2 Mikrotik with one dhcp server each on the same physical network

RB951G is connected to an ADSL network and is for private use and SXT LTE is connected to a 4G network and is for guest use.
RB951: eth1 is pppoe and eth2 has the dhcp server with 192.168.1.1/24.
SXT: lte1 is wan and eth1 has dhcp server 192.168.2.1/24.
The guests connect only via WiFi to 2 Ubiquiti unifi and 1 RB metal2.
I would like that the dhcp server on SXT serves only the requests that come from the 2 unifi and 1 rb metal, and that the dhcp on RB951 don’t serve the requests coming from this 3 antennas.
All the computers and antennas are connected with layer2 switches without the vlan support.

simply connect sxt , ubnt and metal on same switch,
and all the other remain in another switch.

That is not going to work. You need separate switches for your 2 networks or a single switch with VLAN support.

Yes this I know :slight_smile: but I would like to block dhcp to communicate with the 3 AP. Is it possible in Firewall?
If the request comes from the AP that the RB951 don’t accept it, so that the AP will try with with the other DHCP.

No, it is not possible to filter DHCP in the firewall that way.
Get a better switch or an extra switch, or re-wire the network so you have 2 different networks, one directly
on the router swith and one port connecting to the external switch for the other network.

example: bri-uno with inside ether1, ether2 and ether3
if you have “remote” dhcp server on ether2, you can make local DHCP valid on all bri-uno exit except ether2, and remotely on the device connected at the end of ether2 another DHCP (inside or not same 192.168.0.0/24, but with different pool, obviously)

YES, IS POSSIBLE TO BLOCK DHCP if ethernets are bridged:

on both sides:

/interface bridge settings
set use-ip-firewall=yes

/interface bridge filter
add action=drop chain=input in-interface=interface-name-inside-the-bridge-where-you-do-not-want-send-dhcp ip-protocol=udp mac-protocol=ip src-port=67-68
add action=drop chain=forward in-interface=interface-name-inside-the-bridge-where-you-do-not-want-send-dhcp ip-protocol=udp mac-protocol=ip src-port=67-68
add action=drop chain=input dst-port=67-68 in-interface=interface-name-inside-the-bridge-where-you-do-not-want-send-dhcp ip-protocol=udp mac-protocol=ip
add action=drop chain=forward dst-port=67-68 in-interface=interface-name-inside-the-bridge-where-you-do-not-want-send-dhcp ip-protocol=udp mac-protocol=ip
add action=drop chain=forward ip-protocol=udp mac-protocol=ip out-interface=interface-name-inside-the-bridge-where-you-do-not-want-send-dhcp src-port=67-68
add action=drop chain=output ip-protocol=udp mac-protocol=ip out-interface=interface-name-inside-the-bridge-where-you-do-not-want-send-dhcp src-port=67-68
add action=drop chain=forward dst-port=67-68 ip-protocol=udp mac-protocol=ip out-interface=interface-name-inside-the-bridge-where-you-do-not-want-send-dhcp
add action=drop chain=output dst-port=67-68 ip-protocol=udp mac-protocol=ip out-interface=interface-name-inside-the-bridge-where-you-do-not-want-send-dhcp

Yes you can filter what is forwarded through a bridge, but that is not what he has.
It is not possible (I think) to filter the input to the locally running DHCP server on a MikroTik router.
Furthermore, as far as I understand his APs are on an unmanaged switch.

At this point, I do not have one clear idea of what he have really…

Yes both Mikrotik are on unmanaged sw and are on the same physical network. I would like to filter DHCP requests coming from the 3 APs on RB951 and on SXT LTE to filter all the requests except that coming from the 3 APs.

Then change the network so they are no longer on the same physical network.

Ok, so I have to pull new cables and to double the switches… :frowning:
Best regard to all.

Or replace the switches by VLAN-capable switches.