I am setting up a RB951 that our local ISP gave us (awesome ISP!) with a custom configuration, as it needs to manage two different ‘halfs’ so to speak.
One half is what we use personally. The other half has a wireless AP hooked, to give public access to guests. Arranged like this:
eth1 is Gateway.
eth2-4: Private use interface. Has a wireless AP extending the inner wireless adapter network (this works fine).
eth3 is empty, I plan to set it up as the management port
eth4 has an IP-analog telephone adapter (Cisco something): this works fine
eth5 is where the guest AP is hooked.
The interfaces have IPs assigned like this:
eth1 is DHCP (IP assigned by the modem)
eth2-5 are assigned like so: 192.168.88.2 for eth2, and so on until eth5 which has 192.168.88.5
Now, what I want to do is prevent eth5 from accessing any other interface but eth1 (gateway), to prevent any possible access to our network.
I have tried creating the following rule for the firewall:
rule type: forward
in port: eth5
out port: !eth1
protocol: any
action: drop
And placed it atop the list, even before the one allowing icmp packets. But I can still ping hosts, and access inner Microsoft networks.
What am I doing wrong?
Please note I am an absolute newbie to Mikrotik stuff, as all I have used is Cisco equipment.
Thanks for answering. I will test later tonight or tomorrow, as I don’t have immediate access to the router.
I did find a difficulty when freeing eth5 from its ‘slavery’. I cannot seem to route traffic from the interface to the gateway. There is surely something I am overlooking (due to my inexperience with Mikrotik most assuredly!)
Export is the way to show the current configuration.
Connect to the Routerboard via SSH or telnet for command line access, or click the “new terminal” button from Winbox.
There you can type export to give an overview of the configuration.
If you are on RouterOS 6.x export shows all configured items different from their default values.
If you are on RouterOS 5.x (which I doubt) you have to type export compact
Also, I’ve got another question. The ‘clients’ interface doesn’t have internet connection. I wonder what is that due to? I have poked around the config, but I still cannot manage to get internet to it.
I see some weirdness in your config.
You put IP addresses on interfaces 3/4 and wlan1.
This is not needed since these interfaces are part of the bridge. You can remove them.
Also on your DHCP server for your clients interface, change the DNS entry to be 192.168.10.1
I also would advise different firewall rules, but it is also a matter of taste.
I happen to allow the wanted traffic, and then block all others.
So in forward chain, it could look like this.
add chain=forward comment=“Accept established connections” connection-state=established
add chain=forward comment=“Accept related connections” connection-state=related
add chain=forward comment=“Allow traffic from Local network to go outside” in-interface=bridge-local out-interface=ether1-gateway src-address=192.168.88.0/24
add chain=forward comment=“Allow Guest network going outside” in-interface=bridge-client out-interface=ether1-gateway src-address=192.168.10.0/24
add action=log chain=forward comment=“Log everything else” disabled=yes log-prefix=“IPv4 Drop forward RR:”
add action=drop chain=forward comment="Drop everything else"In this case you just allow the traffic to go from ehter5 (via bridge-client) to exit to ether1-gateway
Also keep in mind that since your interfaces are bridged, creating firewalls on the specific interfaces will not work.
Thank you very much! I will be testing these changes in a few hours, I’ll edit the message to post the results.
So, if I have understood right, this is what I should do:
-Remove the addresses from the interfaces that share a bridge with the parent interface.
-Change the DNS in the clients DHCP to be the router itself (192.168.10.1)
-Change the firewall rules to your suggested ones (I will evaluate and adapt them to my ideas if necessary)
-Change the firewall rules so they aren’t checked against interfaces, but bridges (?)