Bridge and IP Firewall setting

RouterOS Beginner Basics
1

Hi all,

Struggling with some configuration, would appreciate some guidance / pointing in the right direction.
Essentially I’ve got a Mikrotik RB3011UiAS that’s being used in a managed office building.
Generally speaking all works fine, but now we want to bandwidth limit some offices etc.

I see to do this, I need to enable “use-ip-firewall=yes” in the bridge settings for the WAN bridge. (WAN is bridged, as some clients have the public IP passed through to their own router)
However when I do this, the clients that have their own router and pass through lose the ability to have port forwarding etc. Aka DST NAT’ing seems to break?

I can see when using the logs connections hitting the DSTNAT rule that’s in place, however there doesn’t seem to be a response.

Thoughts?

See below for the config (without use-ip-firewall=yes)

/interface bridge
add name=bridge-lan
add name=bridge-wan
/interface ethernet
set [ find default-name=ether1 ] name=ether1-wan
set [ find default-name=sfp1 ] disabled=yes
/interface vlan
add interface=bridge-lan name=vlan10-mgmt vlan-id=10
add interface=bridge-lan name=vlan11-mainoffice vlan-id=11
add interface=bridge-lan name=vlan12-customer1 vlan-id=12
add interface=bridge-lan name=vlan15-phone-network vlan-id=15
add interface=bridge-lan name=vlan16-customer2 vlan-id=16
/ip pool
add name=mgmt ranges=10.1.100.10-10.1.100.50
add name=nativeLAN ranges=10.1.99.10-10.1.99.50
add name=mainoffice ranges=10.1.101.10-10.1.101.110
add name=phone-network ranges=10.1.105.1-10.1.105.150
/ip dhcp-server
add address-pool=mgmt disabled=no interface=vlan10-mgmt lease-time=8h name=mgmt
add address-pool=nativeLAN disabled=no interface=bridge-lan lease-time=8h name=nativeLAN
add address-pool=mainoffice disabled=no interface=vlan11-mainoffice lease-time=8h name=mainoffice
add address-pool=phone-network disabled=no interface=vlan15-phone-network lease-time=8h name=phone-network
/queue simple
add dst=bridge-wan limit-at=5M/5M max-limit=5M/5M name=mainoffice-queue target=vlan11-mainoffice
add limit-at=5M/5M max-limit=5M/5M name=customer-queue target=194.0.0.4/32
add limit-at=30M/30M max-limit=30M/30M name=customer-queue target=194.0.0.5/32
/interface bridge port
add bridge=bridge-wan interface=ether1-wan
add bridge=bridge-lan interface=ether3
add bridge=bridge-lan interface=ether4
add bridge=bridge-lan interface=ether5
add bridge=bridge-lan interface=ether6
add bridge=bridge-lan interface=ether7
add bridge=bridge-lan interface=ether8
add bridge=bridge-lan interface=ether9
add bridge=bridge-lan interface=ether10
add bridge=bridge-wan interface=vlan16-customer2
add bridge=bridge-lan interface=ether2
add bridge=bridge-wan interface=vlan12-customer1
/ip address
add address=194.0.0.2/28 interface=bridge-wan network=194.0.0.0
add address=10.1.100.254/24 interface=vlan10-mgmt network=10.1.100.0
add address=10.1.99.254/24 interface=bridge-lan network=10.1.99.0
add address=194.0.0.3/28 interface=bridge-wan network=194.0.0.0
add address=194.0.0.4/28 comment="Disabled as used for customer" disabled=yes interface=bridge-wan network=194.0.0.0
add address=194.0.0.5/28 comment="Disabled as used for customer" disabled=yes interface=bridge-wan network=194.0.0.0
add address=194.0.0.6/28 interface=bridge-wan network=194.0.0.0
add address=194.0.0.8/28 interface=bridge-wan network=194.0.0.0
add address=194.0.0.9/28 interface=bridge-wan network=194.0.0.0
add address=194.0.0.10/28 interface=bridge-wan network=194.0.0.0
add address=194.0.0.11/28 interface=bridge-wan network=194.0.0.0
add address=194.0.0.12/28 interface=bridge-wan network=194.0.0.0
add address=194.0.0.13/28 interface=bridge-wan network=194.0.0.0
add address=194.0.0.14/28 interface=bridge-wan network=194.0.0.0
add address=10.1.101.254/24 interface=vlan11-mainoffice network=10.1.101.0
add address=10.1.105.254/24 interface=vlan15-phone-network network=10.1.105.0
add address=194.0.0.7/28 interface=bridge-wan network=194.0.0.0
/ip dhcp-server network
add address=10.1.99.0/24 dns-server=1.1.1.1 gateway=10.1.99.254 netmask=24
add address=10.1.100.0/24 dns-server=1.1.1.1 gateway=10.1.100.254 netmask=24
add address=10.1.101.0/24 dns-server=1.1.1.1 gateway=10.1.101.254 netmask=24
add address=10.1.105.0/24 dns-server=1.1.1.1 gateway=10.1.105.254 netmask=24
add address=10.1.106.0/24 dns-server=1.1.1.1 gateway=10.1.106.254 netmask=24
/ip dns
set servers=1.1.1.1,1.0.0.1
/ip firewall address-list
add address=0.0.0.0/8 comment=RFC6890 list=not_in_internet
add address=172.16.0.0/12 comment=RFC6890 list=not_in_internet
add address=192.168.0.0/16 comment=RFC6890 list=not_in_internet
add address=10.0.0.0/8 comment=RFC6890 list=not_in_internet
add address=169.254.0.0/16 comment=RFC6890 list=not_in_internet
add address=127.0.0.0/8 comment=RFC6890 list=not_in_internet
add address=224.0.0.0/4 comment=Multicast list=not_in_internet
add address=198.18.0.0/15 comment=RFC6890 list=not_in_internet
add address=192.0.0.0/24 comment=RFC6890 list=not_in_internet
add address=192.0.2.0/24 comment=RFC6890 list=not_in_internet
add address=198.51.100.0/24 comment=RFC6890 list=not_in_internet
add address=203.0.113.0/24 comment=RFC6890 list=not_in_internet
add address=100.64.0.0/10 comment=RFC6890 list=not_in_internet
add address=240.0.0.0/4 comment=RFC6890 list=not_in_internet
add address=192.88.99.0/24 comment="6to4 relay Anycast [RFC 3068]" list=not_in_internet
add address=194.0.0.4 list=PTIPs
add address=194.0.0.5 list=PTIPs
/ip firewall filter
add action=drop chain=forward comment="Drop incoming from internet which is not public IP" in-interface=bridge-wan src-address-list=not_in_internet
add action=drop chain=forward comment="Drop tries to reach not public addresses from LAN" dst-address-list=not_in_internet in-interface=bridge-lan out-interface=!bridge-lan
add action=accept chain=input comment="Local Management - Native LAN" dst-port=2244,8291 protocol=tcp src-address=10.1.99.0/24
add action=accept chain=input comment="Local Management - Mgmt VLAN" dst-port=2244,8291 protocol=tcp src-address=10.1.100.0/24
add action=drop chain=input comment="Local Management - Block" dst-port=2244,8291 protocol=tcp
add action=drop chain=forward comment="Drop incoming packets that are not NATted" connection-nat-state=!dstnat connection-state=new in-interface=bridge-wan src-address-list=!PTIPs
add action=accept chain=forward comment="mainoffice to phone-network" in-interface=vlan11-mainoffice out-interface=vlan15-phone-network
add action=accept chain=forward comment="phone-network to mainoffice" in-interface=vlan15-phone-network out-interface=vlan11-mainoffice
add action=drop chain=forward comment="VLAN Isolation" in-interface=all-vlan out-interface=!bridge-wan
add action=accept chain=forward comment="Acc DstNAT" connection-nat-state=dstnat
add action=accept chain=input comment="Acc Inpt Est Rel" connection-state=established,related
add action=accept chain=forward comment="Acc Fwd Est Rel" connection-state=established,related
add action=accept chain=input comment="Acc Inpt LAN" src-address=10.0.0.0/8
add action=accept chain=forward comment="Acc Inpt LAN" src-address=10.0.0.0/8
add action=accept chain=input comment="Acc Inpt Passthrough" src-address-list=PTIPs
add action=accept chain=forward comment="Acc Inpt Passthrough" src-address-list=PTIPs
add action=drop chain=input comment="Drp Inpt"
add action=drop chain=forward comment="Drp Fwd"
add action=drop chain=forward comment="Drop invalid" connection-state=invalid log=yes
/ip firewall nat
add action=dst-nat chain=dstnat dst-address=194.0.0.4 to-addresses=194.0.0.4
add action=dst-nat chain=dstnat dst-address=194.0.0.5 to-addresses=194.0.0.5
add action=src-nat chain=srcnat out-interface=bridge-wan src-address=194.0.0.4 to-addresses=194.0.0.4
add action=src-nat chain=srcnat out-interface=bridge-wan src-address=194.0.0.5 to-addresses=194.0.0.5
add action=masquerade chain=srcnat out-interface=bridge-wan
/ip firewall service-port
set sip disabled=yes
/ip route
add distance=1 gateway=194.0.0.1
2

Perhaps there is a way to apply queues, to do what you wish to accomplish??

3

We’re essentially after limiting the bandwidth to each unit/customer. (both who are using our router, and those not)
The queues work when bridge ip firewall is enabled.

Thanks

4

I avoid use-ip-firewall=yes like a plague. The problem is that every packet that was previously bridged and IP firewall didn’t see it at all, goes through complete IP firewall, so it changes everything quite a lot. It’s probably manageable, but you need to rethink everything. For example, your:

/ip firewall nat
add action=masquerade chain=srcnat out-interface=bridge-wan

will affect everything previously bridged on bridge-wan, so you’d need to exclude some stuff from it.

One thing I didn’t try and it maybe could help, if you don’t use mangle rules to mark packets for queues, try to mark all packets that would be previously bridged as untracked in raw table, and then allow them in firewall filter. That should make them avoid IP firewall, but maybe queues will still see them.

Or completely different approach without use-ip-firewall=yes, packets can be marked using bridge filters and queues can be made for marked packets. I didn’t test this either, but maybe once marked, queues could see them. Or maybe not, I really don’t know and can’t test it now.