Community discussions

MikroTik App
 
jrhoades9989
just joined
Topic Author
Posts: 4
Joined: Tue Dec 21, 2010 8:43 am

Seperate VLans

Tue Mar 15, 2011 5:15 pm

Ok This is my setup
Vlan1-192.168.1.0/24
vlan2-192.168.2.0/24
vlan3-192.168.3.0/24

I have tested the vlan settings and all works correctly. My Issue is when I need to seperate all three vlans so that they can not talk to each other but still can get to the internet.
right now when I attempt to ping from 192.168.1.2 to 192.168.3.2 I get a reply. How can I block all traffic between the three networks.
 
fewi
Forum Guru
Forum Guru
Posts: 7717
Joined: Tue Aug 11, 2009 3:19 am

Re: Seperate VLans

Thu Mar 17, 2011 4:11 pm

You can either make specific rules:
/ip firewall filter
add chain=forward in-interface=Vlan1 out-interface=Vlan2 action=drop
add chain=forward in-interface=Vlan1 out-interface=Vlan3 action=drop
add chain=forward in-interface=Vlan2 out-interface=Vlan1 action=drop
add chain=forward in-interface=Vlan2 out-interface=Vlan3 action=drop
add chain=forward in-interface=Vlan3 out-interface=Vlan1 action=drop
add chain=forward in-interface=Vlan3 out-interface=Vlan2 action=drop
Or with just one assuming that all three VLANs are supposed to reach some other interface you can do this statefully and go for a default drop policy, which is a good idea anyway. Let's assume that interface connects to the Internet and is called WAN:
/ip firewall filter
add chain=forward connection-state=established action=accept
add chain=forward connection-state=related action=accept
add chain=forward connection-state=invalid action=drop
add chain=forward out-interface=WAN action=accept
add chain=forward action=drop
 
jrhoades9989
just joined
Topic Author
Posts: 4
Joined: Tue Dec 21, 2010 8:43 am

Re: Seperate VLans

Fri Mar 18, 2011 1:44 pm

Thank You for your reply the second rule as your suggested worked perfectly.

Who is online

Users browsing this forum: Amazon [Bot], GoogleOther [Bot], peracchi, syslog and 93 guests