Do you need to ban the Internet on Mikrotik except for one application on Android?

Question

Mikrotik

There is a VLAN interface with a subnet of 192.168.20.0/24, a vlan on a wifi access point. It needs to disable access to the Internet. Except for one application (Kaspi.kz) on a smartphone. How to implement it? If you can not firewall, how can you?

Example:
I create an allow rule:

/ip firewall filter
add chain=forward src-address=Мой ИП dst-address-list=Allowed action=accept

I create a deny rule:

/ip firewall filter

add chain=forward src-address=Мой ИП dst-address-list=!Allowed action=drop

But it only works on the site through the browser, and the application on the smartphone blocks.
If there is a solution, then an example can be immediately on android and on ios.

Answer 1

I see 2 options. Use "child mode" on android and make a list of allowed applications
Option about the network - You need a proxy in which you specify the allowed domains.
Your rule doesn't work with a firewall because the app seems to be using a different domain than the website... you need to find out the list of domains and add them to the allowed list. Don't forget to allow DNS queries

Answer 2

For this, corporate management systems were invented, where the organization decides what software and how it works on the phone.

Answer 3

Except for one application (Kaspi.kz) on a smartphone.

Should the application be given access to anywhere on the Internet or to a specific IP / Domain?

Answer 4

But it only works on the site through the browser, and the application on the smartphone blocks.

See where the app goes. It can break into an address like api.kaspi.xz