Allowing 1 way traffic between bridges

semperfi89 · February 21, 2011, 3:58pm

Ok, I’ve got the following bridge’s setup;

12 R LAN_Bridge bridge 1500 1524
13 R Kids_Bridge bridge 1500 65535
14 R Guest_Bridge bridge 1500 65535
15 R Phone_Bridge bridge 1500 1524
16 R WAN_Bridge bridge 1500 65535

I need to allow all traffic from the LAN_Bridge to all other bridges, but I want to block all traffic starting at all other bridges to all other bridges. I also want them to have internet access (via ether1).

I’ve got everything up and running except the blocking, right now anybody on any bridge can get to any IP on any other bridge.

My second problem is that when I put ether1 into the Wan_bridge I lose all internet traffic. It doesn’t matter if I put the DHCP client on the bridge or the port.. (The reason I want to put ether1 into the wan_bridge is sometimes I have the need to setup another device which requires a public IP, and I want to have another wan port avail so I don’t have to put a switch infront of the RB.)

If you need any additional info I’ll provide.

nhickman · February 22, 2011, 2:34pm

I’ll take a stab at it, but you need to add some filter rules to /ip firewall.

/ip firewall filter
add action=drop chain=forward comment="Deny forwarding from Kids_Bridge" in-interface=Kids_Bridge out-interface=!ether1
add action=drop chain=forward comment="Deny forwarding from Guest_Bridge" in-interface=Guest_Bridge out-interface=!ether1
add action=drop chain=forward comment="Deny forwarding from Phone_Bridge" in-interface=Phone_Bridge out-interface=!ether1
add action=drop chain=forward comment="Deny forwarding from WAN_Bridge" in-interface=WAN_Bridge out-interface=!ether1
add action=allow chain=forward comment="Allow forwarding from LAN_Bridge" in-interface=LAN_Bridge

This may be incorrect since it’s a stab in the dark. If you could provide some exports of your config it would be much more helpful to understand your setup.

These would help..
/interface ethernet export
/interface bridge export
/ip firewall nat export
/ip firewall filter export

Remove any software ID’s from configs you provide.

Ibersystems · February 22, 2011, 9:37pm

to block, play with bridge/filter. you have to activate “use firewall” in bridge

semperfi89 · February 22, 2011, 11:41pm

I’m looking for somemore detailed help, I’ve already read the wiki’s as suggested by support but I still can’t figure it out. Some examples would be nice

Thanks

Ibersystems · February 23, 2011, 8:41am

some examples:

/interface bridge filter
add action=accept chain=forward comment="ACCEPT 192.168.0.238" disabled=no dst-address=0.0.0.0/0 in-interface=wlan1 mac-protocol=ip out-interface=ether1 src-address=192.168.0.238/32
add action=accept chain=forward comment="ACCEPT 192.168.0.239" disabled=no dst-address=0.0.0.0/0 in-interface=wlan1 mac-protocol=ip out-interface=ether1 src-address=192.168.0.239/32
add action=accept chain=forward comment="ACCEPT 192.168.0.240" disabled=no dst-address=0.0.0.0/0 in-interface=wlan1 mac-protocol=ip out-interface=ether1 src-address=192.168.0.240/32
add action=drop chain=forward comment="##############BLOCK 192.168.0.0" disabled=no dst-address=0.0.0.0/0 in-interface=wlan1 mac-protocol=ip out-interface=ether1 src-address=192.168.0.0/24
add action=accept chain=forward comment="ACCEPT 192.168.1.251" disabled=no dst-address=0.0.0.0/0 in-interface=wlan1 mac-protocol=ip out-interface=ether1 src-address=192.168.1.251/32
add action=drop chain=forward comment="##############BLOCK 192.168.1.0" disabled=no dst-address=0.0.0.0/0 in-interface=wlan1 mac-protocol=ip out-interface=ether1 src-address=192.168.1.0/24
add action=accept chain=forward comment="ACCEPT 192.168.23.4" disabled=no dst-address=0.0.0.0/0 in-interface=wlan1 mac-protocol=ip out-interface=ether1 src-address=192.168.23.4/32
add action=accept chain=forward comment="ACCEPT 192.168.23.6" disabled=no dst-address=0.0.0.0/0 in-interface=wlan1 mac-protocol=ip out-interface=ether1 src-address=192.168.23.6/32
add action=drop chain=forward comment="##############BLOCK 192.168.23.0" disabled=no dst-address=0.0.0.0/0 in-interface=wlan1 mac-protocol=ip out-interface=ether1 src-address=192.168.23.0/24

semperfi89 · February 24, 2011, 2:21am

@nhickman I’ve already tried that approch, it works for blocking but not the allow.

@Ibersystems I tried your rules (I think I did them right) but they don’t even block.

LAN_Bridge=192.168.5.0/24 on ether2-6 and wlan1
Kids_Bridge=172.16.5.0/24 on wlan2
Phone_Bridge=172.16.0.0/24 on ether7&8
Guest_Bridge=172.16.1.0/24 on wlan3
Wan IP is on WAN_Bridge and is DHCP, cable modem is plugged into ether1, and ether9 also on WAN_Bridge for other devices that need public IP.

Ok, here is the config.

/interface ethernet export

# feb/23/2011 21:10:47 by RouterOS 5.0rc10
# software id = U3ZG-M7DC
#
/interface ethernet
set 0 arp=enabled auto-negotiation=yes bandwidth=unlimited/unlimited disabled=no \
    full-duplex=yes l2mtu=1524 mac-address=00:0C:42:A8:BD:FA master-port=none mtu=1500 \
    name=ether1 speed=1Gbps
set 1 arp=enabled auto-negotiation=yes bandwidth=unlimited/unlimited disabled=no \
    full-duplex=yes l2mtu=1524 mac-address=00:0C:42:A8:BD:FB master-port=none mtu=1500 \
    name=ether2 speed=1Gbps
set 2 arp=enabled auto-negotiation=yes bandwidth=unlimited/unlimited disabled=no \
    full-duplex=yes l2mtu=1524 mac-address=00:0C:42:A8:BD:FC master-port=none mtu=1500 \
    name=ether3 speed=1Gbps
set 3 arp=enabled auto-negotiation=yes bandwidth=unlimited/unlimited disabled=no \
    full-duplex=yes l2mtu=1524 mac-address=00:0C:42:A8:BD:FD master-port=none mtu=1500 \
    name=ether4 speed=1Gbps
set 4 arp=enabled auto-negotiation=yes bandwidth=unlimited/unlimited disabled=no \
    full-duplex=yes l2mtu=1524 mac-address=00:0C:42:A8:BD:FE master-port=none mtu=1500 \
    name=ether5 speed=1Gbps
set 5 arp=enabled auto-negotiation=yes bandwidth=unlimited/unlimited disabled=no \
    full-duplex=yes l2mtu=1524 mac-address=00:0C:42:A8:BD:FF master-port=none mtu=1500 \
    name=ether6 speed=1Gbps
set 6 arp=enabled auto-negotiation=yes bandwidth=unlimited/unlimited disabled=no \
    full-duplex=yes l2mtu=1524 mac-address=00:0C:42:A8:BE:00 master-port=none mtu=1500 \
    name=ether7 speed=1Gbps
set 7 arp=enabled auto-negotiation=yes bandwidth=unlimited/unlimited disabled=no \
    full-duplex=yes l2mtu=1524 mac-address=00:0C:42:A8:BE:01 master-port=none mtu=1500 \
    name=ether8 speed=1Gbps
set 8 arp=enabled auto-negotiation=yes bandwidth=unlimited/unlimited disabled=no \
    full-duplex=yes l2mtu=1524 mac-address=00:0C:42:A8:BE:02 master-port=none mtu=1500 \
    name=ether9 speed=1Gbps
/interface ethernet switch
set switch1 mirror-source=none mirror-target=none name=switch1
set switch2 mirror-source=none mirror-target=none name=switch2
/interface ethernet switch port
set cpu vlan-header=leave-as-is vlan-mode=fallback
set ether1 vlan-header=leave-as-is vlan-mode=fallback
set ether2 vlan-header=leave-as-is vlan-mode=fallback
set ether3 vlan-header=leave-as-is vlan-mode=fallback
set ether4 vlan-header=leave-as-is vlan-mode=fallback
set ether5 vlan-header=leave-as-is vlan-mode=fallback
set ether6 vlan-header=leave-as-is vlan-mode=fallback
set ether7 vlan-header=leave-as-is vlan-mode=fallback
set ether8 vlan-header=leave-as-is vlan-mode=fallback
set ether9 vlan-header=leave-as-is vlan-mode=fallback

/interface bridge export

# feb/23/2011 21:11:05 by RouterOS 5.0rc10
# software id = U3ZG-M7DC
#
/interface bridge
add admin-mac=00:00:00:00:00:00 ageing-time=5m arp=enabled auto-mac=yes disabled=no \
    forward-delay=15s l2mtu=1524 max-message-age=20s mtu=1500 name=LAN_Bridge priority=\
    0x8000 protocol-mode=none transmit-hold-count=6
add admin-mac=00:00:00:00:00:00 ageing-time=5m arp=enabled auto-mac=yes disabled=no \
    forward-delay=15s l2mtu=2290 max-message-age=20s mtu=1500 name=Kids_Bridge priority=\
    0x8000 protocol-mode=none transmit-hold-count=6
add admin-mac=00:00:00:00:00:00 ageing-time=5m arp=enabled auto-mac=yes disabled=no \
    forward-delay=15s l2mtu=65535 max-message-age=20s mtu=1500 name=Guest_Bridge priority=\
    0x8000 protocol-mode=none transmit-hold-count=6
add admin-mac=00:00:00:00:00:00 ageing-time=5m arp=enabled auto-mac=yes disabled=no \
    forward-delay=15s l2mtu=1524 max-message-age=20s mtu=1500 name=Phone_Bridge priority=\
    0x8000 protocol-mode=none transmit-hold-count=6
add admin-mac=00:00:00:00:00:00 ageing-time=5m arp=enabled auto-mac=yes disabled=no \
    forward-delay=15s l2mtu=1524 max-message-age=20s mtu=1500 name=WAN_Bridge priority=\
    0x8000 protocol-mode=none transmit-hold-count=6
/interface bridge filter
add action=accept chain=forward disabled=no dst-address=172.16.5.0/24 in-interface=ether2 \
    mac-protocol=ip out-interface=wlan2 src-address=192.168.5.0/24
add action=drop chain=forward comment="##############BLOCK Kids-LAN" disabled=no \
    dst-address=192.168.5.0/24 in-interface=wlan2 mac-protocol=ip out-interface=ether2 \
    src-address=172.16.5.0/24
/interface bridge port
add bridge=LAN_Bridge disabled=no edge=auto external-fdb=auto horizon=none interface=\
    ether2 path-cost=10 point-to-point=auto priority=0x80
add bridge=LAN_Bridge disabled=no edge=auto external-fdb=auto horizon=none interface=\
    ether3 path-cost=10 point-to-point=auto priority=0x80
add bridge=LAN_Bridge disabled=no edge=auto external-fdb=auto horizon=none interface=\
    ether4 path-cost=10 point-to-point=auto priority=0x80
add bridge=LAN_Bridge disabled=no edge=auto external-fdb=auto horizon=none interface=\
    ether5 path-cost=10 point-to-point=auto priority=0x80
add bridge=LAN_Bridge disabled=no edge=auto external-fdb=auto horizon=none interface=wlan1 \
    path-cost=10 point-to-point=auto priority=0x80
add bridge=LAN_Bridge disabled=no edge=auto external-fdb=auto horizon=none interface=\
    ether6 path-cost=10 point-to-point=auto priority=0x80
add bridge=WAN_Bridge disabled=no edge=auto external-fdb=auto horizon=none interface=\
    ether9 path-cost=10 point-to-point=auto priority=0x80
add bridge=Kids_Bridge disabled=no edge=auto external-fdb=auto horizon=none interface=\
    wlan2 path-cost=10 point-to-point=auto priority=0x80
add bridge=Guest_Bridge disabled=no edge=auto external-fdb=auto horizon=none interface=\
    wlan3 path-cost=10 point-to-point=auto priority=0x80
add bridge=Phone_Bridge disabled=no edge=auto external-fdb=auto horizon=none interface=\
    ether7 path-cost=10 point-to-point=auto priority=0x80
add bridge=Phone_Bridge disabled=no edge=auto external-fdb=auto horizon=none interface=\
    ether8 path-cost=10 point-to-point=auto priority=0x80
add bridge=WAN_Bridge disabled=no edge=auto external-fdb=auto horizon=none interface=\
    ether1 path-cost=10 point-to-point=auto priority=0x80
/interface bridge settings
set use-ip-firewall=yes use-ip-firewall-for-pppoe=no use-ip-firewall-for-vlan=no

/ip firewall nat export

# feb/23/2011 21:11:13 by RouterOS 5.0rc10
# software id = U3ZG-M7DC
#
/ip firewall nat
add action=masquerade chain=srcnat comment="Added by webbox" disabled=no out-interface=\
    WAN_Bridge
add action=dst-nat chain=dstnat comment="Remote Desktop to VirtualHost" disabled=no \
    dst-port=3389 protocol=tcp to-addresses=192.168.5.20 to-ports=3389
add action=dst-nat chain=dstnat comment="Only allow inbound SMTP traffic from POSTINI" \
    disabled=no dst-port=25 in-interface=WAN_Bridge protocol=tcp src-address-list=Postini \
    to-addresses=192.168.5.23 to-ports=25
add action=dst-nat chain=dstnat comment="Mail Server" disabled=no dst-port=80,443,993 \
    in-interface=WAN_Bridge protocol=tcp to-addresses=192.168.5.23 to-ports=0-65535
add action=dst-nat chain=dstnat comment="Mail Server (Hairpin NAT)" disabled=no \
    dst-address-type=local dst-port=80,443,993 in-interface=LAN_Bridge protocol=tcp \
    to-addresses=192.168.5.23 to-ports=0-65535
add action=dst-nat chain=dstnat comment=Vipre disabled=no dst-port=18082,18086,18087,1433 \
    in-interface=WAN_Bridge protocol=tcp to-addresses=192.168.5.2 to-ports=0-65535
add action=dst-nat chain=dstnat comment="Vipre (Hairpin NAT)" disabled=no \
    dst-address-type=local dst-port=18082,18086,18087,1433 in-interface=LAN_Bridge \
    protocol=tcp to-addresses=192.168.5.2 to-ports=0-65535
add action=dst-nat chain=dstnat comment=Utorrent disabled=no dst-port=6000 in-interface=\
    WAN_Bridge protocol=tcp to-addresses=192.168.5.25 to-ports=6000
add action=dst-nat chain=dstnat comment="Utorrent (Hairpin NAT)" disabled=no \
    dst-address-type=local dst-port=6000 in-interface=LAN_Bridge protocol=tcp \
    to-addresses=192.168.5.25 to-ports=6000

/ip firewall filter export

# feb/23/2011 21:11:21 by RouterOS 5.0rc10
# software id = U3ZG-M7DC
#
/ip firewall filter
add action=drop chain=input comment="Drop All Traffic From China" disabled=no \
    src-address-list=Drop_All_List
add action=accept chain=input comment="Accept established connections" connection-state=\
    established disabled=no in-interface=WAN_Bridge
add action=accept chain=input comment="Accept related connections" connection-state=\
    related disabled=no in-interface=WAN_Bridge
add action=drop chain=input comment="Drop invalid connections" connection-state=invalid \
    disabled=no in-interface=WAN_Bridge
add action=accept chain=input comment=UDP disabled=no in-interface=WAN_Bridge protocol=udp
add action=accept chain=einput comment="SSH for secure shell" disabled=no dst-port=22 \
    in-interface=WAN_Bridge protocol=tcp
add action=drop chain=input comment="Drop Winbox from Guest_Bridge" disabled=no dst-port=\
    8291 in-interface=Guest_Bridge protocol=tcp
add action=drop chain=input comment="Drop Winbox from Kids_Bridge" disabled=no dst-port=\
    8291 in-interface=Kids_Bridge protocol=tcp
add action=drop chain=input comment="Drop Winbox from Phone_Bridge" disabled=no dst-port=\
    8291 in-interface=Phone_Bridge protocol=tcp
add action=accept chain=input comment="Allow Winbox from WAN" disabled=no dst-port=8291 \
    in-interface=WAN_Bridge protocol=tcp
add action=accept chain=input comment="Allow limited pings" disabled=no in-interface=\
    WAN_Bridge limit=50/5s,2 protocol=icmp
add action=accept chain=forward comment="Allow forwarding from LAN_Bridge" disabled=no \
    in-interface=LAN_Bridge
add action=drop chain=input comment="Drop excess pings" disabled=no in-interface=\
    WAN_Bridge protocol=icmp
add action=accept chain=input comment="PPTP Server: WAN" disabled=no in-interface=\
    WAN_Bridge protocol=gre
add action=accept chain=input comment="PPTP Server: WAN" disabled=no dst-port=1723 \
    in-interface=WAN_Bridge protocol=tcp
add action=accept chain=forward comment="Allow Mail Server's to Send SMTP" disabled=no \
    dst-port=25 in-interface=WAN_Bridge protocol=tcp src-address-list=Allow_SMTP_Out
add action=log chain=forward comment=\
    "Log all traffic that is attempting to send port 25 except 'Allow_SMTP_Out'" disabled=\
    no dst-port=25 in-interface=!WAN_Bridge log-prefix="SMTP Outbound" protocol=tcp \
    src-address-list=!Allow_SMTP_Out
add action=drop chain=forward comment="Drop All outbound SMTP traffic" disabled=no \
    dst-port=25 out-interface=WAN_Bridge protocol=tcp src-address-list=!Allow_SMTP_Out
add action=accept chain=forward comment=\
    "Allow Kids_Bridge internet from 8am - 10pm, Mon-Sat" disabled=no in-interface=\
    Kids_Bridge time=8h-22h,mon,tue,wed,thu,fri,sat
add action=accept chain=forward comment=\
    "Allow Kids_Bridge internet from 8am to 11:30am on Sun" disabled=no in-interface=\
    Kids_Bridge time=8h-11h30m,sun
add action=accept chain=forward comment=\
    "Allow Kids_Bridge internet from 4:30pm-8pm on Sun" disabled=no in-interface=\
    Kids_Bridge time=16h30m-22h,sun
add action=drop chain=forward comment="Block Kids_Bridge internet." disabled=no \
    in-interface=Kids_Bridge src-address-list="" src-mac-address=!00:00:00:00:00:00 time=\
    0s-1d,sun,mon,tue,wed,thu,fri,sat
add action=log chain=input comment="Log everything else" disabled=no in-interface=\
    WAN_Bridge log-prefix="DROP INPUT"
add action=drop chain=input comment="Drop everything else" disabled=no in-interface=\
    WAN_Bridge

nhickman · February 24, 2011, 3:40pm

This will probably take a while for you to get. My posts still have to be moderator approved.

The only thing I can think of is that with the rules I posted the traffic is being forwarded from LAN_Bridge to the others, but is being blocked on the return. Adding !LAN_Bridge on the out-interface would allow them to access your LAN which is not what you want. What you really want to block are just the new sessions from those bridge groups which you can add with “connection-state=new”.

Try this:

/ip firewall filter
add action=drop chain=forward comment="Deny forwarding from Kids_Bridge" in-interface=Kids_Bridge out-interface=!ether1 connection-state=new
add action=drop chain=forward comment="Deny forwarding from Guest_Bridge" in-interface=Guest_Bridge out-interface=!ether1 connection-state=new
add action=drop chain=forward comment="Deny forwarding from Phone_Bridge" in-interface=Phone_Bridge out-interface=!ether1 connection-state=new
add action=drop chain=forward comment="Deny forwarding from WAN_Bridge" in-interface=WAN_Bridge out-interface=!ether1 connection-state=new

You can probably drop the last LAN_Bridge statement since the default is to allow.

The only other alternative that I can think of is to do some connection-marking in the mangle table for packets sourced from LAN_Bridge then add a drop statement for traffic with no-mark or use the filters above and replace the “connection-state=new” with “connection-mark=no-mark”.

Let us know how it goes!

semperfi89 · February 27, 2011, 3:15pm

It’s been 4 days, does anybody have any ideas?

semperfi89 · March 3, 2011, 2:16pm

Well I guess since nobody’s posted anything then this must not be possible. So much for this being a better router then my old Sonicwall…

nhickman · March 8, 2011, 4:16pm

Did you not try the connection-state suggestion I posted?

/ip firewall filter
add action=drop chain=forward comment="Deny forwarding from Kids_Bridge" in-interface=Kids_Bridge out-interface=!ether1 connection-state=new
add action=drop chain=forward comment="Deny forwarding from Guest_Bridge" in-interface=Guest_Bridge out-interface=!ether1 connection-state=new
add action=drop chain=forward comment="Deny forwarding from Phone_Bridge" in-interface=Phone_Bridge out-interface=!ether1 connection-state=new
add action=drop chain=forward comment="Deny forwarding from WAN_Bridge" in-interface=WAN_Bridge out-interface=!ether1 connection-state=new

semperfi89 · March 9, 2011, 3:26pm

I didn’t even see that post, it must have been approved after I posted my comment, Sorry. But I did get it working. That apporch seems to be cleaner and I’ll have to see if it will work. But thanks for the post.

What I ended up doing was taken form “ibersystems” post, but I had to drop the interfaces from the rules to get it to work. (Thanks Mikrotik Support)

Here is the rules that worked for me…

add action=accept chain=forward comment="Allow Traffic from LAN to Kids" \
    disabled=no dst-address=172.16.5.0/24 src-address=192.168.5.0/24
add action=accept chain=forward comment=\
    "Accept established connections from Kids to LAN" connection-state=\
    established disabled=no dst-address=192.168.5.0/24 src-address=\
    172.16.5.0/24
add action=accept chain=forward comment=\
    "Accept Related connectons from Kids to LAN" connection-state=\
    related disabled=no dst-address=192.168.5.0/24 src-address=\
    172.16.5.0/24
add action=drop chain=forward comment="Drop Traffic from Kids to LAN" \
    disabled=no dst-address=192.168.5.0/24 src-address=172.16.5.0/24

You can copy these and change the IP’s to get them to work for other networks.

semperfi89 · March 9, 2011, 5:10pm

@nhickman

I just tried your rules and they worked with one change. I had to change the Out Interface from “ether1” to “WAN_Bridge” due to having my WAN Ip on the bridge not the interface.

Thank you for following up. I was able to reduce 12 rules down to 3 with this method.

nhickman · March 10, 2011, 1:31pm

Awesome! I’m glad it worked out for you!

I believe that is what happened. It took 2 days for my response to get approved so it was inserted before.

-Nick