김용남 2017-03

static dns를 사용해보시는건 어떨까요?

lovin09 2017-03

정말 다기능의 장비 같은데, 쓰기가 어렵군요.

아무래도 포기해야 할듯 하네요

바나나파이… 2017-03

프로토콜이라서 그런거 아닌가요?

iwill 2017-03

nexon.com 앞에  닷(.)이  들어가면 문법룰이 틀려줘서 그런거 아닐까요..
^.+(nexon.com).*$  이렇게 해야 하는걸로 기억이...

백두성 2017-03

http등 domain name이 결국 ip로 변환되기 때문에 data에 nexon이 들어 있는 것은 의미가 없습니다.

따라서, dns값을 이용해 address  목록을 만들 필요가 있습니다.
다음 문서 참조하셔서
https://wiki.mikrotik.com/wiki/Manual:Scripting-examples#Block_access_to_specific_websites
firewall 등을 설정하시고

/system scripts에 넣는 스크립트는 다음을 사용해보세요.

:foreach i in=[/ip dns cache all find where (name~"nexon") && (type="A") ] do={
    :local tmpAddress [/ip dns cache get $i address];
    delay delay-time=10ms
#prevent script from using all cpu time
    :if ( [/ip firewall address-list find where address=$tmpAddress] = "") do={       
        :local cacheName [/ip dns cache get $i name] ;
        :log info ("added entry: $cacheName  $tmpAddress");
        /ip firewall address-list add address=$tmpAddress list=restricted comment=$cacheName;
    }
}

그리고 해당 스크립트를 scheduler에 걸어주면...
처음에는 브라우저에서 nexon.com에 접속되었다가 dns cache가 되고 스케줄러가 돌면
address 리스트가 등록되어 block이 되게 됩니다.

호기심에 해보니 링크 걸린 스크립트는 안되고 ^^;
아래 글 보고 하니 되네요.
https://forum.mikrotik.com/viewtopic.php?t=31311

# 관련 configuration 출력값은 대략 다음과 같습니다.
#################

/ip firewall nat
add action=redirect chain=dstnat comment=DNS !connection-bytes \
    !connection-limit !connection-mark !connection-rate !connection-type \
    !content disabled=no !dscp !dst-address !dst-address-list \
    !dst-address-type !dst-limit dst-port=53 !fragment !hotspot !icmp-options \
    !in-bridge-port !in-interface !ingress-priority !ipsec-policy \
    !ipv4-options !layer7-protocol !limit log=no log-prefix="" !nth \
    !out-bridge-port !out-interface !packet-mark !packet-size \
    !per-connection-classifier !port !priority protocol=tcp !psd !random \
    !routing-mark !routing-table !src-address !src-address-list \
    !src-address-type !src-mac-address !src-port !tcp-mss !time !to-addresses \
    to-ports=53 !ttl
add action=redirect chain=dstnat !connection-bytes !connection-limit \
    !connection-mark !connection-rate !connection-type !content disabled=no \
    !dscp !dst-address !dst-address-list !dst-address-type !dst-limit \
    dst-port=53 !fragment !hotspot !icmp-options !in-bridge-port \
    !in-interface !ingress-priority !ipsec-policy !ipv4-options \
    !layer7-protocol !limit log=no log-prefix="" !nth !out-bridge-port \
    !out-interface !packet-mark !packet-size !per-connection-classifier !port \
    !priority protocol=udp !psd !random !routing-mark !routing-table \
    !src-address !src-address-list !src-address-type !src-mac-address \
    !src-port !tcp-mss !time !to-addresses to-ports=53 !ttl

/ip firewall filter
add action=drop chain=forward !connection-bytes !connection-limit \
    !connection-mark !connection-nat-state !connection-rate !connection-state \
    !connection-type !content disabled=no !dscp !dst-address \
    dst-address-list=restricted !dst-address-type !dst-limit !dst-port \
    !fragment !hotspot !icmp-options !in-bridge-port !in-interface \
    !ingress-priority !ipsec-policy !ipv4-options !layer7-protocol !limit \
    log=no log-prefix="" !nth !out-bridge-port !out-interface !p2p \
    !packet-mark !packet-size !per-connection-classifier !port !priority \
    !protocol !psd !random !routing-mark !routing-table !src-address \
    !src-address-list !src-address-type !src-mac-address !src-port !tcp-flags \
    !tcp-mss !time !ttl

/system scheduler
add disabled=no interval=30s name=schedule_dns2addresslist on-event=\
    dns2addresslist policy=\
    ftp,reboot,read,write,policy,test,password,sniff,sensitive start-date=\
    mar/25/2017 start-time=03:33:42
/system script
add comment="DNS(nexon.com)" name=dns2addresslist owner=admin policy=\
    ftp,reboot,read,write,policy,test,password,sniff,sensitive source=":foreac\
    h i in=[/ip dns cache all find where (name~\"nexon\") && (type=\"A\") ] do\
    ={\
    \n    :local tmpAddress [/ip dns cache get \$i address];\
    \n    delay delay-time=10ms\
    \n#prevent script from using all cpu time\
    \n    :if ( [/ip firewall address-list find where address=\$tmpAddress] =\
    \_\"\") do={        \
    \n        :local cacheName [/ip dns cache get \$i name] ;\
    \n        :log info (\"added entry: \$cacheName  \$tmpAddress\");\
    \n        /ip firewall address-list add address=\$tmpAddress list=restric\
    ted comment=\$cacheName;\
    \n    }\
    \n}"

lovin09 2017-03

감사합니다. ^^  날잡아서 다시 해보겠습니다.

김용남 2017-03

IP > DNS > Static에서
+ 눌러서
Regexp: ^.*nexon\.com$
Address: 127.0.0.1
로 추가해 주세요

그리고
IP > DHCP Server > Networks에서
DNS Servers: [Gateway와 동일한 IP]로 설정해 주시면 됩니다.

간단히 *베 사이트 같은것 막기에 좋습니다.