hello to everyone,

i'm working in a big municipality and they told me to block some pages.. i used to setup Web proxy in mikrotik to redirect some pages to a specified destination ..

but, some users there have found some ways to use web proxy and still access these sites, or seems they are using "FREE vpn softwares" and access these sites,

my question is : HOW TO BLOCK all "VPN softwares"? is there any port that i can block? and is there a way to block all web proxy pages??


  • 3
    You are trying to solve a personnel problem using technological means. You need to solve this at an HR level by making clear what your expectations are to the employees. Short of implementing a deny all, whitelist-based filter, there's nothing you'll be able to do about this. – EEAA Apr 14 '15 at 16:26
  • sir, i'm talking about how to block in mikrotik ALL users to connect any VPN and allow to access these pages??? – h0feer Apr 14 '15 at 16:33
  • 4
    Yes, and as I said, you'll need to block outbound access to everything for this to work, and then only whitelist specific sites you want your users to get access to. This is a policy and HR problem, not a technological problem. Your users will always find a way to get around whatever technological measures you put in place. – EEAA Apr 14 '15 at 16:40
  • EEAA thanks for your comment, i just want to know how to PREVENT / BLOCK users to use vpn , that's all if u can help me please, becuase whitelist is not allowed in the rule they gave me to do ;/ – h0feer Apr 14 '15 at 20:42

You can block the following to deny popular VPN/Tunnel protocols.

Port 1701 UDP (L2TP)
Port 1723 TCP (PPTP)
Port 1194 TCP/UDP (OVPN)

Protocol GRE (7)
Protocol IP Encapsulation (4)

There is also SSTP but this usually works on port 443 so you cannot really block this port as it will block many websites as well.


All vpn software can connect over port 80 or 443 so blocking them is almost impossible.

You can only look to which IP addresses they go and block those in firewall rule &​ Firewall address

/ip firewall rule add chain=forward protocol=tcp dst-port=80, 443 action=dst-nat to-addresses=<internal IP address> action=drop dst-address-list=<Your Block List>


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.