark=client6-gpkt passthrough=nodst-address=192.168.1.21 packet-mark=gpkt comment=Client6-Game

addaction=mark-packet chain=forwardnew-packet-mark=master-gpktpassthrough=nodst-address=192.168.1.8 packet-mark=gpkt comment=Master-Game

/queue tree

addname=Billing-Game parent=Billing packet-mark=billing-gpkt queue=defaultpriority=1 limit-at=220k max-limit=220k burst-limit=256k burst-threshold=165k burst-time=2s

addname=Client1-Game parent=Client1 packet-mark=client1-gpkt queue=defaultpriority=1 limit-at=220k max-limit=220k burst-limit=256k burst-threshold=165k burst-time=2s

addname=Client2-Game parent=Client2 packet-mark=client2-gpkt queue=defaultpriority=1 limit-at=220k max-limit=220k burst-limit=256k burst-threshold=165k burst-time=2s

addname=Client3-Game parent=Client3 packet-mark=client3-gpkt queue=defaultpriority=1 limit-at=220k max-limit=220k burst-limit=256k burst-threshold=165k burst-time=2s

addname=Client4-Game parent=Client4 packet-mark=client4-gpkt queue=defaultpriority=1 limit-at=220k max-limit=220k burst-limit=256k burst-threshold=165k burst-time=2s

addname=Client5-Game parent=Client5 packet-mark=client5-gpkt queue=defaultpriority=1 limit-at=220k max-limit=220k burst-limit=256k burst-threshold=165k burst-time=2s

addname=Client6-Game parent=Client6 packet-mark=client6-gpkt queue=defaultpriority=1 limit-at=220k max-limit=220k burst-limit=256k burst-threshold=165k burst-time=2s

addname=Master-Game parent=Master packet-mark=master-gpkt queue=defaultpriority=1 limit-at=220k max-limit=220k burst-limit=256k burst-threshold=165k burst-time=2s

In this case we make the online-games connection at first, based on out-interface=wlan1 and tcp and udp of many ports that used by the online games. Then make the online games connection packets per ip address client from that, finally we capture the packets online games on queue tree and the priority as you wish.

Part IV. Make browsing connection packets per client complete with tree queue and give the priority, here the following script :

/ip firewall mangle

addaction=mark-packet chain=forwardconnection-bytes=0-1000000 src-port=80,443 passthrough=nopacket-mark=Billing-pkt new-packet-mark=billing-bpkt protocol=tcp comment="BILLING BROWSING"

addaction=mark-packet chain=forwardconnection-bytes=0-1000000 src-port=80,443 passthrough=nopacket-mark=Client1-pkt new-packet-mark=client1-bpkt protocol=tcp comment="CLIENT1 BROWSING"

addaction=mark-packet chain=forwardconnection-bytes=0-1000000 src-port=80,443 passthrough=nopacket-mark=Client2-pkt new-packet-mark=client2-bpkt protocol=tcp comment="CLIENT2 BROWSING"

addaction=mark-packet chain=forwardconnection-bytes=0-1000000 src-port=80,443 passthrough=nopacket-mark=Client3-pkt new-packet-mark=client3-bpkt protocol=tcp comment="CLIENT3 BROWSING"

addaction=mark-packet chain=forwardconnection-bytes=0-1000000 src-port=80,443 passthrough=nopacket-mark=Client4-pkt new-packet-mark=client4-bpkt protocol=tcp comment="CLIENT4 BROWSING"

addaction=mark-packet chain=forwardconnection-bytes=0-1000000 src-port=80,443 passthrough=nopacket-mark=Client5-pkt new-packet-mark=client5-bpkt protocol=tcp comment="CLIENT5 BROWSING"

addaction=mark-packet chain=forwardconnection-bytes=0-1000000 src-port=80,443 passthrough=nopacket-mark=Client6-pkt new-packet-mark=client6-bpkt protocol=tcp comment="CLIENT6 BROWSING"

addaction=mark-packet chain=forwardconnection-bytes=0-1000000 src-port=80,443 passthrough=nopacket-mark=Master-pkt new-packet-mark=master-bpkt protocol=tcp comment="MASTER BROWSING"

/queue tree

addname="Billing-Browsing"parent=Billing packet-mark=billing-bpkt queue=defaultpriority=2 limit-at=256k max-limit=256k burst-limit=720k burst-threshold=192k burst-time=2s

addname="Client1-Browsing"parent=Client1 packet-mark=client1-bpkt queue=defaultpriority=2 limit-at=256k max-limit=256k burst-limit=720k burst-threshold=192k burst-time=2s

addname="Client2-Browsing"parent=Client2 packet-mark=client2-bpkt queue=defaultpriority=2 limit-at=256k max-limit=256k burst-limit=720k burst-threshold=192k burst-time=2s

addname="Client3-Browsing"parent=Client3 packet-mark=client3-bpkt queue=defaultpriority=2 limit-at=256k max-limit=256k burst-limit=720k burst-threshold=192k burst-time=2s

addname="Client4-Browsing"parent=Client4 packet-mark=client4-bpkt queue=defaultpriority=2 limit-at=256k max-limit=256k burst-limit=720k burst-threshold=192k burst-time=2s

addname="Client5-Browsing"parent=Client5 packet-mark=client5-bpkt queue=defaultpriority=2 limit-at=256k max-limit=256k burst-limit=720k burst-threshold=192k burst-time=2s

addname="Client6-Browsing"parent=Client6 packet-mark=client6-bpkt queue=defaultpriority=2 limit-at=256k max-limit=256k burst-limit=720k burst-threshold=192k burst-time=2s

addname="Master-Browsing"parent=Master packet-mark=master-bpkt queue=defaultpriority=2 limit-at=256k max-limit=256k burst-limit=720k burst-threshold=192k burst-time=2s

Take and use the connection per client then we make the new browsing connection by capturing based on port 80 and 443 (HTTP and HTTPS ports) and adding small bytes connection-bytes=0-1000000, port that commonly used in browsing the url site, small bytes of data may also be included here from the other three connection packets else, but small enough

 

How to limit video streaming,youtube and idm connection with mikrotik

Cara limit streaming,youtube dan koneksi idm di mikrotik langsung copas script ini di new terminal mikrotik.

 untuk layer 7
 

/ip firewall layer7-protocol
add name="Limit IDM" regexp="get /.*(user-agent: mozilla/4.0|range: bytes=)"
add name=http-video regexp="http/(0.9|1.0|1.1)[x09-x0d ][1-5][0-9][0-9][x09-x0\
    d -~]*(content-type: video)"
add name=VIDEO regexp=video
add name=AUDIO regexp=audio
add name=donlotan regexp="^.*get.+\\.(exe|rar|zip|7z|cab|asf|mov|wmv|mpg|mpeg|\
    mkv|avi|flv|pdf|wav|rm|mp3|mp4|ram|rmvb|dat|daa|iso|nrg|bin|vcd|mp2|3gp|mp\
    e|qt|raw|wma|ogg|doc|deb|tar|bzip|gzip|gzip2|0[0-9][0-9]).*\$"

untuk mangle nya

/ip firewall mangle
add action=mark-packet chain=prerouting connection-mark=video \
    new-packet-mark=video passthrough=no
add action=mark-connection chain=prerouting layer7-protocol=AUDIO \
    new-connection-mark=yutup
add action=mark-connection chain=prerouting layer7-protocol=VIDEO \
    new-connection-mark=yutup
add action=mark-packet chain=forward connection-mark=yutup new-packet-mark=\
    youtube passthrough=no
add action=mark-packet chain=forward comment=STREAMING connection-mark=\
    STREAMING new-packet-mark=STREAMING passthrough=no
 add action=mark-packet chain=forward comment=Donlotan layer7-protocol=\
    donlotan new-packet-mark=paket-donlot passthrough=no protocol=tcp

filter untuk idm

/ip firewall filter
add action=drop chain=forward connection-limit=2,32 layer7-protocol=\
     "Limit IDM" protocol=tcp

membuat queue type

 /queue type
add kind=pcq name=GRATIS pcq-classifier=dst-address pcq-rate=256k

 membatasi streaming dan youtube

/queue tree
add comment=YUOTUBE max-limit=512k name=YOUTUBE packet-mark=youtube parent=\
    global priority=5 queue=default
add max-limit=128k name=STREAMING packet-mark=STREAMING parent=global queue=\
    default
add max-limit=256k name=" Limit Download" packet-mark=paket-donlot parent=\
    global queue=GRATIS 

5 Interesting Ways To Use Google News RSS Feeds

We all love neat RSS hacks, right? Well, here’s some interesting ways to use Google RSS news feeds. Many of us MakeUseOf readers are keen readers of Google News because it’s an easy way to see news articles from newspapers worldwide, grouped by topic and also grouped with similar headlines. However, not everyone realises that Google News offers a wide selection of RSS feeds, which you can manage using search terms and other useful modifiers.

By learning more about these RSS feeds and incorporating a few interesting tricks to display and read these RSS news feeds, you’ll be able to stay on top of all the very best news as easily as possible. How’s that for useful?

Creating RSS News Feeds

Creating generic and specific news RSS feeds is quite an easy task.

1. Find Your Preferred Google News RSS Feed

You’ve probably already set up Google News to show local news in your preferred language. At the bottom of the news page, you’ll see an RSS link. This link will give you a basic RSS feed for Google News, incorporating your chosen local news and language. Subscribe to this if you are happy to have lots of new updates.
For me, I get: http://news.google.com/news?pz=1&cf=all&ned=uk&hl=en&output=rss

2. Find RSS Feeds For Google News Topics

Also at the bottom of the Google news page is a link to “About Feeds“, which shows you the various news topics and the RSS feeds to subscribe to them.
For instance, Sci-Tech is: http://news.google.com/news?ned=us&topic=t&output=rss

3. Create A Google News Search RSS Feed

At the top of Google News is the all-familiar search bar. Plug in your search term there (using normal Google search formatting) and you’ll be presented with news on that subject. At the bottom of the page, you can see the RSS link where you can copy the RSS URL or subscribe to your feed.
For example, a basic news search for “Lemur”: http://news.google.com/news?q=lemurs&output=rss
A News search for “Lemur” with my preferred settings: http://news.google.com/news?pz=1&cf=all&ned=uk&hl=en&q=lemur&cf=all&output=rss

4. Change Your RSS Feeds

In the previous examples, you can see topic=t is tech, while q=lemur is your search term. You can change ned=us to ned=uk if you prefer results from the UK, plus you can add hl=en if you want the results only in English. Since my Google News was already set up with my preferred settings, the search added those settings into the feed for me.
Either edit the RSS feed link manually or use Google’s advanced search features to add more search parameters to your news search.

For instance, limiting the search to the last month gives us: http://news.google.com/news?pz=1&cf=all&ned=uk&hl=en&as_scoring=r&as_maxm=2&q=lemur&as_qdr=m&as_drrb=q
&as_mind=29&as_minm=1&cf=all&as_maxd=28&output=rss
If you want to fine-tune your feed even further, consider using something like Yahoo Pipes.

What To Do With News RSS Feeds?

There’s plenty of great ideas for using these feeds once you know these tricks. Maybe these scenarios will help you think of something you can use.

• You’re an Apple fanatic and you’d like to show news about Apple products and Steve Jobs in your blog’s sidebar.
• You’re a student and you’d like to see headlines about the new developments in medicine whenever possible.
• You’re a tech professional and you want to ensure you don’t miss any tech news headlines.
• You’re a lemur specialist and you’d like lemur headlines to feature near the top whenever you visit Google News.
• You’re currently very interested in Middle-Eastern politics and want to be informed of all of the updates by email.

Displaying & Reading Google News RSS Feeds

Now that you know how to create all these great news feeds and know what you want to keep track of, there’s some tricks you might like to know about displaying and reading the RSS feeds.

1. Add A Search Term As A Google News Element

After you search in Google News, there is an option at the bottom of the page to “Create Your Own Custom Section For SEARCHTERM“. Click that and it will add your search to your everyday Google News layout.

If you want to rearrange your page, click on “Edit Page” and decide where you’d like your search term to feature.

2. Create Google Alerts

If it’s important that you don’t miss the news updates, try creating a Google Alert for your search. At the bottom of the news search page, click on “Create An Email Alert For SEARCHTERM“. Choose how frequently you want the alert to be sent and whether you want that sent to an email or as an RSS feed.

3. NewsShow For Your Website

Google will allow you to show Google News on your website, as long as you adhere to strict rules. The easiest way to ensure you are sticking to the rules is to use Google NewsShow to create the widget. You can customise it if you like, by using the [NO LONGER WORKS] Google NewsShow wizard.

4. Add News Feeds To Google Reader

If you get your RSS feeds into Google Reader, you can use all sorts of tools to read them, including magazine-style extensions such as Feedly.

5. Read Your News Feeds In Netvibes (Or Another Start Page)

The beauty of Netvibes is that you can create pages dedicated to certain topics, so if you’re studying a given topic you can add your news feeds specific to that topic and ensure you keep up-to-date while you’re studying.