Well, you have a pretty much sane (largely default) configuration, it is just a matter to learn a few things as also your intended final configuration (per anav’s post) is pretty much standard.
You now have:
- a single ethernet port (ether1) self-standing and added as WAN to the interface list
- a bridge interface (think of it as a dumb switch, it can be considered a meta-interface containing physical ports) grouping together the other 4 ethernet ports marked as LAN in the interface list
This is the default and replicates how most common routers work, a single port connected to “outside” and all the other in a switch (often the physical ports are blue for the WAN and yellow for the LAN).
From your posted config:
/interface bridge
add admin-mac=18:FD:74:56:2B:6D auto-mac=no comment=defconf name=bridge
...
/interface bridge port
add bridge=bridge comment=defconf interface=ether2
add bridge=bridge comment=defconf interface=ether3
add bridge=bridge comment=defconf interface=ether4
add bridge=bridge comment=defconf interface=ether5
You have two configured interface lists and the two (for the moment) interfaces assigned to them:
/interface list
add comment=defconf name=WAN
add comment=defconf name=LAN
...
/interface list member
add comment=defconf interface=bridge list=LAN
add comment=defconf interface=ether1 list=WAN
Configuring a Mikrotik router can be done both by CLI and GUI, it largely depends on what one finds more familiar with, in any case, knowing a few basic CLI commands like export and print allows to better communicate on the forum and to check what has been done in GUI, 99.999% of things can be done in GUI (only dome new-new features may be initially accessible only from CLI, but you won’t need them).
You need to remove two interfaces, ether2 and ether3 from the bridge and then assign them to interface list LAN.
The assign to them the two addresses you already assigned, respectively, to ether1 and to the bridge, for the moment disable the IP addresses you have (as opposed to removing them):
This:
/interface list member
add comment=defconf interface=bridge list=LAN
add comment=defconf interface=ether1 list=WAN
/ip address
add address=192.168.0.222/24 comment=defconf interface=bridge network=\
192.168.0.0
add address=192.168.1.222/24 interface=ether1 network=192.168.1.0
should become:
/interface list member
add comment=defconf interface=bridge list=LAN
add comment=defconf interface=ether1 list=WAN
add comment=myconf interface=ether2 list=LAN
add comment=myconf interface=ether3 list=LAN
/ip address
add address=192.168.0.222/24 disabled=yes comment=defconf interface=bridge network=192.168.0.0
add address=192.168.1.222/24 disabled=yes interface=ether1 network=192.168.1.0
add address=192.168.0.222/24 comment=myconf interface=ether2 network=192.168.0.0
add address=192.168.1.222/24 comment=myconf interface=ether3 network=192.168.1.0
To disable an interface in CLI, use the command print to get the number of the interface, then issue command disable , in GUI you use the red cross (easier).
Now your current firewall rules, if you check them you will see that they are grouped into two groups, one with chain input and one with chain forward:
The ones in chain input should not be touched for the moment
/ip firewall filter
add action=accept chain=input comment="defconf: accept established,related,untracked" connection-state=established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=invalid
add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp
add action=accept chain=input comment="defconf: accept to local loopback (for CAPsMAN)" dst-address=127.0.0.1
add action=drop chain=input comment="defconf: drop all not coming from LAN" in-interface-list=!LAN
------------------------------------------------------------------------------------------------------------------------------
add action=accept chain=forward comment="defconf: accept in ipsec policy" ipsec-policy=in,ipsec
add action=accept chain=forward comment="defconf: accept out ipsec policy" ipsec-policy=out,ipsec
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" connection-state=established,related
add action=accept chain=forward comment="defconf: accept established,related, untracked" connection-state=established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" connection-state=invalid
add action=drop chain=forward comment="defconf: drop all from WAN not DSTNATed" connection-nat-state=!dstnat connection-state=new in-interface-list=WAN
The ones in forward need to have a few changes, as a general rule for a beginner, in case a rule should be removed, I would not delete any existing firewall rule with comment “defconf”, but rather disable them if not needed.
anav’s suggesterd rules, commented:
add action=fasttrack-connection chain=forward connection-state=established,related > ← already present in defconf
add action=accept chain=forward connection-state=established,related,untracked > ← already present in defconf
add action=drop chain=forward connection-state=invalid > ← already present in defconf
add action=accept chain=forward comment=“internet traffic” in-interface-list=LAN out-interface-list=WAN src-address=!SubnetB ← this will later provide access to internet only to LAN A
add action=accept chain=forward comment=“usersA to usersB” in-interface=ether2 src-address=subnetA out-interface=ether3 dst-address=subnetB ← this is the key rule that allows LAN A to talk to LAN B
add action=accept chain=forward comment=“port forwarding” connection-nat-state=dstnat ← this and the following rule should replace the last two rules in defconf
add action=drop chain=forward comment=“Drop all else” ← see above, the logic is “inverted”, instead of dropping not dstnatted, here we forward dstnatted and then drop everything else
In the above SubnetB should be replaced by 192.168.1.0 and subnetA by 192.168.0.0
See if you can “digest” and understand the above, if you have questions or doubts ask them, then we will go to next steps.
Even if we later change idea/topology, trying to make the above changes will be anyway an useful exercise to make you more familiar with ROS.
.
