/ip proxy set port=8403,8402 enabled=yes
/ip proxy access
add action=deny local-port=8402 disabled=no \
redirect-to="http://sgp.net.br/bloqueio/netbox/atraso"
add action=deny local-port=8403 disabled=no \
redirect-to="http://sgp.net.br/bloqueio/netbox/"

/ip firewall address-list
add address=144.202.13.29 list=SITES-LIBERADOS
add address=208.67.222.222 list=SITES-LIBERADOS
add address=208.67.222.220 list=SITES-LIBERADOS
add address=8.8.8.8 list=SITES-LIBERADOS
add address=8.8.4.4 list=SITES-LIBERADOS
add address=10.24.0.0/22 list=BLOQUEADOS

/ip firewall filter
add action=drop chain=forward dst-address-list=!SITES-LIBERADOS src-address-list=BLOQUEADOS comment="SGP REGRAS"

/ip firewall nat
add action=masquerade chain=srcnat \
src-address-list=BLOQUEADOS comment="SGP REGRAS"
add action=redirect chain=dstnat src-address-list= BLOQUEADOS \
dst-address-list=!SITES-LIBERADOS dst-port=80,443 protocol=tcp to-ports=8403 comment="SGP REGRAS"
add chain=dstnat connection-mark=BLOQUEIO-AVISAR protocol=tcp action=redirect to-ports=8402 comment="SGP REGRAS"

# Aviso bloqueio
/ip firewall mangle
add chain=prerouting connection-state=new src-address-list=BLOQUEIO-AVISAR protocol=tcp dst-port=80 \
action=mark-connection new-connection-mark=BLOQUEIO-VERIFICAR passthrough=yes comment="SGP REGRAS"
add chain=prerouting connection-mark=BLOQUEIO-VERIFICAR src-address-list=!BLOQUEIO-AVISADOS \
action=mark-connection new-connection-mark=BLOQUEIO-AVISAR comment="SGP REGRAS"

/ip firewall filter
add chain=input connection-mark=BLOQUEIO-AVISAR action=add-src-to-address-list \
address-list=BLOQUEIO-AVISADOS address-list-timeout=4h comment="SGP REGRAS"

/ip pool
add name=bloqueados ranges=10.24.0.0/22