How to block DHCP relay over EoIP Bridge?

RouterOS General
1

Does someone has experience about bridging networks and with troubleshooting related issues?
Here is my problem.

I have got two networks transparently bridged just as described in http://www.mikrotik.com/testdocs/ros/3.0/vpn/eoip.php
The bridge works fine and resources are available across two remote networks.

The problem comes up as each MT box on each network has a running DHCP server. I must ensure that each DHCP server serves only the local network, and each computer gets the IP of the local gateway for outgoing traffic. Sometimes it happens that a new computer gets its DHCP lease over the bridge from the other DHCP server. I fail to find a way to filter those DHCP packets out from the bridge. Since Local interface is bridged with EoIP, it is not possible to filter those packets and discern between local and EoIP packets in the firewall. Do I have to use Mangle here? How?

Can someone explain how to solve this? Appreciate your input.

R.

2

Did you try to put a rule in the bridge filter?

How do you distinguish the DHCP packets of one network to filter them?

I would filter the DHCP server as well as all other DHCP related packets from clients, but would require a little reading and/or analyzing what those are, to match them.

3

It works now. :slight_smile:

The following rule in Bridge filter drops DHCP requests in EoIP over Bridge both ways:

/interface bridge filter
add action=drop chain=forward dst-port=67 ip-protocol=udp mac-protocol=ip
disabled=no comment=“Drop all DHCP requests over EoIP bridge”

Thanks for input!

R.