Manage inter-vlan connections

RouterOS General
1

Once switch1-cpu is involved in multiple Vlans for routing purpose, each Vlan can route to WAN by its own gateway

Doing so, also inter-vlan is automatically enabled but this is unwanted.

I’ve got to insert a filter rule on top of my forward ones :

chain=forward action=drop in-interface=all-vlan out-interface=all-vlan
chain=forward action=accept connection-state=established,related
chain=forward action=drop connection-state=invalid
chain=forward action=drop connection-state=new connection-nat-state=!dstnat in-interface=pppoe-out1
chain=forward action=drop connection-state=new connection-nat-state=!dstnat in-interface=ether24

(first one is the only position that deny inter-vlan traffic)

However, I need some host in a single Vlan to access all hosts in the other Vlans

I’ve tried many rules in many order but host to inter-vlan packets are always dropped: what’s the rights syntax ? where I’m wrong???

Thank you

2

Try

chain=forward action=accept in-interface=all-vlan out-interface=all-vlan src-address=allo.wed.host.ip
chain=forward action=drop in-interface=all-vlan out-interface=all-vlan
chain=forward action=accept connection-state=established,related
chain=forward action=drop connection-state=invalid
chain=forward action=drop connection-state=new connection-nat-state=!dstnat in-interface=pppoe-out1
chain=forward action=drop connection-state=new connection-nat-state=!dstnat in-interface=ether24

3

Already tried. It doesn’t work.

In this allow rule, packets counter increases while pinging a machine on another vlan but it increases as well on the next rule (the dropping one).
Any idea ?

4

Obviously, communication is a two way business. You are getting packets there but not back. Try adding a corresponding dst-address rule:

chain=forward action=accept in-interface=all-vlan out-interface=all-vlan src-address=allo.wed.host.ip
chain=forward action=accept in-interface=all-vlan out-interface=all-vlan dst-address=allo.wed.host.ip

5

You’re right, I must allow packets in both directions
It works , thanks

6

Sorry, I missed rule order:

chain=forward action=accept in-interface=all-vlan out-interface=all-vlan src-address=allo.wed.host.ip 
chain=forward action=accept connection-state=established,related
chain=forward action=drop in-interface=all-vlan out-interface=all-vlan
chain=forward action=drop connection-state=invalid
chain=forward action=drop connection-state=new connection-nat-state=!dstnat in-interface=pppoe-out1
chain=forward action=drop connection-state=new connection-nat-state=!dstnat in-interface=ether24

even better:

chain=forward action=accept in-interface=all-vlan out-interface=all-vlan src-address=allo.wed.host.ip connection-state=new
chain=forward action=accept connection-state=established,related
chain=forward action=drop in-interface=all-vlan out-interface=all-vlan
chain=forward action=drop connection-state=invalid
chain=forward action=drop connection-state=new connection-nat-state=!dstnat in-interface=pppoe-out1
chain=forward action=drop connection-state=new connection-nat-state=!dstnat in-interface=ether24



However, I need some host in a single Vlan to access all hosts in the other Vlans

@sid5632:
I understood that single host should be the one able to connect to the others, that is, initiate the connections and not viceversa; with your suggested ruleset other vlan hosts can initiate connections to allo.wed.host.ip with no restrictions.

7

Agreed.

8

Confirm, new order , it works !