Block access from IP range (10.10.10.4-10.10.10.254) to an IP (10.10.10.3) or how to isolate clients in LAN subnet

[lotnybartek]

This one is connected with this thread:

http://forum.mikrotik.com/t/allow-only-one-ip-from-first-subnet-10-10-10-0-to-communicate-with-second-subnet-192-168-1-0/97180/1

So I have this restaurant PC (10.10.10.3)that I need to block access to it from other PCs in this very same subnet (10.10.10.0/24).

So: block access to 10.10.10.3 from 10.10.10.4-10.10.10.254

My Firewall looks like this (the important part I think)

OR

How to isolate clients on lan?

Kind Regards

Bart

[jarda]

Check the firewall on bridge level. Bridge horizon could be also the way.

[ZeroByte]

Bridge horizon, bridge firewall, and other layer2 (ethernet in this case) technologies are required to do what you want because inside of a given subnet, the hosts can just talk directly to each other without using the router. That being the case, an IP firewall cannot stop hosts in the subnet from talking directly to each other because they never hand the packets to the router.

If the server is connected directly to the Mikrotik on a switch port, then you have something to work with. Remove the server’s port from any hardware switching and add the port to the LAN bridge. Then you can create a bridge filter rule in the forward chain which will drop frames from being forwarded OUT the interface to the server. (The Mikrotik itself goes through the input / output chains, so this won’t block the Internet access for the host itself).

Split horizon can also do what you want, but it’s a broad approach - if you use split horizon, then all bridge ports will get isolated from each other, and not just from the server.

Another option is to put the server in a separate IP range and use the IP filter forward chain to block this traffic.

[nxs02]

@ZeroByte

Bridge horizon, bridge firewall, and other layer2 (ethernet in this case) technologies are required to do what you want because inside of a given subnet, the hosts can just talk directly to each other without using the router. That being the case, an IP firewall cannot stop hosts in the subnet from talking directly to each other because they never hand the packets to the router.

If the server is connected directly to the Mikrotik on a switch port, then you have something to work with. Remove the server’s port from any hardware switching and add the port to the LAN bridge. Then you can create a bridge filter rule in the forward chain which will drop frames from being forwarded OUT the interface to the server. (The Mikrotik itself goes through the input / output chains, so this won’t block the Internet access for the host itself).

Split horizon can also do what you want, but it’s a broad approach - if you use split horizon, then all bridge ports will get isolated from each other, and not just from the server.

Another option is to put the server in a separate IP range and use the IP filter forward chain to block this traffic.

ZeroByte solution is so complete