Website blocking?

Question

Mikrotik

There is a grid, with a bunch of PCs.
Router MikroTik RouterOS 6.37.3.
ip are distributed from the router based on DHCP.
It is necessary to block social networks and other necessary sites.
Here I found some solutions, but they do not work correctly, something works and something does not.
Need something new. Thanks in advance.
PS I'm not very good at Mikrotik.

Answer 1

In the role of https-proxy, Mikrotik is not able to work, and dns substitution has many workarounds.
So, depending on the skill of users, either close workarounds for dns spoofing, which is often difficult, and not always realistic at all, or do https-proxy NOT on Mikrotik.
Threat in the presence of a domain, a white list of applications, and the exclusion of loading extensions for browsers - dns substitution is quite a working option.

Answer 2

For http, you can use the built-in proxy, for https sites, you can use a firewall, in the latest versions you can not use l7 filters, there is a SNI field ready, but you need to understand that this actually remains an l7 filter, i.e. resources will eat up.
This is quite a working solution, but now every second person in his pocket has a phone with a screen of 5 inches and 3g, i.e. such blocking will not help in the situation of "lazy brutes, instead of working in VKontakte they are sitting."

Answer 3

This is unrealizable only with the help of Mikrotik, unless it is a top model.
Why.
Mikrotik router. Hence it is optimized for routing tasks. The proxy in it is "for show", it is useless to use it, and https in general simply resets it. Yes, you can gut https requests for SNI, but firstly, there may not be anything there, and secondly, the L7 filter that will implement this - it eats a lot of resources!
You can stupidly ban IP - feel like Roskomnadzor :)
You can put a proxy in front of Mikrotik - and then you can safely blame everyone on the proxy. If statistics are not needed, then bumping is not needed, you can do without replacing certificates

Answer 4

Hello.
The address list in routeros can resolve dns names.
tested on 6.45.1
Everything is simple.
ip firewall address-list add address=www.ya.ru list=block_website
ip firewall filter add chain=forward action=reject reject-with=tcp-reset protocol=tcp dst-address-list=block_website
ps action=drop better not to use .
If you use drop, then for the browser the block with the domain name www.ya.ru will fall off by timeout. If you use reject then the router will respond that there is no connection with this host and the browser will not download this block.
ps2, the client's dns must have the address of the router where the blocking occurs.