I need capsman (wifi5) to stop routing between it's WiFi interfaces/subnets as those should be only used to forward the WiFi client traffic towards the inter-vlan router, and not to route between those subnets inside Capsman router.
Not sure how to achieve this as Mikrotik's default is to route between all direct-attached-interfaces that have IP, which is required for Capsman forwarding to function.
I cannot override this default behavior with routing priority as direct attached routes have highest priority 0, nor block this traffic using firewall rules as this would block it instead of forwarding it to inter-VLAN router.
if you do not want to route packets form one subnet to another then set blocking forwarding rule for all WiFi subnets. You can gather all subnets in one address list and then:
Yes, thank you for suggesting.
I could do that on capsman and it would disable forwarding on capsman, but it would also stop all such traffic already on capsman.
However, I don't need to stop all this routing traffic, just route it to another device inter-VLAN router which then should do either blocking or inter-VLAN routing such traffic.
All such block/route rules should be defined and concentrated there instead of on Capsman.
Note, I have 4 capsmans and network is a bit more complex... but in essence, capsmans shouldn't perform functions of an inter-VLAN router.
What you describe can only happen if the capsman is in fact the default gateway on those networks. If it is specified as the default gateway then it has no choicd but to perform l3 functions: it either forwards such packets as per its routing table or drops the traffic.
What do you mean writing CAPSAN?
CAPSMAN as a WiFi manager does not IMHO route packets @L3. The "CapsMan" as a device with a CAPSMAN service installed on can do routing as a main router. If you move the CAPSMAN to another device from the main router then routing would be done on it.
Sorry for taking some time to answer, but in essence I use Capsman forwarding and not the local forwarding. So Capsman does perform L3 routing from/to WiFi Clients.
Traffic is passing between WiFi client through CAPs over management VLAN to Capsman, then Capsman routes traffic through it’s own IP into particular VLAN (L2 network) and sends it to L3 subnet client in that VLAN or to default router on that VLAN so to access the Internet.
Not routes, rather "transfers" or "passes" packets usin L3 not L2 level (if implemented with IP addresses). It does not define any rules according "how to route trafic from point A to B". Try to "destroy" routing table and watch if CAPSMAN would be still operational.
Yes correct, I don’t need to define any routes in Capsman for this behavior and it probably is “transfer” or “pass” of the traffic rather than a proper routing. But any Mikrotik routes by default unless the rule is set to prevent routing.
So I will need to troubleshoot further trying to prevent example routing with a rule on a test bench so to see what happens.
My fear is that, if left as such, anyone setting Capsman as the default router for example could theoretically be routed to any of the other Capsman’s interfaces in different VLANs.
Maybe I am missing something here, but will test & update info here when I get a chance.
For routing forget names as CAPSMAN, VLAN, VETH etc., just think of IP addresses, no matter where they are bound. If only packet could be routed/passed from device A to B, then the interface (port,bridge,vlan) could be used for attack vector.
CAPSMAN could not be set as a default router, the router where tha CAPSMAN is installed could be a default router or better to say the default gateway for devices accessing the network via CAPSAM operated interfaces.
CAPSMAN could be installed on any device in your network. It could even be the device that has no WiFi interfaces or virtual applience.
Not sure I fully understand what you mean, but Capsman has at least one active IP address and as such could be set as either a default router/gareway or a router/gageway for the particular subnet.
In addition to that, and in order for the routing to function, it would need at least one additional IP address so traffic can be routed (and used for attack if not blocked).
Capsman is running on a RouterOS as one module/menu of the entire system, so regardless if Capsman is activated or not, RouterOS still does the routing.
So if RouterOS device running Capsman has multiple IP addresses assigned (as in situation for eg. when VLANs are used to separate WiFi clients into multiple VLANs) it could theoretically execute the routing between these VLANs/Subnets.
Now, what does Capsman or local “forwarding” in this sense mean, I would guess L3 routing rather than only L2 switching, as packages forwarded by Capsman can be routed to different subnets/VLANs. This is required to enable different SSIDs to be in different VLANs or dynamic VLAN assignments based on MAC.
Since we talk definitions, historically having some different connotations, router or gateway is interchangeable definition in TCP/IP and mostly means the same thing, or at least not properly defined accross vendors/devices & time.
But generally routing means sending IPs between IP networks (based on rules defined), while gatewaying usually means sending/converting IP (or other) packets between different networks (eg. LAN <> WAN), different hardware (eg. ethernet <> token ring, or ethernet <> WiFi) or protocols (eg. IP <> IPX).
So it is mostly that router is a function and gateway is a role of particular device in the network.
And usually you have a router, which sometimes does also the role of a gateway (in home networks with a sinlge ISP router this is usually the case).
But in bigger networks you can have internal routers (eg. Inter-VLAN routers or other) that are routers, but not gateways.
One example of would be a gateway without a router is a modem or a bridge, albeit these don’t use IPs so not really routers in the IP world… if we split the hairs, so only as an example.
When I get a chance I will need to test for myself and will update the info here.
The CAPsMAN forwarding is about L2 traffic to and from wireless clients. It's not about routing.
With forwarding set to local this means that every CAP device will have a bridge connecting both wired (upstream) port and any of wifi interfaces (one per SSID/band). So any ethernet frame passing to and from wireless stations will be taken from or injected into LAN by CAP device directly.
With forwarding set to CAPsMAN, CAP and CAPsMAN will create a proprietary (encrypted) tunnel and then CAPsMAN will add wifi each and every WiFi interface to its own bridge. So all ethernet frames to and from WiFi stations will pass through that tunnel. Which means that CAPsMAN device will have full control over how will wireless clients' traffic pass to the rest of LAN.
If CAPsMAN device actually acts as a router, then it will obviously also route traffic of wireless stations ... but the L2 forwarding doesn't rely on any IP address (I've never tried but it might be that CAPsMAN might properly work even if device doesn't have any IP address).
Thanks for reasuring about the part of forwarding vs routing, this is behavior that I can confirm.
Let me test so not to misinform here, but to what I can remember IP in appropriate VLANs is required on the Capsman, if CAPs do the Capsman forwarding instead of local forwarding.
It would also be expected behavior (again to what I can remember), as if local forwarding is used then CAPs require VLANs/IPs set on them instead of being set on Capsman.
In each case Cap or Capsman adds & removes WiFi interfaces in the bridge dynamically (adds when active, meaning at least 1 client attached to the particular WiFi interface).
This is done either with wifi interface locally on CAP (local forwarding) or on Capsman (capsman forwarding, where Cap “lends” it’s WiFi interface to Capsman).
So if I add the IPs to either Cap or Capsman then it’s routerOS surely can route, unless forbidden with adding a firewall forwarding block rule.
That’s my fear, as if that’s the case I would need to stop forwarding between IPs/VLANs (actually their subnets) on every Cap in case of local forwarding and Capsman in case of Capsman forwarding.
In this regard there's no difference regardless the mode of forwarding used: if your wifi interfaces are supposed to "attach" to different VLANs, then one needs VLAN setting on wifi interface ... BTW, if all of wifi interfaces are supposed to be part of same L2 broadcast domain (which mostly means IP subnet), then there's no need to use VLANs.
Not really. wifi interfaces are added to appropriate bridges when provisioned/started. What does change with active stations is status (running / not running) ... which can affect different functionalities of bridge (one of them is STP discovery which can signifficantly affect roaming stations).
Yes, but again: passing traffic between wifi interface and bridge doesn't involve routing (it is switching if you want). So it doesn't matter if CAP or CAPsMAN doing it has one, multiple or none IP addresses.
Yes, any device running ROS (CAP, CAPsMAN, switch, etc.) can route if configured to do so and if other devices are configured to use it as gateway. So there are a few prerequisites to enable routing on device which is not supposed to do it. And as I already wrote: neither CAP nor CAPsMAN devices are required to do routing, that can be done by completely separate device (even another vendor).
To make it absolutely clear: switches (and CAPsMANs) and APs (and CAPs) don't need IP address in each VLAN passing them (in L2). These devices only need one single IP address which is strictly needed for management of that particular device (webfig or CLI access, connectivity towards servers with upgrade packages) and should hence be set in VLAN which is dedicated to management (of all networking gear). And capsman protocol then should probably also carried of that VLAN (either L2 - default discovery settings ... or L3 if CAP are configured with CAPsMAN's IP address).