Greetings all,
I am an absolute beginner with MikroTik products, and have limited networking experience.
I have been tasked with the following objective:
- Create an environment with two computers connected to a single router via Ethernet
- Isolate the connectivity of the second computer so that it can only receive data from only the first computer,
- Prevent the second computer from accessing the internet.
It is my understanding that in order to succeed with objectives #2 and #3 via firewall rules, computers 1 and 2 must be on separate subnets.
Therefore, before looking into constraining traffic, I'm currently only looking for help with:
A) Creating two subnets
B) Successfully pinging between computers 1 and 2 in both directions
PC 1 is connected to ETH2,
PC 2 is connected to ETH3
ETH 2 is set to 192.168.88.1
PC 1 (ETH 2) is set to 192.168.88.130, subnet mask 255.255.255.0, default gateway 192.168.88.1
ETH 3 is set to 192.168.87.1
PC 2 (ETH 3) is set to 192.168.87.128, subnet mask 255.255.255.0, default gateway 192.168.87.1
PC 1 can ping its default gateway of 192.168.88.1, and PC 2 can ping its default gateway of 192.168.87.1, but no further in either direction.
Are there any steps that I'm missing in order to properly route traffic between these two subnets?
For those who are still reading, I greatly appreciate your time and effort.
Best regards!
[admin@MikroTik] > /ip address print
Flags: X - disabled, I - invalid, D - dynamic
ADDRESS NETWORK INTERFACE
0 ;;; defconf
192.168.88.1/24 192.168.88.0 ether2-master
1 192.168.87.1/24 192.168.87.0 ether3 [admin@MikroTik] > /ip firewall export
jan/02/1970 00:39:36 by RouterOS 6.36.1
software id = H9W4-H7FZ
/ip firewall filter
add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp
add action=accept chain=input comment="defconf: accept established,related"
connection-state=established,related
add action=drop chain=input comment="defconf: drop all from WAN" in-interface=
ether1
add action=fasttrack-connection chain=forward comment="defconf: fasttrack"
connection-state=established,related
add action=accept chain=forward comment="defconf: accept established,related"
connection-state=established,related
add action=drop chain=forward comment="defconf: drop invalid" connection-state=
invalid
add action=drop chain=forward comment=
"defconf: drop all from WAN not DSTNATed" connection-nat-state=!dstnat
connection-state=new in-interface=ether1
[admin@MikroTik] > /ip firewall export
jan/02/1970 00:39:36 by RouterOS 6.36.1
software id = H9W4-H7FZ
/ip firewall filter
add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp
add action=accept chain=input comment="defconf: accept established,related"
connection-state=established,related
add action=drop chain=input comment="defconf: drop all from WAN" in-interface=
ether1
add action=fasttrack-connection chain=forward comment="defconf: fasttrack"
connection-state=established,related
add action=accept chain=forward comment="defconf: accept established,related"
connection-state=established,related
add action=drop chain=forward comment="defconf: drop invalid" connection-state=
invalid
add action=drop chain=forward comment=
"defconf: drop all from WAN not DSTNATed" connection-nat-state=!dstnat
connection-state=new in-interface=ether1