Network

Block VPN & Proxy Websites (Layer7) — v6 & v7

Layer7 pattern with websites of popular VPN, proxy and hacking tools, plus a disabled drop rule. It blocks the websites, not every VPN protocol.

MikroTik Version

RouterOS v6 & v7

# EN: Websites of VPN, proxy and security tools to block
# AR: مواقع برامج VPN والبروكسي والأدوات الأمنية المراد حظرها
/ip firewall layer7-protocol
add name=block-vpn-sites regexp="^.+(hoobie.net|project-rainbowcrack.com|edge-security.com|aircrack-ng.org|openwall.com|oxid.it|l0phtcrack.com|crypticide.com|hashcat.net|ultrasurf.us|hotspotshield.com|hide.me|genmirror.com|vpnunlimitedapp.com|ipvanish.com|hidemyass.com|tunnelbear.com|proxysite.com|croxyproxy.com|expressvpn.com|nordvpn.com|xvpn.io|protonvpn.com|pandasecurity.com|privateinternetaccess.com|betternet.co|f-secure.com|hideman.net|openvpn.net|operavpn.com|surfeasy.com|goldenfrog.com|vpnmaster.com|yogavpn.com|zpn.im|zenvpn.net|webproxy.to|vpnbook.com|hidester.com|whoer.net).*\$"

# EN: Drop rule - created disabled, enable it after testing
# AR: قاعدة الحظر - تُنشأ معطلة، فعّلها بعد التجربة
/ip firewall filter
add chain=forward layer7-protocol=block-vpn-sites action=drop disabled=yes comment="Block VPN and proxy websites"