This script is useful if you need ip address without netmask (for example to use it in firewall), but ' /ip address get address' returns ip address and netmask. :put 'ip address $currentIP changed to $newIP' This script will compare if dynamic IP address is changed. Sometimes provider gives dynamic IP addresses. In v3.x it is not possible to create file directly, however there is a workaround Script examples used in this section were tested with the latest 3.x version. This section contains some useful scripts and shows all available scripting features.

2.3 Include custom function in another script.

1.14 Other scripts known to work with latest v3.x.

1.12 Allow use of ntp.org pool service for NTP.

1.8 Check bandwidth and add limitations.

1.6 Generate backup and send it by e-mail.

1.5 Write simple queue stats in multiple files.

1.2 Check if IP on interface have changed.

If the above is too theoretical for you, be aware that so was your question - so if you want a more detailed suggestion, post your export. But either of those authentication methods must be used for all users, not just those you want to restrict.

A poor man's alternative to this is to force use of PPPoE on LAN. The only reliable measure to prevent users from escaping your rules by changing their MAC addresses is to use 802.1x authentication, which requires (to date) an external RADIUS server. However, to prevent users from escaping your rules by manually assigning IP addresses, you may need to set arp=reply-only on the interface and let the DHCP server add arp records for the addresses it leases out.

To your question, the same way you can place accept rules matching on IP addresses of privileged devices before the blocking rules, to except the traffic of the privileged devices from being handled by the blocking rules, you can also add a src-address-list to the blocking rules so that these rules would only apply on devices whose addresses are placed on that address list.įirewall rules cannot be directly linked to MAC addresses without spending extra CPU so I would recommend to use static dhcp leases. Also if you can block facebook without blocking login to other services using the facebook account, the same people will be happy too. If you've found a reliable way to block youtube alone without blocking the rest of google services, please share the link or your configuration, you'll make many people here happy.

Mikrotik block mac address