{"id":1101,"date":"2023-07-24T10:13:14","date_gmt":"2023-07-24T13:13:14","guid":{"rendered":"http:\/\/www.tech-nico.com\/blog\/?p=1101"},"modified":"2023-07-24T10:13:16","modified_gmt":"2023-07-24T13:13:16","slug":"routeros-controlar-filtrar-contenido-por-dns-2023","status":"publish","type":"post","link":"http:\/\/www.tech-nico.com\/blog\/routeros-controlar-filtrar-contenido-por-dns-2023\/","title":{"rendered":"RouterOS – Controlar \/ Filtrar contenido por DNS 2023"},"content":{"rendered":"\n

En muchas ocasiones he tenido que controlar mediante QoS algunas cuestiones como las actualizaciones de windows, o las redes sociales, y en otros casos filtra Whatsapp.
OpenDNS<\/a> de Cisco permite mediante un dashboard poder ir tildando y destildando contenidos a filtrar.
Anda bien pero no te deja discriminar. Por ejemplo filtra \u00abRedes Sociales\u00bb pero el termino es muy grande y termina cometiendo errores. Si tildas por ejemplo \u00abFile Sharing\u00bb los audios de Whatsapp no se envian.
Entonces para evitar este tipo de problemas lo que hacemos es armar nuestro script que marque por nombre de dominio. <\/p>\n\n\n\n

\n

Te deja utilizar los filtros de manera gratuita para 1 direccion IP por cuenta. Es decir que para 1 red nateada andaria bien. Tiene para tildar por defecto redes bogon, sitios que propagan malware, pornografia, etc.<\/p>\nOpenDNS<\/cite><\/blockquote>\n\n\n\n

El script<\/h2>\n\n\n\n

Para que funcione correctamente tenemos que habilitar el cache de DNS de nuestro router y hacer resolver a nuestos clientes con los DNS del router. Luego siempre dropear el DNS input en el firewall para que no nos ataquen los DNS desde afuera. <\/p>\n\n\n\n

Lo que hace el script es buscar una palabra que coincida en el nombre del dominio. <\/p>\n\n\n\n

# Use DNS Entrys and add Address to the Firewall Address-list #\n:foreach i in=[\/ip dns cache all find where ( (name~\"instagram\") || (name~\"facebook\") || (name~\"twitter\") || (name~\"twitch\") ) && (type=\"A\") && (data!=0.0.0.0) ] do={\n:local tmpAddress [\/ip dns cache get $i data];\ndelay delay-time=10ms;\n# prevent script from using all cpu time #\n:if ( [\/ip firewall address-list find where address=$tmpAddress] = \"\") do={ \n:local cacheName [\/ip dns cache get $i name] ;\n#:log info (\"added entry: $cacheName $tmpAddress\");\n\/ip firewall address-list add address=$tmpAddress list=RedesSociales comment=$cacheName timeout=6d;\n}\n}<\/code><\/pre>\n\n\n\n
Si se fijan donde dice: <\/p>\n\n\n\n
(name~\u00bbinstagram<\/strong>\u00ab) || (name~\u00bbfacebook<\/strong>\u00ab) || (name~\u00bbtwitter<\/strong>\u00ab) || (name~\u00bbtwitch<\/strong>\u00ab) <\/p>\n\n\n\n
Modificamos a nuestro antojo.<\/p>\n\n\n\n
Y mas abajo le damos el nombre al Address-List:<\/p>\n\n\n\n
\/ip firewall address-list add address=$tmpAddress list=RedesSociales<\/strong> comment=$cacheName timeout=6d<\/strong>;<\/p>\n\n\n\n
Tambien pueden modificar el timeout<\/strong>: Todas las direcciones nuevas que resuelva las va agregando al AddressList (en este caso las mantiene por 6 dias), esto hace que tengamos un segundo cache que se vaya limpiando cada 6 dias y las direcciones IP viejas se vayan eliminando automaticamente.<\/p>\n\n\n\n
Luego solo nos queda hacer algo con ese address list. Podemso dropearlo en el firewall. 
O bien crear un mangle que marque la conexion con destino a esas IP y luego usarlo en Queues.<\/p>\n\n\n\n
Por ejemplo:<\/p>\n\n\n\n
\/ip firewall filter\nadd action=drop chain=forward dst-address-list=RedesSociales in-interface=bridge_alumnos\nadd action=drop chain=output dst-address-list=RedesSociales out-interface=bridge_alumnos<\/code><\/pre>\n\n\n\n
Ojo que en mi caso ademas le digo en que interfaz eliminar las redes sociales. Elijan la interfaz para su caso.<\/p>\n\n\n\n
origen: tech-nico.com<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"
En muchas ocasiones he tenido que controlar mediante QoS algunas cuestiones como las actualizaciones de windows, o las redes sociales, y en otros casos filtra Whatsapp. OpenDNS de Cisco permite mediante un dashboard poder ir tildando y destildando contenidos a … Sigue leyendo →<\/span><\/a><\/p>\n","protected":false},"author":3,"featured_media":600,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_publicize_message":"","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":true,"jetpack_social_options":{"image_generator_settings":{"template":"highway","default_image_id":0,"font":"","enabled":false},"version":2},"jetpack_post_was_ever_published":false},"categories":[74,73,3],"tags":[],"class_list":["post-1101","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-mikrotik","category-scripts","category-trucos"],"jetpack_publicize_connections":[],"jetpack_featured_media_url":"https:\/\/i0.wp.com\/www.tech-nico.com\/blog\/wp-content\/uploads\/2015\/05\/logo_tech_nico.com_.jpg?fit=1650%2C1400","jetpack_sharing_enabled":true,"jetpack_shortlink":"https:\/\/wp.me\/phA9Q-hL","jetpack_likes_enabled":true,"jetpack-related-posts":[{"id":645,"url":"http:\/\/www.tech-nico.com\/blog\/script-mikrotik-para-bloquear-dispositivos-moviles-en-firewall\/","url_meta":{"origin":1101,"position":0},"title":"Script Mikrotik para bloquear dispositivos moviles en Firewall","author":"soporte","date":"agosto 7, 2015","format":false,"excerpt":"Bloqueando Celulares desde Mikrotik con Firewall (Efectividad 80%) NOTA: Esta es la version para filtrar por firewall, tambien podes filtrar en bridge filter o\u00a0bloquear directamente en dhcp-server. Me toco en un colegio tener que dejar sin navegaci\u00f3n\u00a0a los celulares.\u00a0En este caso opte por armar un script que recorra la lista\u2026","rel":"","context":"En \u00abProgramaci\u00f3n\u00bb","block_context":{"text":"Programaci\u00f3n","link":"http:\/\/www.tech-nico.com\/blog\/category\/programacion\/"},"img":{"alt_text":"","src":"https:\/\/i0.wp.com\/www.tech-nico.com\/blog\/wp-content\/uploads\/2015\/05\/logo_tech_nico.com_.jpg?fit=1200%2C1018&resize=350%2C200","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/www.tech-nico.com\/blog\/wp-content\/uploads\/2015\/05\/logo_tech_nico.com_.jpg?fit=1200%2C1018&resize=350%2C200 1x, https:\/\/i0.wp.com\/www.tech-nico.com\/blog\/wp-content\/uploads\/2015\/05\/logo_tech_nico.com_.jpg?fit=1200%2C1018&resize=525%2C300 1.5x, https:\/\/i0.wp.com\/www.tech-nico.com\/blog\/wp-content\/uploads\/2015\/05\/logo_tech_nico.com_.jpg?fit=1200%2C1018&resize=700%2C400 2x, https:\/\/i0.wp.com\/www.tech-nico.com\/blog\/wp-content\/uploads\/2015\/05\/logo_tech_nico.com_.jpg?fit=1200%2C1018&resize=1050%2C600 3x"},"classes":[]},{"id":582,"url":"http:\/\/www.tech-nico.com\/blog\/script-mikrotik-para-bloquear-dispositivos-moviles-en-bridge-muy-efectivo\/","url_meta":{"origin":1101,"position":1},"title":"[Actualizado] Script Mikrotik para bloquear dispositivos m\u00f3viles en bridge – Muy Efectivo!","author":"soporte","date":"marzo 20, 2016","format":false,"excerpt":"Bloqueando Celulares desde Mikrotik con Bridge filter (Efectividad 80%) NOTA: Esta es la version para filtrar por bridge, tambien podes filtrar en firewall\u00a0o\u00a0bloquear directamente en dhcp-server. Me toco en un colegio tener que dejar sin navegaci\u00f3n\u00a0a los celulares.\u00a0En este caso opte por armar un script que recorra la lista de\u2026","rel":"","context":"En \u00abProgramaci\u00f3n\u00bb","block_context":{"text":"Programaci\u00f3n","link":"http:\/\/www.tech-nico.com\/blog\/category\/programacion\/"},"img":{"alt_text":"","src":"https:\/\/i0.wp.com\/www.tech-nico.com\/blog\/wp-content\/uploads\/2015\/05\/logo_tech_nico.com_.jpg?fit=1200%2C1018&resize=350%2C200","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/www.tech-nico.com\/blog\/wp-content\/uploads\/2015\/05\/logo_tech_nico.com_.jpg?fit=1200%2C1018&resize=350%2C200 1x, https:\/\/i0.wp.com\/www.tech-nico.com\/blog\/wp-content\/uploads\/2015\/05\/logo_tech_nico.com_.jpg?fit=1200%2C1018&resize=525%2C300 1.5x, https:\/\/i0.wp.com\/www.tech-nico.com\/blog\/wp-content\/uploads\/2015\/05\/logo_tech_nico.com_.jpg?fit=1200%2C1018&resize=700%2C400 2x, https:\/\/i0.wp.com\/www.tech-nico.com\/blog\/wp-content\/uploads\/2015\/05\/logo_tech_nico.com_.jpg?fit=1200%2C1018&resize=1050%2C600 3x"},"classes":[]},{"id":777,"url":"http:\/\/www.tech-nico.com\/blog\/routeros-6-41-incorpora-tls-host-para-controlar-sitios-https-que-usen-tcp\/","url_meta":{"origin":1101,"position":2},"title":"RouterOS 6.41 incorpora TLS-Host para controlar sitios HTTPS que usen TCP","author":"soporte","date":"febrero 2, 2018","format":false,"excerpt":"Alternativa para poder manejar fitros o queues en sitios con HTTPS En la version 6.42rc (release candidate) segun afirman en el foro oficial de Mikrotik, ya esta en funcionamiento el parametro TLC-Host desde los filtros del firewall, con lo cual permite marcar\/controlar o filtrar ciertos sitios HTTPS que corran en\u2026","rel":"","context":"En \u00abmikrotik\u00bb","block_context":{"text":"mikrotik","link":"http:\/\/www.tech-nico.com\/blog\/category\/mikrotik\/"},"img":{"alt_text":"","src":"https:\/\/i0.wp.com\/www.tech-nico.com\/blog\/wp-content\/uploads\/2015\/05\/logo_tech_nico.com_.jpg?fit=1200%2C1018&resize=350%2C200","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/www.tech-nico.com\/blog\/wp-content\/uploads\/2015\/05\/logo_tech_nico.com_.jpg?fit=1200%2C1018&resize=350%2C200 1x, https:\/\/i0.wp.com\/www.tech-nico.com\/blog\/wp-content\/uploads\/2015\/05\/logo_tech_nico.com_.jpg?fit=1200%2C1018&resize=525%2C300 1.5x, https:\/\/i0.wp.com\/www.tech-nico.com\/blog\/wp-content\/uploads\/2015\/05\/logo_tech_nico.com_.jpg?fit=1200%2C1018&resize=700%2C400 2x, https:\/\/i0.wp.com\/www.tech-nico.com\/blog\/wp-content\/uploads\/2015\/05\/logo_tech_nico.com_.jpg?fit=1200%2C1018&resize=1050%2C600 3x"},"classes":[]},{"id":948,"url":"http:\/\/www.tech-nico.com\/blog\/navegar-con-dns-por-https-en-mikrotik\/","url_meta":{"origin":1101,"position":3},"title":"Navegar con DNS por HTTPs en Mikrotik","author":"soporte","date":"agosto 12, 2020","format":false,"excerpt":"A partir de las ultimas versiones de RouterOS, ya viene la posibilidad de habilitar los DNS seguros o mejor dicho DoH (DNS over HTTPS). De esta manera se terminan los ataques de envenenamiento tu tabla cache de DNS o de algun tipo de manipulacion como se suelen hacer con ataques\u2026","rel":"","context":"En \u00abgeneral\u00bb","block_context":{"text":"general","link":"http:\/\/www.tech-nico.com\/blog\/category\/general\/"},"img":{"alt_text":"","src":"https:\/\/i0.wp.com\/www.tech-nico.com\/blog\/wp-content\/uploads\/2015\/05\/logo_tech_nico.com_.jpg?fit=1200%2C1018&resize=350%2C200","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/www.tech-nico.com\/blog\/wp-content\/uploads\/2015\/05\/logo_tech_nico.com_.jpg?fit=1200%2C1018&resize=350%2C200 1x, https:\/\/i0.wp.com\/www.tech-nico.com\/blog\/wp-content\/uploads\/2015\/05\/logo_tech_nico.com_.jpg?fit=1200%2C1018&resize=525%2C300 1.5x, https:\/\/i0.wp.com\/www.tech-nico.com\/blog\/wp-content\/uploads\/2015\/05\/logo_tech_nico.com_.jpg?fit=1200%2C1018&resize=700%2C400 2x, https:\/\/i0.wp.com\/www.tech-nico.com\/blog\/wp-content\/uploads\/2015\/05\/logo_tech_nico.com_.jpg?fit=1200%2C1018&resize=1050%2C600 3x"},"classes":[]},{"id":679,"url":"http:\/\/www.tech-nico.com\/blog\/mikrotik-routeros-address-list-whatsapp\/","url_meta":{"origin":1101,"position":4},"title":"[Actualizado] Mikrotik RouterOS Address-List Whatsapp","author":"soporte","date":"mayo 18, 2017","format":false,"excerpt":"Mikrotik RouterOS Address-List Whatsapp, Para todos aquellos que quieren ecualizar con QOS \/ priorizar, o bien filtrar Whatsapp, mas abajo les dejo el address-list listo para copiar y pegar en la consola de tu RouterOS. De a cuerdo al CIDR con todos los bloques completos de IP que usa Whatsapp\u2026","rel":"","context":"En \u00abredes\u00bb","block_context":{"text":"redes","link":"http:\/\/www.tech-nico.com\/blog\/category\/redes\/"},"img":{"alt_text":"","src":"https:\/\/i0.wp.com\/www.tech-nico.com\/blog\/wp-content\/uploads\/2015\/05\/logo_tech_nico.com_.jpg?fit=1200%2C1018&resize=350%2C200","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/www.tech-nico.com\/blog\/wp-content\/uploads\/2015\/05\/logo_tech_nico.com_.jpg?fit=1200%2C1018&resize=350%2C200 1x, https:\/\/i0.wp.com\/www.tech-nico.com\/blog\/wp-content\/uploads\/2015\/05\/logo_tech_nico.com_.jpg?fit=1200%2C1018&resize=525%2C300 1.5x, https:\/\/i0.wp.com\/www.tech-nico.com\/blog\/wp-content\/uploads\/2015\/05\/logo_tech_nico.com_.jpg?fit=1200%2C1018&resize=700%2C400 2x, https:\/\/i0.wp.com\/www.tech-nico.com\/blog\/wp-content\/uploads\/2015\/05\/logo_tech_nico.com_.jpg?fit=1200%2C1018&resize=1050%2C600 3x"},"classes":[]},{"id":618,"url":"http:\/\/www.tech-nico.com\/blog\/mikrotik-script-marcar-y-controlar-trafico-de-whatsapp-por-dns\/","url_meta":{"origin":1101,"position":5},"title":"Mikrotik Script: Marcar y controlar trafico de whatsapp por DNS","author":"soporte","date":"junio 5, 2015","format":false,"excerpt":"Si queremos controlar el ancho de banda de whatsapp por QoS o dropear o simplemente dejar pasar este trafico, podemos ejecutar este maravilloso script desde nuestro RouterOS, que recolecta las IP que usa esta aplicaci\u00f3n de mensajer\u00eda. Las IP que recolecta realmente son MUCHAS!. \u00a0 Entonces, pegamos este codigo en\u2026","rel":"","context":"En \u00abProgramaci\u00f3n\u00bb","block_context":{"text":"Programaci\u00f3n","link":"http:\/\/www.tech-nico.com\/blog\/category\/programacion\/"},"img":{"alt_text":"","src":"https:\/\/i0.wp.com\/www.tech-nico.com\/blog\/wp-content\/uploads\/2015\/05\/logo_tech_nico.com_.jpg?fit=1200%2C1018&resize=350%2C200","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/www.tech-nico.com\/blog\/wp-content\/uploads\/2015\/05\/logo_tech_nico.com_.jpg?fit=1200%2C1018&resize=350%2C200 1x, https:\/\/i0.wp.com\/www.tech-nico.com\/blog\/wp-content\/uploads\/2015\/05\/logo_tech_nico.com_.jpg?fit=1200%2C1018&resize=525%2C300 1.5x, https:\/\/i0.wp.com\/www.tech-nico.com\/blog\/wp-content\/uploads\/2015\/05\/logo_tech_nico.com_.jpg?fit=1200%2C1018&resize=700%2C400 2x, https:\/\/i0.wp.com\/www.tech-nico.com\/blog\/wp-content\/uploads\/2015\/05\/logo_tech_nico.com_.jpg?fit=1200%2C1018&resize=1050%2C600 3x"},"classes":[]}],"_links":{"self":[{"href":"http:\/\/www.tech-nico.com\/blog\/wp-json\/wp\/v2\/posts\/1101","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/www.tech-nico.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/www.tech-nico.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/www.tech-nico.com\/blog\/wp-json\/wp\/v2\/users\/3"}],"replies":[{"embeddable":true,"href":"http:\/\/www.tech-nico.com\/blog\/wp-json\/wp\/v2\/comments?post=1101"}],"version-history":[{"count":1,"href":"http:\/\/www.tech-nico.com\/blog\/wp-json\/wp\/v2\/posts\/1101\/revisions"}],"predecessor-version":[{"id":1102,"href":"http:\/\/www.tech-nico.com\/blog\/wp-json\/wp\/v2\/posts\/1101\/revisions\/1102"}],"wp:featuredmedia":[{"embeddable":true,"href":"http:\/\/www.tech-nico.com\/blog\/wp-json\/wp\/v2\/media\/600"}],"wp:attachment":[{"href":"http:\/\/www.tech-nico.com\/blog\/wp-json\/wp\/v2\/media?parent=1101"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/www.tech-nico.com\/blog\/wp-json\/wp\/v2\/categories?post=1101"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/www.tech-nico.com\/blog\/wp-json\/wp\/v2\/tags?post=1101"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}