How to allow only Skype on Mikrotik?

Question

Skype

Kind.
The task is to prohibit the message "Internet" from the network on the Mikrotik router, to allow only Skype.
Please tell me how to solve this problem?
I tried to allow only 80, 443 and 33033 ports on the Skype servers (I got the list of ip addresses of the servers via sniffer), but it did not work.
In theory, this should be done through Layer7, such as Basic traffic shaping based on layer-7 protocols . But it didn't work for me either.

Answer 1

if you want to allow only access to certain addresses, why specify ports? enter only addresses.

Answer 2

https://virtualitsupport.wordpress.com/2013/12/09/...
you can jump from this

Answer 3

1. Make NAT only for allowed IPs.
The Skype IP list is taken from Google. Refine it yourself or load the entire Microsoft .

/ip firewall address-list add list=list-skype address=111.221.74.0/24
/ip firewall address-list add list=list-skype address=111.221.77.0/24
/ip firewall address-list add list=list-skype address=157.55.130.0/24
/ip firewall address-list add list=list-skype address=157.55.235.0/24
/ip firewall address-list add list=list-skype address=157.55.56.0/24
/ip firewall address-list add list=list-skype address=157.56.52.0/24
/ip firewall address-list add list=list-skype address=213.199.179.0/24
/ip firewall address-list add list=list-skype address=64.4.23.0/24
/ip firewall address-list add list=list-skype address=65.55.223.0/24

We raise NAT only from allowed IPs.

/ip firewall nat
add action=masquerade chain=srcnat out-interface=ether1 dst-address-list=list-skype

I checked it, it works for me, but double-check the IP list.
2. Of course, the same trick can be done in the Firewall with a rule that prohibits everything except the allowed Skype IP list.

/ip firewall filter
add chain=forward src-address-list=list-skype
add action=drop chain=forward dst-address-list=!list-skype