few bridges config

lokz · February 17, 2020, 7:02pm

So, I am new to Mikrotik.
I bought several devices for my house. Cebtarla router is 2011iL and it has ETH1 as WAn and 3 bridges configured. I tweaked default conf to achieve this.
Somehow you can ping IP-s on other bridges although they are separate on router.

In general I would like to achieve this:

All devices go to WAN over ETH1 (working)
All devices on any bridge receive their own set of IPs (working)
Devices between bridges cannot communicate with each other (NOT working)
When you are connected with laptop in BridgeL (192.168.100.0/24) you should see static IP mikrotik boxes (192.168.150.2 and 192.168.200.2) with winbox in order to manage them (although you re on different subnet)

Maybe NAT is the problem, I did not touch default rule (which usually applies on one bridge which contains all ports.

P.S. Is there any default set of rules to apply when you remove factory default ones? Some standard set of rules which most people use?

Here is my config. Thanks anyone for the assistance.

# model = 2011iL
# serial number = xxxxxxxxxxxxxx
/interface bridge
add name=bridgeA1
add admin-mac=E4:8D:8C:29:xx:xx auto-mac=no name=bridgeL
add name=bridgeP
/interface list
add comment=defconf name=WAN
add comment=defconf name=LAN
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
/ip pool
add name=dhcp_pool1 ranges=192.168.100.10-192.168.100.254
add name=dhcp_pool2 ranges=192.168.200.10-192.168.200.254
add name=dhcp_pool3 ranges=192.168.150.10-192.168.150.254
/ip dhcp-server
add address-pool=dhcp_pool1 disabled=no interface=bridgeL name=dhcpL
add address-pool=dhcp_pool2 disabled=no interface=bridgeP name=dhcpP
add address-pool=dhcp_pool3 disabled=no interface=bridgeA1 name=dhcpA1
/interface bridge port
add bridge=bridgeL interface=ether2
add bridge=bridgeL interface=ether3
add bridge=bridgeL interface=ether4
add bridge=bridgeL interface=ether5
add bridge=bridgeL interface=ether6
add bridge=bridgeL interface=ether7
add bridge=bridgeP interface=ether8
add bridge=bridgeP interface=ether9
add bridge=bridgeA1 interface=ether10
/ip neighbor discovery-settings
set discover-interface-list=LAN
/interface list member
add interface=bridgeL list=LAN
add comment=defconf interface=ether1 list=WAN
add interface=bridgeP list=LAN
add interface=bridgeA1 list=LAN
/ip address
add address=192.168.100.1/24 interface=bridgeL network=192.168.100.0
add address=192.168.150.1/24 interface=bridgeA1 network=192.168.150.0
add address=192.168.200.1/24 interface=bridgeP network=192.168.200.0
/ip dhcp-client
add disabled=no interface=ether1
/ip dhcp-server network
add address=192.168.100.0/24 gateway=192.168.100.1
add address=192.168.150.0/24 gateway=192.168.150.1
add address=192.168.200.0/24 gateway=192.168.200.1
/ip dns
set allow-remote-requests=yes servers=8.8.8.8,8.8.4.4
/ip dns static
add address=192.168.88.1 comment=defconf name=router.lan
/ip firewall filter
add action=accept chain=input comment=\
    "defconf: accept established,related,untracked" connection-state=\
    established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=\
    invalid
add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp
add action=accept chain=input comment=\
    "defconf: accept to local loopback (for CAPsMAN)" dst-address=127.0.0.1
add action=drop chain=input comment="defconf: drop all not coming from LAN" \
    in-interface-list=!LAN
add action=accept chain=forward comment="defconf: accept in ipsec policy" \
    ipsec-policy=in,ipsec
add action=accept chain=forward comment="defconf: accept out ipsec policy" \
    ipsec-policy=out,ipsec
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" \
    connection-state=established,related
add action=accept chain=forward comment=\
    "defconf: accept established,related, untracked" connection-state=\
    established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" \
    connection-state=invalid
add action=drop chain=forward comment=\
    "defconf: drop all from WAN not DSTNATed" connection-nat-state=!dstnat \
    connection-state=new in-interface-list=WAN
/ip firewall nat
add action=masquerade chain=srcnat comment="defconf: masquerade" \
    ipsec-policy=out,none out-interface-list=WAN
/system clock
set time-zone-name=Europe/Zagreb
/system identity
set name=KO-router
/tool mac-server
set allowed-interface-list=LAN
/tool mac-server mac-winbox
set allowed-interface-list=LAN

bpwl · February 18, 2020, 11:49am

My suggestions:

3: traffic is “routed” between those subnets. Routes are added automatically for connected interfaces. There are no firewall rules or routing rules to prohibit this routed traffic ?

anav · February 19, 2020, 3:33pm

I would say step back and forget about your current configuration.
State your requirements in words, what you wish to accomplish from a users perspective without stating any networking equipment.
Then a design can be determined which will be optimal.

vortex · February 19, 2020, 4:09pm

I could never get mDNS to route between subnets.

WeWiNet · February 19, 2020, 5:25pm

4.) See/manage your Mikrotik boxes:
The issue is, you try to access those boxes from their point of view via their WAN interface (outside).
By security this is not allowed in default setting. I would recommend to leave it this way for now
as it seems you are just about to learn how to use routerOS.
Hint, you can use ROMON to do that at later stage…

3.) Attention: Firewall rules will need more than this, but its a starting point:
Create filter rule for each bridge to WAN and return traffic from WAN to bridge. Example:

 /ip firewall filter add action=accept chain=forward comment="Accept Downstream for bridge 1" connection-state=established,related  \
    in-interface-list=WAN out-interface=Bridge1
add action=accept chain=forward comment="Accept upstream for bridge 1" connection-state=new,established,related \
in-interface=bridge1 out-interface-list=WAN

This allows the traffic you want to happen from each bridge to go onto the “internet”.
Drop the remaining forward traffic and clients will no more communicate to each other. Add exceptions etc as needed.

lokz · February 20, 2020, 8:38pm

The issue is, you try to access those boxes from their point of view via their WAN interface (outside).

Well, not, because those devices are configured like “bridge” devices. They do not have WAN port, all ports are bridged because they get their IPs from main Router in the network.

anav · February 22, 2020, 7:07pm

Would love to help but as stated above, without understanding your requirements, the config is too messy to figure out.