Hi. I’m setting up a Mikrotik/Capsman setup for someone.
My plan is:
Bridge-LAN: bridged with “uplink” to unknown router. I do not know the IP range. Wifi for users will go to this bridge, and users will get address from external (unknown) router.
DHCP client on this bridge to get a gateway on the router.
Bridge-GuestLAN: DHCP to guests and NAT to the DHCP-client on the other bridge.
This setup works fine in lab.
But I need a firewall rule to prevent GUEST users to access anything else then the gateway provided from the DHCP client.
How do I do this ? As I mentioned before - I do not know the IP range (and therefore the gateway). I will also like this setup to “survive” a router / subnet change so I think I need some way to identify the gateway address from the dhcp client? or just “default gateway” on the router.