Hi,
Is it possible to isolate communication on the same subnet in RouterOS?
I did try the rule bellow but it doesn’t work .
chain=forward action=drop src-address=10.192.0.0/16
dst-address=10.192.0.0/16 dst-address-type=“” in-interface=B-GUEST log=no
log-prefix=“”
Tell us more …
1 if the subnet is on the same ethernet port then you have no possible influence on that communication, as it does not pass the MKT device at all
2 if the subnet is on multiple interfaces then the bridge can be forced to use the ip firewall for traffic on different interfaces (interfaces could be VLAN) . Set in bridge ‘Settings’
Equal bridge port horizon values can help with broadcast traffic limitation
3 if the subnet is on a WLAN (wifi) interface then you have the “Default forward” that can be disabled, or forwarding can be explicitly set in the access list
forwarding (yes | no; Default: yes)
no - Client cannot send frames to other station that are connected to same access point.
yes - Client can send frames to other stations on the same access point.
The communication within same subnet in principle doesn’t pass IP firewall, it only passes bridge and if HW offloaded (most MT devices do it), it only passes switch chip.
So if you want to isolate clients, you have to force all traffic to router’s CPU by setting hw=no on all ports members of tge bridge (/interface bridge port). Then you have to force bridge to use IP firewall by setting /interface bridge settings set use-ip-firewall=yes.
If you0re thinking about wireless clients of the same AP, then you have to set default-forwarding=no on wireless interface(s).
And tgen this only works for isolating clients which are connected to different interfaces on the router. If there’s a switch connected to one interface of router and multiple clients are connected to that switch, then connections between those clients never reach router … so client isolation has to be enforced on any other switch in the network as well.
Thank you both of you for the clarification
have a nice day