Blocking social networks on Mikrotik for the entire subnet, except for some users?

Question

Mikrotik

In general, the task is this, there is a subnet, working, in it you need to block access to social networks. networks, except for some users. It will not work to distribute statics, because the turnover of equipment is constant, and not an option. If you block the entire subnet, is it possible to add a specific IP to the exceptions, after giving the equipment static? If so, how? I did not work with Mikrotiks, I encountered it for the first time, figured out the rules of the application protocol (7), figured out the firewall, but did not find "exceptions for certain IPs".

Answer 1

Create a group that falls under the blocking rule or does not fall under the blocking rule and add users there. And already in the Firewall, block or allow this group access to social networks. networks.
You can not give statics, but in the IP settings - DHCP Server - Leases make the necessary entries static (right-click - make static).
You can not use L7 at all, update the firmware to the latest stable version and use IP - Firewall - Address list where add social addresses. networks by their domain names, Mikrotik will automatically create a list of IP belonging to this social network. networks.