Web Proxy · Topic 2 of 2
Proxy Lists and Regular Expressions
Learn the RouterOS web proxy access, direct access and cache lists, their match fields and actions, and how regular expressions match hosts and paths.
- 5 min
- The three lists are
/ip proxy access,/ip proxy directand/ip proxy cache. - The access list uses allow and deny, and an unmatched request is allowed.
- The direct list uses allow for direct access and deny for the parent proxy.
What it is
The proxy rule lists decide what the proxy does with each request, and regular expressions make the rules flexible.
Each request passes through the lists in turn. The access list says whether the request is allowed.
The direct access list says how it leaves the router. The cache list says whether the response may be stored.
All three lists have the same style. A rule has match fields and an action, and the first rule that matches decides.
How it works
Each list has its own menu, but the match fields are alike.
Match fields
The rules in the lists look at parts of the HTTP request.
| Field | Matches |
|---|---|
| src-address | The client address |
| dst-address | The address of the web server |
| dst-port | The server port |
| local-port | The proxy port the request arrived on |
| dst-host | The host name in the request |
| path | The path part of the web address |
| method | The HTTP method, such as GET or POST |
The dst-host and path fields are text matches. They can use wildcards or regular expressions, as described below.
Access list
The access list controls which requests the proxy serves. It lives in /ip proxy access.
/ip proxy access add dst-host=*.social.example action=deny
/ip proxy access add src-address=192.168.88.0/24 action=allow| Action | Effect |
|---|---|
| allow | The proxy serves the request |
| deny | The proxy refuses the request |
Rules are read from top to bottom. If no rule matches, the request is allowed. A blocking rule is therefore written as a deny rule, and a catch all deny at the end turns the list into an allow list.
A deny rule can also carry the redirect-to parameter. The client is then sent to that address instead of seeing a plain refusal.
/ip proxy access add dst-host=*.news.example action=deny redirect-to=intranet.exampleDirect access list
The direct access list matters only when a parent proxy is configured. It lives in /ip proxy direct.
/ip proxy direct add dst-host=*.example action=allow| Action | Effect |
|---|---|
| allow | Fetch the page directly from the web server |
| deny | Send the request through the parent proxy |
Use this list for internal sites, so that they do not travel through the central proxy. Without a parent proxy, every request is fetched directly and this list has no effect.
Cache list
The cache list controls which responses the proxy may store. It lives in /ip proxy cache.
/ip proxy cache add path=":\\.(mp4|iso)\$" action=deny
/ip proxy cache add dst-host=*.updates.example action=allow| Action | Effect |
|---|---|
| allow | The response may be stored in the cache |
| deny | The response is not stored |
By default responses may be cached. Use deny rules to keep unwanted content out, for example very large files that would fill the cache, or pages that change at every request.
Order matters in all three lists. Put the narrow rules at the top and the general rules at the bottom.
Wildcards and regular expressions
Text fields such as dst-host and path can be matched in two ways.
| Form | Example | Meaning |
|---|---|---|
| Wildcard | *.example.com | An asterisk stands for any text, and a question mark for one character |
| Regular expression | :\\.mp3 | A value starting with a colon is read as a regular expression |
A regular expression is a pattern language. Inside the pattern, a dot matches any character unless escaped, and a dollar sign anchors the end.
A backslash escapes a special character. In the console, a backslash is written twice and a dollar sign is escaped with a backslash.
/ip proxy access add path=":\\.(mp3|avi)\$" action=denyThe rule above denies any request whose path ends in .mp3 or .avi. The vertical bar separates the two alternatives, which a wildcard cannot express as neatly.
Use a wildcard when it is enough, because it is easier to read and to check. Use a regular expression when you need alternatives or an anchor at the start or end.
Hit counters
Each rule has a hit counter that counts the requests that matched the rule.
After you add a rule, load a page and check the counter. If it stays at zero, the match field is wrong or a rule above it already took the request.
A deny rule with a loose pattern may block more than you meant. Test it on a few known sites and watch the counters.
What to remember for the exam
Eight facts cover most questions on this topic.
- The three lists are
/ip proxy access,/ip proxy directand/ip proxy cache. - The access list uses allow and deny, and an unmatched request is allowed.
- The direct list uses allow for direct access and deny for the parent proxy.
- The direct list matters only if a parent proxy is set.
- The cache list uses allow and deny to control what is stored.
- Rules are read from top to bottom, and the first match decides.
- Text fields accept wildcards, and a leading colon marks a regular expression.
- Rule hit counters show whether a rule matched.
Common mistakes
These four mistakes appear often.
Expecting the direct list to work without a parent proxy. There is nothing to bypass, so the list has no effect.
Reading deny in the direct list as blocking. It sends the request through the parent proxy and does not block it.
Forgetting the colon. Without it, the text is read as a wildcard and not as a regular expression.
Putting a general rule above a specific one. The specific rule never gets a hit.
Check yourself
Work through these three questions.
What happens to a request that no access list rule matches?
It is allowed.
What does deny mean in the direct access list?
The request is sent through the parent proxy, not fetched directly.
How do you mark a proxy rule value as a regular expression?
Start the value with a colon.
Topic 2 of 2 in Web Proxy
Test yourself on Web Proxy
The full MikroTik MTCTCE question bank has 479 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by MikroTik. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.