Why can't I block a site in MikroTik?

Question

Mikrotik

Please tell me what I'm doing wrong. You need to block youtube.com. Using firewall, I add a domain to the address list. Then I create a reject - tcp reset rule. The client has a dns router, but the added domain does not cut.

Answer 1

fasttrack disable

Answer 2

Try to raise the rules blocking for this address list higher. And put reject action instead of tcp reset (not sure if tcp reset and fasttrack will coexist normally).

Answer 3

in my opinion, on Mikrotik you can’t block sites except for L7 https in principle - you need to use a proxy

Answer 4

Replace reject with drop. Add udp, youtube can work on udp down anyway.
Check which addresses the client is going to, youtube can have a lot of them, and the address list is not updated online.
Alternatively, add a static entry for youtube to mikrotik's dns, to a stub or to 127.0.0.1, and block other dns.

Answer 5

Most likely, the IP of the YouTuber changes very quickly, to which the address of the Mikrotik sheet does not respond.
Try this:
By adding a .*\\.youtube\\.com DNS entry and wrapping it in a stub, we will block access to all hosts in the youtube.com domain.
Using the .*youtube\\.com entry will block all hosts whose name ends with youtube.com By
adding the .*youtube.* DNS entry and wrapping it around a stub, you can block all sites that contain youtube in the address.
To protect yourself from alternative dns, you can do the following:

/ip firewall nat
add chain=dstnat protocol=udp dst-port=53 action=redirect 
add chain=dstnat protocol=tcp dst-port=53 action=redirect

Answer 6

Checked. This method works, but there is a nuance - the browser has its own DNS client and it will still be able to resolve the address that is not in the address list.
You can try to prohibit access to foreign DNS, but in the era of DoH, this is also useless ...