Block DHCP over EoIP Tunnel.

RouterOS General
1

I have a problem with DHCP & EoIP that try as I may I cannot resolve.

I have two sites connected remotely via EoIP.

The interfaces are exactly the same as below for both sites.

ether1 (serves the ip address of the router and the ethernet port that the clients connect to)
ether2 (serves as a bridge for pppoe-out1, default internet connectivity for the router)
ether3 (serves as a bridge for pppoe-out2, intra-site connectivity for the router)
pppoe-out1 (serves default internet ip connectivity for the router)
pppoe-out2 (serves intra-site ip connectivity for the router)
pptp-in1 (pptp server in for intra-site ip connectivity between the routers)
eoip-tunnel1 (tunnel between sites)
bridge1 (bridge for ether1 & eoip-tunnel1)

&

ether1 (serves the ip address of the router and the ethernet port that the clients connect to)
ether2 (serves as a bridge for pppoe-out1, default internet connectivity for the router)
ether3 (serves as a bridge for pppoe-out2, intra-site connectivity for the router)
pppoe-out1 (serves default internet ip connectivity for the router)
pppoe-out2 (serves intra-site ip connectivity for the router)
pptp-out1 (pptp client out for intra-site ip connectivity between the routers)
eoip-tunnel1 (tunnel between sites)
bridge1 (bridge for ether1 & eoip-tunnel1)

The common IP network for the sites is 192.168.0.0/24
To make it simple each site must have its own DHCP server each with a pool,
pool for site 1 = 192.168.0.1-192.168.0.126
pool for site 2 = 192.168.0.127-192.168.0.254
If the DHCP server is not on bridge1 it does not work (obviously.)

I have tried nearly every firewall rule imaginable to block the DHCP from the tunnel in an attempt to segregate the 2 DHCP server at each site with no success. Obviously UDP 67 & 68.

Any assistance would be greatly appreciated.

2

Assuming this is RouterOS version 3.x, IP traffic passing through Bridge does not normally go through IP firewall rules unless you enable that in the Bridge options.

Your DHCP server setup seems flawed to me though. Why are you bridging the sites? Why not route them?

3

The reason I bridged and not routed was that both sites had windows workgroup servers that needed to be seen from either side. It seemed easier just to let them type in UNC’s and browse that way. Thanks for the help, as I’m sure enabling the bridge settings to use the ip firewall will work.