Basically I have the edge router / firewall doing all of the NAT and access controll to the inside, the DHCP and DNS are on the internal servers. Due to some of the applications that run requirements, I cannot NAT at the MikroTik, so basically I need it to be a transparent spot in the network that only authenticates users. DHCP and DNS are located off the core switch.
Can this be done with the MikroTik on RouterBoard with OS 4.2?
If you have some suggestions, it would be much appreciated,
Thank you
Shawn
First: put one RB450G in bridge mode as you described in your schema. Use as ports of the bridge at least 2 ether interfaces. One side to backbone, other side to user’s switch. In bridge you must activate the firewall. In firewall Mangle you must add all the customers, one rule per customer. In each rule you must assign the mac addres of the client in src. mac address. In action you must use “mark connection”. In new connection mark use, as example, “Authorized”. Passtrough=yes. In chain use prerouting. In that way you are marking all packets coming from authorized customers with the mark “Authorized”. After that go to firewall filter rules, put in the top a rule action accept, chain forward, connection mark: “Authorized”. After that, put other rule action drop, chain forward in the bottom of the list of firewall filter rules. And done. In that way yours authorized customers going forward traffic over the bridge, all others (intruders or unknowns mac address) not.