IP spoofing?

[belowzero273]

I’ve set up 2 networks on CRS109-8G-1S-2HnD-IN:

• network_1 (192.168.0.0/24) for wired clients has its own dhcp-server.
• network_2 (192.168.10.0/24) for wireless clients uses mirkotik internal dhcp-server.
  Interfaces are not bridged and traffic between network is controlled with firewall.

The problem is that a wireless can assign himself an IP-address from network 1 pool manually and go straight to network_1’s resources. What’s the best way to prevent this?

[troffasky]

You could change wireless interface ARP setting to ‘reply-only’, then set the DHCP server to add ARP entries for leases.
http://forum.mikrotik.com/t/add-arp-for-leases-what-does-it-do/79806/1
This will prevent wireless users from assigning their own IPs.
However, you might want to investigate how network_1 and network_2 are being bridged together [as that’s what the symptoms you’re reporting suggest to me].

[belowzero273]

@troffasky

You could change wireless interface ARP setting to ‘reply-only’, then set the DHCP server to add ARP entries for leases.
http://forum.mikrotik.com/t/add-arp-for-leases-what-does-it-do/79806/1
This will prevent wireless users from assigning their own IPs.
However, you might want to investigate how network_1 and network_2 are being bridged together [as that’s what the symptoms you’re reporting suggest to me].

Thanks for a tip, this did the trick.
Networks are not bridged as far as I can see. The first wired interface is set as a master and all the others are slaves and that’s it. Wireless interface however is not bridged in any way.