on my cloud router i have set WAN to allow my LAN to go the internet, via Masquerading. The LAN network is 192.168.0.0/24, a dhcp address from the same cloud router: my question is i want drop traffic that is coming from 192.168.0.0/24 to 192.168.0.2 please help with solution, what i have done is not working, this what i have done “/ip firewall filter add chain=forward src-address=192.168.0.0/24 dst-address=192.168.0.2 action=drop” the 192.168.0.2 in a network printer which i want allow just few ip to reach not every ip from my network.
You can’t block access to printer using router’s firewall because printer is part of same LAN subnet and other drvices talk to printer directly.
However, if that printer is connected directly to your router using dedicated network port (none other device is using it), then you could filter traffic. So what is your LAN physical topology?
the printer is not located where i can plug it directly to a dedicated mikrotik port, it is connected to dlink switch but somebody is suggest i used acls to control it if the printer is support acls based ip, i will appreciate if any one has ideal on how i can sort it out using acls. thanks
the printer is not located where i can plug it directly to a dedicated mikrotik port, it is connected to dlink switch but somebody is suggest i used acls to control it if the printer is support acls based ip, i will appreciate if any one has ideal on how i can sort it out using acls. thanks
Any device (be it Mikrotik or TPlink) can only filter traffic passing between its own ports. If only a part of traffic is passing Mikrotik (because devices, connected to TPlink, can communicate without MT ever knowing about it), then possibilities to filter traffic are limited. If your TPlink allows to set up some filters, then do it there. ROS devices can do it, so if this issue is big for you, get yourself a ROS device to replace TPlink (you can get 5 gigabit ethernet ports for 50-70EUR) and then we’ll think of something.
If you do have managed switch TP link, then the easy solution is create a subnet just for the printer and then its easy peasy with firewall rules to ensure traffic is allowed as required.
So even a cheap managed switch will do the trick.