Layer 7 Protocol Matching in MikroTik

Layer7 Protocol Filter in MikroTik Firewall

Layer7 protocol matching is a powerful feature in RouterOS that lets you inspect packet payloads and match traffic based on patterns in the data — not just IP addresses and ports. This is useful for blocking specific applications, games, or websites by recognizing their traffic signatures.

What is Layer7 Matching?

Traditional firewall rules work at Layer 3 (IP) and Layer 4 (TCP/UDP ports). Layer7 goes deeper — it reads the actual content of packets to find patterns. In RouterOS, you define a regex (regular expression) pattern, and the firewall checks packet data against it.

Where It Lives

/ip firewall layer7-protocol

This is where you define your patterns. Then you reference those patterns inside regular firewall filter rules.

Creating a Layer7 Pattern

/ip firewall layer7-protocol add name=block-youtube regexp="^.*(youtube.com|googlevideo.com).*$"

This defines a pattern called block-youtube that matches traffic containing "youtube.com" or "googlevideo.com" in the payload.

Applying It in a Firewall Rule

/ip firewall filter add chain=forward layer7-protocol=block-youtube action=drop comment="Block YouTube"

This rule drops any forwarded traffic that matches the Layer7 pattern.

Blocking an App by Pattern

Here is an example blocking Telegram:

/ip firewall layer7-protocol add name=block-telegram regexp="^.*(149.154.|91.108.).*$"

This matches Telegram's known IP ranges in packet data. A better approach for IP blocking is address-lists, but Layer7 can catch patterns that IP rules miss.

Blocking HTTP Host Headers

For plain HTTP traffic, you can match the Host header:

/ip firewall layer7-protocol add name=block-facebook regexp="^.*(facebook.com|fbcdn.net).*$"

/ip firewall filter add chain=forward layer7-protocol=block-facebook action=drop comment="Block Facebook HTTP"

Note: This works only for unencrypted HTTP. HTTPS traffic is encrypted, so the hostname is in the TLS SNI field, not visible as plain text in most cases.

Using Layer7 with Address Lists

You can combine Layer7 with address lists for smarter rules:

/ip firewall layer7-protocol add name=detect-torrent regexp="^(BitTorrent protocol|azver
$|get /scrape?info_hash=)"

/ip firewall filter add chain=forward layer7-protocol=detect-torrent action=add-src-to-address-list address-list=torrent-users address-list-timeout=1h
/ip firewall filter add chain=forward src-address-list=torrent-users action=drop

This detects torrent traffic, adds the source IP to a list, then blocks all traffic from that IP for one hour.

Performance Considerations

Layer7 matching is expensive in terms of CPU usage. Here is why:

• RouterOS must inspect the payload of every packet, not just headers
• Regex matching is computationally heavier than simple IP/port checks
• RouterOS checks the first 10 packets (or first 2KB of data) in a connection by default — if no match is found, it stops checking that connection

Tips to Minimize Performance Impact

• Place Layer7 rules after other rules — use IP/port filtering first to reduce the number of packets reaching Layer7 rules
• Use connection state matching — only inspect new connections:

/ip firewall filter add chain=forward connection-state=new layer7-protocol=block-youtube action=drop

• Avoid complex regex — keep patterns simple and specific
• Test on low-traffic routers first — on busy networks, Layer7 can spike CPU to 100%

Limitations of Layer7

1. Does not work with encrypted traffic — HTTPS, QUIC, and most modern apps use encryption, making payload inspection ineffective
2. Only inspects first packets — if the signature appears later in the stream, it will be missed
3. False positives — broad regex patterns may accidentally block legitimate traffic
4. Not a replacement for a proper content filter — for reliable content filtering, use dedicated solutions like DNS-based filtering or a proxy

Viewing Layer7 Patterns

/ip firewall layer7-protocol print

Output example:

# NAME                     REGEXP
0 block-youtube            ^.*(youtube.com|googlevideo.com).*$
1 block-facebook           ^.*(facebook.com|fbcdn.net).*$

Practical Example: Block Gaming Traffic

/ip firewall layer7-protocol add name=block-steam regexp="^.*(steampowered.com|steamcontent.com).*$"

/ip firewall filter add chain=forward layer7-protocol=block-steam action=drop comment="Block Steam downloads"

Summary

• Layer7 lets you match traffic by payload content using regex
• Define patterns under /ip firewall layer7-protocol
• Reference patterns in firewall filter rules
• Best used for HTTP (unencrypted) traffic detection
• Always place Layer7 rules late in the chain to protect CPU performance
• For modern encrypted apps, DNS filtering is more effective