Dear Experts,
Hope every one are good in health in this pandemic.
I have a situation in my network I want to restrict some people to use the Printer which is in same network.
Like, the user ip 192.168.10.11 and the printer IP is 192.168.10.18 and want to restrict printer connection for the user.
Any help, thanks in advance.
As printer and computers communicate directly so they bypass router therefore you have no control over it but I do it this way…
change IP of a printer to the new one.
The old one assign to the router and make DST NAT the old to the new IP.
All printers will pass the traffic to the router which will pass it to the printer … voila … but …
all computers have to communicate with printer explicite by IP+port not by the name or “special custom printer port” which they resolve to the current IP or even MAC address. To be sure you can connect a printer directly to the router to a port which is not a part of a switch where computers are connected to remove it from L2 domain and avoid scanning LAN at MAC level for it.
Thanks for your reply. let me test your tricks but I am a novice in Mikrotik.
I would do it differently.
A. put printer on its own vlan or subnet (aka B)
B. create a firewall rule and firewall address list that identifies those without access. (blocked_users)
add forward chain rule allow source-address=subnetA destination-address=IP of printer source-address-list**=!**blocked _users
There are a couple ways but first I need to know if you have a way to connect the printer directly to the router, or if the printer is connected to a switch tha can use VLANs
Yes my printer is directly connected to a LAN port of Mikrotik, and dhcp enabled.
If not currently using vlans, no need just assign a different subnet to the port and the printer IP pool of one LOL, and simply ensure the forward firewall filter rules are setup properly.
I tried to fix it by assigning the printer to different subnet / ip pool. like 192.168.11.2.
Now ping is blocked but still printer working & its printing.
Any help??
Plz see my router config
# aug/31/2020 15:42:08 by RouterOS 6.45.6
# software id = *********
#
# model = RB450Gx4
# serial number = **********
/interface bridge
add fast-forward=no name=bridge1_LAN
/interface ethernet
set [ find default-name=ether1 ] name=ether1_WAN speed=100Mbps
set [ find default-name=ether2 ] speed=100Mbps
set [ find default-name=ether3 ] speed=100Mbps
set [ find default-name=ether4 ] speed=100Mbps
set [ find default-name=ether5 ] poe-out=off speed=100Mbps
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
/ip pool
add name=dhcp_pool0 ranges=192.168.10.20-192.168.10.254
/ip dhcp-server
add address-pool=dhcp_pool0 disabled=no interface=bridge1_LAN lease-time=\
10h10m name=dhcp1
/interface bridge port
add bridge=bridge1_LAN interface=ether5
add bridge=bridge1_LAN interface=ether4
add bridge=bridge1_LAN interface=ether3
add bridge=bridge1_LAN interface=ether2
/interface bridge settings
set use-ip-firewall=yes use-ip-firewall-for-vlan=yes
/ip address
add address=114.*.*.*/27 interface=ether1_WAN network=114.*.*.*
add address=192.168.10.1/24 interface=bridge1_LAN network=192.168.10.0
add address=192.168.11.1/30 interface=bridge1_LAN network=192.168.11.0
/ip dhcp-server network
add address=192.168.10.0/24 gateway=192.168.10.1
/ip firewall filter
add action=drop chain=forward connection-state="" dst-address=192.168.11.2 \
src-address=192.168.10.237
/ip service
set telnet disabled=yes
set ftp disabled=yes
set ssh disabled=yes
set api disabled=yes
set api-ssl disabled=yes
/ip traffic-flow
set enabled=yes interfaces=bridge1_LAN
This config has serious problems, first of all no firewall rules to speak of and thus should not be connected to the internet.
I dont see any vlans assigned and found it bizarre that there is a firewall rule addition for vlans????
By the way curious which port is assigned to the printer?
What is the purpose of the single firewall rule you do have?
# aug/31/2020 15:42:08 by RouterOS 6.45.6
/interface bridge
add fast-forward=no name=bridge1_LAN
/interface ethernet
set [ find default-name=ether1 ] name=ether1_WAN speed=100Mbps
set [ find default-name=ether2 ] speed=100Mbps
set [ find default-name=ether3 ] speed=100Mbps
set [ find default-name=ether4 ] speed=100Mbps
set [ find default-name=ether5 ] poe-out=off speed=100Mbps
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
/ip pool
add name=dhcp_pool0 ranges=192.168.10.20-192.168.10.254
IP POOL FOR SECOND SUBNET required
/ip dhcp-server
add address-pool=dhcp_pool0 disabled=no interface=bridge1_LAN lease-time=
10h10m name=dhcp1
IP DHCP-SERVER for second subnet required
/interface bridge port
add bridge=bridge1_LAN interface=ether5
add bridge=bridge1_LAN interface=ether4
add bridge=bridge1_LAN interface=ether3
add bridge=bridge1_LAN interface=ether2
/interface bridge settings
set use-ip-firewall=yes use-ip-firewall-for-vlan=yes
WHY??? You dont have any vlans AND recommend using only normal firewall rules
/ip address
add address=114.../27 interface=ether1_WAN network=114...
add address=192.168.10.1/24 interface=bridge1_LAN network=192.168.10.0
add address=192.168.11.1/30 interface=bridge1_LAN network=192.168.11.0
/ip dhcp-server network
add address=192.168.10.0/24 gateway=192.168.10.1
IP DCHP_SERVER Network for second subnet required.
/ip firewall filter
add action=drop chain=forward connection-state="" dst-address=192.168.11.2
src-address=192.168.10.237
IF THESE ARE YOUR ONLY firewall rules, dont connect to the internet your router is not safe and who the heck configured the router in this way???
/ip service
set telnet disabled=yes
set ftp disabled=yes
set ssh disabled=yes
set api disabled=yes
set api-ssl disabled=yes
/ip traffic-flow
set enabled=yes interfaces=bridge1_LAN
Thanks anav, for your elaborating reply. Actually I am a newbie in mikrotik configuration. In response to your ques:
//By the way curious which port is assigned to the printer?
ETH2
//What is the purpose of the single firewall rule you do have?
This single rule to restrict the printer to the IP
Brother I will be very glad to you, if you advice the codes that could secure & complete my router config and also the printer issue.
# sep/01/2020 10:01:17 by RouterOS 6.45.6
# software id = *****
#
# model = RB450Gx4
# serial number = *****
/interface bridge
add fast-forward=no name=bridge1_LAN
/interface ethernet
set [ find default-name=ether1 ] name=ether1_WAN speed=100Mbps
set [ find default-name=ether2 ] speed=100Mbps
set [ find default-name=ether3 ] speed=100Mbps
set [ find default-name=ether4 ] speed=100Mbps
set [ find default-name=ether5 ] poe-out=off speed=100Mbps
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
/ip pool
add name=dhcp_pool0 ranges=192.168.10.20-192.168.10.254
/ip dhcp-server
add address-pool=dhcp_pool0 disabled=no interface=bridge1_LAN lease-time=\
10h10m name=dhcp1
/interface bridge port
add bridge=bridge1_LAN interface=ether5
add bridge=bridge1_LAN interface=ether4
add bridge=bridge1_LAN interface=ether3
add bridge=bridge1_LAN interface=ether2
/interface bridge settings
set use-ip-firewall-for-vlan=yes
/ip address
add address=114.*****/27 interface=ether1_WAN network=114.*****
add address=192.168.10.1/24 interface=bridge1_LAN network=192.168.10.0
add address=192.168.11.1/30 interface=bridge1_LAN network=192.168.11.0
/ip dhcp-server network
add address=192.168.10.0/24 gateway=192.168.10.1
/ip dns
set servers=203.112.72.5,8.8.8.8
/ip firewall filter
add action=drop chain=forward connection-state="" dst-address=192.168.11.2 \
src-address=192.168.10.237
/ip route
add distance=1 gateway=114.*****
/ip service
set telnet disabled=yes
set ftp disabled=yes
set ssh disabled=yes
set api disabled=yes
set api-ssl disabled=yes
/ip traffic-flow
set enabled=yes interfaces=bridge1_LAN