Drop traffic between two different vlans that are on the same interface

RouterOS General
1

Hello,

I want to isolate traffic between different VLANs that are on the same interface. Is it possible?

 5  R  VLAN16-LAN                          vlan             1500  1592            B8:69:F4:71:D1:40
 6  R  VLAN33-MGMT                         vlan             1500  1592            B8:69:F4:71:D1:40

They’re all set on the same bridge (bridge includes all ports, ofc not the WAN port). They have different subnets. Cable is connected to ether2 port. Ether2 receives tagged packets from switch.
Let’s say that
VLAN16 = 192.168.16.0/24
VLAN33 = 10.33.33.0/24

I want to make VLAN16 not reachable for VLAN33 and vice versa. How can I reach these results? I’ve tried firewall rules but it didn’t help:

 8    chain=forward action=drop src-address=10.33.33.0/24 dst-address=192.168.0.0/16 log=no log-prefix="" 

 9    chain=forward action=drop src-address=192.168.0.0/16 dst-address=10.33.33.0/24 log=no log-prefix="" 

10    ;;; DROP FROM 192.168.16.0/24 to 192.168.100.0/24
      chain=forward action=drop in-interface=VLAN16-LAN out-interface=VLAN33-MGMT log=no log-prefix="" 

11    ;;; DROP FROM 192.168.100.0/24 to 192.168.16.0/24
      chain=forward action=drop in-interface=VLAN33-MGMT out-interface=VLAN16-LAN log=no log-prefix=""

But I still can ping 192.168.16.254 with source 10.33.33.100.

2

Why at all different VLANs communicate?

3

Because router does routing :stuck_out_tongue:

4

Have you enable “ip firewall on bridge”
or if you do not want to do that you can use “filter” within the bridge (but less comfortable).

5

I’ve tried enabling ip firewall on bridge, but it didn’t help me. Maybe I was doing it wrong. Any examples, please?

6

Sorry, I was able to ping only the gateways. I can’t ping hosts.

7

By their nature VLANS provide separation at layer two. Thus even if on the same bridge they will not crosstalk.
However if you allow them at layer 3 to connect, then they will be able to reach each other.

The key is proper forward chain fiirewall filter rules.
Your basic forward chain should be
fastrack allow established related traffic (default)
allow established related traffic (default)
drop invalid traffic (default)

drop all other traffic

You will be good to go.
The ************ represents only the traffic you wish to allow for example:

allow vlanx to internet
allow vlany to internet
allow homelan to internet
allow vlanx and vlany subnets to access a shared printer on homelan
allow destination packets to a server on homelan
allow admin on homelan to access vlanx and vlany subnets.
etc…

So if you do not explicitly allow vlanx to vlany traffic, it will not be allowed in layer 3!

8

Trafic that you are trying to avoid in your ping command is not for the forward chain, is for the input chain.
If you do not want users on vlanx communicate with the interface of the VLANy on the router , you need to block the traffic on the input chain.

Regards.

9

What you said makes no sense to me. Input chain is for traffic heading to the router, not from one interface to another interface, that is clearly Forward Chain.

10

See post #6, where do you think the gateways for these vlans are?

11

Hi CZFAN, sorry no capiche.
Not being able to ping hosts, from the lan side but using external WANIPs is probably an issue with not using hairpin nat.
Not being able to ping hosts on the same vlan from the lan side of the router is finger problems
Not being able to ping from one vlan to another vlan from the lan side of the router is simply standard layer 2 functionality- part1
Not being able to ping from one vlan to another vlan from the lan side of the router is simply filter forward rules ensuring no layer 3 routing allowed - part2

Tell me again, how does input filtering figure on pinging hosts, pinging the router sure…
I can turn off pinging the router but still allow port forwarding to servers… OH MY Effing God… can it be true… ;-PP

if you want to stick your nose (yes its a very smart nose) in the middle of conversation, you know better than to write just a few lines vice a long winded proper explanation!! :wink: