Direct Access List - MikroTik RouterOS v2.9 Reference Manual

• to specify that no symbols are allowed after the given pattern, we use $ symbol at the end of
the pattern
• to enter [ or ] symbols, you should escape them with backslash \.
Example
The default rule:
[admin@MikroTik] ip web-proxy access> print
Flags: X - disabled, I - invalid
0 ;;; allow CONNECT only to SSL ports 443 [https] and 563 [snews]
dst-port=!443,563 method=connect action=deny
[admin@MikroTik] ip web-proxy access>
To disallow download of .MP3 and .MPG files and FTP connections other than from the 10.0.0.1
server:
[admin@MikroTik] ip web-proxy access> add url=":\\.mp\[3g\]$" action=deny
[admin@MikroTik] ip web-proxy access> add src-address=10.0.0.1/32 action=allow
[admin@MikroTik] ip web-proxy access> add url="ftp://*" action=deny
[admin@MikroTik] ip web-proxy access> print
Flags: X - disabled, I - invalid
0 ;;; allow CONNECT only to SSL ports 443 [https] and 563 [snews]
dst-port=!443,563 method=connect action=deny
1 url=":\.mp[3g]$" action=deny
2 src-address=10.0.0.1/32 action=allow
3 url="ftp://*" action=deny
[admin@MikroTik] ip web-proxy access>

Direct Access List

Home menu level: /ip web-proxy direct
Description
If parent-proxy property is specified, it is possible to tell the proxy server whether to try to pass the
request to the parent proxy or to resolve it connecting to the requested server directly. Direct Access
List is managed just like Proxy Access List described in the previous chapter except the action
argument.
Property Description
action ( allow | deny ; default: allow ) - specifies the action to perform on matched packets
• allow - always resolve matched requests directly bypassing the parent router
• deny - resolve matched requests through the parent proxy. If no one is specified this has the
same effect as allow
dst-address ( IP address | netmask ) - destination address of the IP packet
dst-port ( port ) - a list or range of ports the packet is destined to
local-port ( port ) - specifies the port of the web proxy via which the packet was received. This
value should match one of the ports web proxy is listening on.
Copyright 1999-2007, MikroTik. All rights reserved. Mikrotik, RouterOS and RouterBOARD are trademarks of Mikrotikls SIA.
Other trademarks and registred trademarks mentioned herein are properties of their respective owners.
Page 557 of 695