How to Apply Different Treatment for Overseas Traffic
Description
You want to deny, slow down or proxy oversea traffic. To distinguish oversea
traffic from the local country traffic, 'mangle mark' function can be used. It
will 'mark' the packets to / from the networks that reside in your country and
the oversea traffic with different marks, so that you may apply different
treatment for these flows.
To prepare mangle list, you need to get a list of local networks. List of
network numbers belonging to ISPs in Latvia can be extracted from file http://www.nic.lv/local.net Generate router script file (.rsc) (for
example, using spreadsheet program, such as Microsoft Excel), upload it to the
router via FTP and import it (with '/import' command). Here is a condensed
example of a such a script for Latvian networks: /ip firewall mangle
add in-interface=ether1 dst-address=159.148.0.0/16 action=passthrough
.. mark-connection=mark-con-latvia comment="mark all latvian traffic"
add dst-address=193.41.195.0/24 action=passthrough
.. mark-connection=mark-con-latvia comment="mark all latvian traffic"
add dst-address=193.41.33.0/24 action=passthrough
.. mark-connection=mark-con-latvia comment="mark all latvian traffic"
add dst-address=193.41.45.0/24 action=passthrough
.. mark-connection=mark-con-latvia comment="mark all latvian traffic"
add dst-address=193.68.64.0/19 action=passthrough
.. mark-connection=mark-con-latvia comment="mark all latvian traffic"
...
add connection =>
mark-con-latvia action=passthrough mark-flow=latvia comment="mark latvia"
add flow=!latvia action =>
passthrough mark-flow=overseas comment="mark all oversea traffic"
Next, you should define, what to do with the marked packets. The basic usages
are:
-
Limit access to/from oversea sites from some or all hosts of your network.
For example, to deny oversea traffic for 10.0.0.0/24 network: /ip firewall rule forward
add action=drop flow=overseas src-address=10.0.0.0/24
add action=drop flow=overseas dst-address=10.0.0.0/24
The same way you may deny oversea traffic for some computers (for example, to
specify a particular host, you should use the host's address with the mask of
32).
-
Slow down speed of oversea connections. For example, to limit overall speed
of downloading from overseas to 128Kbit/s and of uploading - to 64Kbit/s: /queue tree
add flow=overseas parent=local max-limit=131072
add flow=overseas parent=public max-limit=65536
-
To use local transparent web proxy server for oversea HTTP traffic: /ip web-proxy set enabled=yes transparent-proxy=yes address=:3128
/ip firewall dst-nat add flow=overseas in-interface=local protocol=tcp
dst-port=80 action=redirect to-dst-port=3128 | 
Access Points
