Bridge filter and CHR

RouterOS General
1

Hello,

One question, does bridge filter work on CHR? if so, how do I activate it? I tried setting simple rules, yet they never get matched, tried the same simple rules on real equipment and they work as intended.

For instance this rule:

/interface bridge filter add in-interface=ether10 mac-protocol=0x8100 action=drop vlan-id=1200

Works on real equipment.

The virtual and real topology are exactly the same, on CHR this rule never works (tried other rules too, same problem) on the real equipment it works correctly.

2

Just to clarify, the traffic is coming into the CHR properly tagged as seen via packet captures. Anyone got information related to this matter?

Enviado desde mi MotoE2(4G-LTE) mediante Tapatalk

3

Check the Bridge [Settings] button, is “Use IP firewall” ticked?

4

Hi, it’s not. So isn’t on real equipment as well. This option as far I know is only to force bridged traffic to also be processed by IP rules on /ip firewall; regular bridge rules doesn’t need this option turned on, unless you’ve got any information related to a bug that makes this option behave differently.

I’ll try your suggestion later, but if this works it’s probably a bug, could someone from Mikrotik clarify this please?

Thanks

5

It looks broken here too (CHR 6.35rc33).

I connected two CHRs, added vlan to CHR1’s interface, then bridged two interfaces on CHR2 and added another vlan on top of that and finally these rules:

/interface bridge filter
add action=log chain=forward mac-protocol=vlan
add action=log chain=input mac-protocol=vlan
add action=log chain=output mac-protocol=vlan

And nothing, I can see vlan packets in Torch, both incoming and outgoing, but not a single packet matched by these rules. Same thing on real hardware works. So it looks like you found a bug.

6

Though so. I was trying to validate some designs but this issue came in. Would be nice to have answers from mikrotik staff since this feature which is a major one seems to be broken on CHR.

Enviado desde mi MotoE2(4G-LTE) mediante Tapatalk

7

Send a supout to mikrotik support

8

To anyone interested, as per response of mikrotik support. This is a known bug that’s being investigated to get fixed.