Hi! For hardware testing purposes I needed to drop some % of all packets between two ethernet devices. These devices are in the same subnet, so I decided to use transparent firewall and use “random” matcher. The configuration I created did not work so I decided to drop all traffic just for test purposes, it did not work either.
This configuration did not work on:
hAP AC lite RouterOS 6.48.7 and 7.9.2
hAP AC2 RouterOS 6.49.8
But the very same config DID work in virtual environment in pnetlab!
I have also tried to disable connection tracking and fast forward, did not help.
Also tried to set the RAW rule for All interfaces, the counter is ticking but ICMP traffic is not dropped!
What am I doing wrong? What is the possible solution?
Here Eth1 is used for configuration, don’t mind it
Traffic must be dropped between Eth2 and Eth3
# jan/02/1970 01:59:00 by RouterOS 6.48.7
#
# model = RB952Ui-5ac2nD
/interface bridge
add fast-forward=no name=bridge1
/interface list
add name=Test_interfaces
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
/ip pool
add name=dhcp_pool1 ranges=192.168.1.10-192.168.1.100
add name=dhcp_pool2 ranges=10.0.0.10-10.0.0.100
/ip dhcp-server
add address-pool=dhcp_pool1 disabled=no interface=ether1 name=dhcp1
add address-pool=dhcp_pool2 disabled=no interface=bridge1 name=dhcp2
/interface bridge port
add bridge=bridge1 interface=ether2
add bridge=bridge1 interface=ether3
/interface bridge settings
set allow-fast-path=no use-ip-firewall=yes
/ip neighbor discovery-settings
set discover-interface-list=!dynamic
/interface list member
add interface=ether2 list=Test_interfaces
add interface=ether3 list=Test_interfaces
/ip address
add address=192.168.1.1/24 interface=ether1 network=192.168.1.0
add address=10.0.0.1/24 interface=bridge1 network=10.0.0.0
/ip dhcp-server network
add address=10.0.0.0/24 gateway=10.0.0.1
add address=192.168.1.0/24 gateway=192.168.1.1
/ip firewall filter
add action=drop chain=forward in-bridge-port-list=Test_interfaces
/ip firewall raw
add action=drop chain=prerouting in-interface-list=Test_interfaces