Allow acces to specific interface based on IP and MAC

RouterOS Beginner Basics
1

Hello,

I want to implement a specific solution:

PORT1 connect to LAN device 192.168.1.1
PORT2 connect to LAN device 192.168.1.2 with MAC xx:xx:xx:xx:xx:xx and further client devices 192.168.1.3-1.254
PORT3 connect to LAN 192.168.2.x

All Clients on PORT2 192.168.1.2-192.168.1.254 should be able to access PORT1

Client 192.168.1.2 on PORT2 should be able to access PORT3 based on IP and MAC filtering (for example allow access to 192.168.2.20), all other clients on PORT2 should not be able to access PORT3

How can this be implemented with Mikrotik RB260GS?

2

What you describe cannot be achieved using RB260GS. Your device is a switch, not a router. And while it has some limited (up to 16 simple rules) MAC/IP-based filtering support, it is not suitable for bridging two different IP networks (192.168.1.x and 192.168.2.x in your case).

3

Ok, I understand, no routing. Is there a solution if PORT3 will be in the same subnet 192.168.1.x?

4

It should be possible for a small number of hosts (there’s a limit on the max. number of entries (rules) in the ACL).
I suggest you look through the documentation first, then ask specific questions here, if any.

5

Ok checked. Maybe a solution could be

  • Rule 1: drop all packets from PORT2
  • Rule 2: redirect all packets from PORT2 to PORT1, give this rule a higher priority than Rule 1
  • Rule 3: redirect all packets from PORT2 and IP 192.168.1.2 and MAC xx:xx:xx:xx:xx:xx to PORT3, give this rule a higher priority than Rule 1 and Rule 2

Is this right?

How I can configure a something like regex hosts 192.168.1.2-192.168.1.254? Can I work with placeholders?

6

You cannot really use placeholders, but you can specify IP/mask pair to refer to subnets instead of individual hosts. For instance, 192.168.1.128/25 will give you the 192.168.1.128-192.168.1.255 range, however the range that you gave as an example (192.168.1.2-192.168.1.254) cannot be represented this way.

7

To work with priorities the way I described ist possible?

The solution I described can be done? Or are there better solutions?