hotspot firewall property and IP binding bypass

RouterOS General
1

Can’t try it out for a few days as I am traveling, and I am wondering because it would elegantly solve a problem I’ve been given to solve next week.

In IP firewall filter and NAT rules you can refer to hotspot packets based on authentication status and direction:

hotspot (auth | from-client | http | local-dst | to-client; Default: )

http://wiki.mikrotik.com/wiki/Manual:IP/Firewall/NAT

Do IP bindings of type ‘bypassed’ match “hotspot=auth”, “hotspot=from-client”, or “hotspot=to-client”? Or are they exempted entirely from being dealt with by the Hotspot facilities, and aren’t just exempted from having to authenticate?

Sorry to ask a questions five minutes with a router could solve, but I’m not near a router until Tuesday.

Also: how well do many (say, two thousand) bypassed MAC addresses work as compared to the same number of logged in Hotspot users?

2

I tried a couple rules for you:

/ip firewall filter
chain=forward action=add-src-to-address-list hotspot=auth address-list=auth
chain=forward action=add-src-to-address-list hotspot=!auth address-list=unauth

The I bypassed my laptop, and only unauth showed up in “/ip firewall address-list”.
Anything else you want me to try?

3

Nope, that’ll do it!

Very much appreciate your time testing it. Thanks.