I got ccr3xx switch. All ports are into bridge. HW offloading only possible on one bridge.
Is there any way to make ONLY one switch port A send or receive packets from or to other switch port B in same bridge. Port B should be able communicate with other bridge ports, but port A should work only with B port
Bridge horizon deactivates hw offloading.
Any ideas ? Thank You
.
I think this should be possible, in both the stateless firewall (HW ACL FW) as well in the stateful firewall (SW CPU FW).
For ACL you can check this: https://wiki.mikrotik.com/wiki/Manual:CRS3xx_series_switches#Switch_Rules_.28ACL.29
Ie. should be something like this:
/interface ethernet switch rule
add ports=ether1 new-dst-ports=ether2 …
add ports=ether2 new-dst-ports=ether1 …
.
Another option is to assign each of the two interfaces an IP + netmask, see “/ip address print”.
The result then can also be used in the above ACL with “src-address” and “dst-address”, cf. the above link.
Of course also port isolation via a VLAN could be used → https://wiki.mikrotik.com/wiki/Manual:Switch_Chip_Features#Port_isolation
But I haven’t tried these out myself, just some ideas.
See also http://forum.mikrotik.com/t/using-horizon-on-bridges-with-multiple-wan/52725/1