1.

disable p2p connections

/ system script
add name="stop_dc1" source="ip firewall rule forward enable \[/ip firewall rule forward
find action=drop\]
\n" \ policy=ftp,reboot,read,write,policy,test
for RouterOS v2.9 it looks like this:
/ system script
add name="stop_dc1" source="ip firewall filter enable \[/ip firewall filter find action=drop\]
\n" \
policy=ftp,reboot,read,write,policy,test

2. enable p2p connections

/ system script
add name="start_dc1" source="ip firewall rule forward disable \[/ip firewall rule forward find \
action=drop\]
\n" policy=ftp,reboot,read,write,policy,test
(I have to add that for these two scripts you have to have a firewall rule: )
/ ip firewall rule forward
add p2p=all-p2p action=drop comment="" disabled=no

This example will explain you “How to Block Web Sites” & “How to Stop Downloading”. I have use
Web-Proxy test Package.
First, Configure Proxy.

/ip proxy
enabled: yes
src-address: 0.0.0.0
port: 8080
parent-proxy: 0.0.0.0:0
cache-drive: system
cache-administrator: "ASHISH PATEL"
max-disk-cache-size: none
max-ram-cache-size: none
cache-only-on-disk: no
maximal-client-connections: 1000
maximal-server-connections: 1000
max-object-size: 512KiB
max-fresh-time: 3d

Now, Make it Transparent

/ip firewall nat

chain=dstnat protocol=tcp dst-port=80 action=redirect to-ports=8080

Make sure that your proxy is NOT a Open Proxy

/ip firewall filter

chain=input in-interface= src-address=0.0.0.0/0 protocol=tcp dst-port=8080 action=drop
Now for Blocking Websites

/ip proxy access

dst-host=www.vansol27.com action=deny

It will block website http://www.vansol27.com, We can always block the same for different networks
by giving src-address. It will block for particular source address.
We can also stop downloading files like.mp3, .exe, .dat, .avi,…etc.

/ip proxy access

path=*.exe action=deny
path=*.mp3 action=deny
path=*.zip action=deny
path=*.rar action=deny.

Try with this also

/ip proxy access

dst-host=:mail action=deny

This will block all the websites contain word “mail” in url.

Example: It will block www.hotmail.com, mail.yahoo.com, www.rediffmail.com

/ip firewall filter

add action=accept chain=input comment="Anti-Netcut" disabled=no dst-port=’ 0-65535 protocol=tcp

src-address=61.213.183.1-61.213.183.254
add action=accept chain=input comment="Anti-Netcut" disabled=no dst-port=’ 0-65535 protocol=tcp
src-address=67.195.134.1-67.195.134.254
add action=accept chain=input comment="Anti-Netcut" disabled=no dst-port=’ 0-65535 protocol=tcp
src-address=68.142.233.1-68.142.233.254
add action=accept chain=input comment="Anti-Netcut" disabled=no dst-port=’ 0-65535 protocol=tcp
src-address=68.180.217.1-68.180.217.254
add action=accept chain=input comment="Anti-Netcut" disabled=no dst-port=’ 0-65535 protocol=tcp
src-address=203.84.204.1-203.84.204.254
add action=accept chain=input comment="Anti-Netcut" disabled=no dst-port=’ 0-65535 protocol=tcp
src-address=69.63.176.1-69.63.176.254
add action=accept chain=input comment="Anti-Netcut" disabled=no dst-port=’ 0-65535 protocol=tcp
src-address=69.63.181.1-69.63.181.254
add action=accept chain=input comment="Anti-Netcut" disabled=no dst-port=’ 0-65535 protocol=tcp
src-address=63.245.209.1-63.245.209.254
add action=accept chain=input comment="Anti-Netcut" disabled=no dst-port=’ 0-65535 protocol=tcp
src-address=63.245.213.1-63.245.213.254

Versi laen anti net cut for mikocok:

/ip firewall filter

add action=add-src-to-address-list address-list=DDOS address-list-timeout=15s \ chain=input

comment=”" disabled=no dst-port=1337 protocol=tcp

add action=add-src-to-address-list address-list=DDOS address-list-timeout=15m \ chain=input

comment=”" disabled=no dst-port=7331 protocol=tcp src-address-list=knock
add action=add-src-to-address-list address-list=”port scanners” address-list-timeout=2w \
chain=input comment=”Port scanners to list ” disabled=no protocol=tcp psd=21,3s,3,1

add action=add-src-to-address-list address-list=”port scanners” address-list-timeout=2w \

chain=input comment=”SYN/FIN scan” disabled=no protocol=tcp tcp-flags=fin,syn

add action=add-src-to-address-list address-list=”port scanners” address-list-timeout=2w \

chain=input comment=”SYN/RST scan” disabled=no protocol=tcp tcp-flags=syn,rst

add action=add-src-to-address-list address-list=”port scanners” address-list-timeout=2w \

chain=input  disabled=no tcp-flags=fin,psh,urg,!syn,!rst,!ack protocol=tcp \
comment=”FIN/PSH/URG scan”

add action=add-src-to-address-list address-list=”port scanners” address-list-timeout=2w \

chain=input disabled=no protocol=tcp tcp-flags=fin,syn,rst,psh,ack,urg \
comment=”ALL/ALL scan”

add action=add-src-to-address-list address-list=”port scanners” address-list-timeout=2w \

chain=input  tcp-flags=!fin,!syn,!rst,!psh,!ack,!urg comment=”NMAP NULL scan” \
disabled=no protocol=tcp

add action=add-src-to-address-list address-list=”port scanners” address-list-timeout=2w \

chain=input comment=”NMAP FIN Stealth scan” disabled=no protocol=tcp

add action=accept chain=input comment=”ANTI NETCUT” disabled=no dst-port=0-65535 \

protocol=tcp src-address=61.213.183.1-61.213.183.254

add action=accept chain=input comment=”ANTI NETCUT” disabled=no dst-port=0-65535 \

protocol=tcp src-address=67.195.134.1-67.195.134.254

add action=accept chain=input comment=”ANTI NETCUT” disabled=no dst-port=0-65535 \

protocol=tcp src-address=68.142.233.1-68.142.233.254

add action=accept chain=input comment=”ANTI NETCUT” disabled=no dst-port=0-65535 \

protocol=tcp src-address=68.180.217.1-68.180.217.254

add action=accept chain=input comment=”ANTI NETCUT” disabled=no dst-port=0-65535 \

protocol=tcp src-address=203.84.204.1-203.84.204.254

add action=accept chain=input comment=”ANTI NETCUT” disabled=no dst-port=0-65535 \

protocol=tcp src-address=69.63.176.1-69.63.176.254

add action=accept chain=input comment=”ANTI NETCUT” disabled=no dst-port=0-65535 \

protocol=tcp src-address=69.63.181.1-69.63.181.254

add action=accept chain=input comment=”ANTI NETCUT” disabled=no dst-port=0-65535 \

protocol=tcp src-address=63.245.209.1-63.245.209.254

add action=accept chain=input comment=”ANTI NETCUT” disabled=no dst-port=0-65535 \

protocol=tcp src-address=63.245.213.1-63.245.213.254

thanks for ANDRI SUWIGNYO