Hi to All
I have a hotspot network with lan users , i want to configure another rb750 to replace the switch , that the users connected in it to not show each other. For example to hide windows shares ext.
Waiting your response
why not just block the windows share port on the RB750?
toni17, users on the same network will connect directly to each other, and will not go through the router internal process, so firewall will not work.
hey,
sorry for interrupting you sir but i need to ask you
how can i block a specific website to a ip or user example i don t want to let the user X with an ip 192.168.6.23 to go to www.facebook.com
but i want to let user Y with an ip 192.168.6.56 to access to facebook.com
anyone can help plz?
make a separate topic please, don’t post unrelated question in an existing topic
ok i m sorry but i m a new member and i can t find how to make a new topic and i m not authorized to compose a new message
if you can help me plz
click this link:
http://forum.mikrotik.com/posting.php?mode=post&f=13
ok thank you
I know. I’ve tried this by the firewall a lot of times, it doesent works.
Does it have any way do cofigure the rb750 as a managed switch?
It WILL go through the firewall if you put the ports into BRIDGE, and then check the box for the bridge to use IP FIREWALL.
Do you have any sample about this?
In winbox, look at bridge, and on the first tab labeled bridge hit the settings button.
Are you sticking APs on the end of each of the ports?
Something to keep in mind: If you have two users on the same AP, traffic between the two will not go through the RB750
In Firewall i’ve putted many rules incl antiviruses etc .
So you mean if i activate the firewall option in Bridged ports all trafic in the brides will pass through the Firewall? And my problem with the users to not show each other (who is on line and windows shares) will be firewalled?
Correct, if you active USE IP BRIDGE, then the bridge traffic goes through the firewall (traffic between the ports listed in the bridge… not traffic on an external switch and not traffic between wireless users). As stated above, if they are wireless then you need to use AP isolation to keep them from seeing each other as well.
Tried this but no sucess. From my computer i can see others computers. In main firewall i’ve blocked ports 135-139 & 445 tcp & udp. are they the ports that block that? I don’t use wireless AP only 40 lan users. Do i need to make something else to work this?
Show your rules here
These are all my Firewall rules
/ip firewall filter
add action=passthrough chain=unused-hs-chain comment=“place hotspot rules here” disabled=yes
add action=passthrough chain=unused-hs-chain comment=“place hotspot rules here” disabled=yes
add action=accept chain=forward comment=“allow established connections” connection-state=established
disabled=no
add action=accept chain=forward comment=“allow related connections” connection-state=related
disabled=no
add action=drop chain=forward comment=“drop invalid connections” connection-state=invalid disabled=
no
add action=drop chain=virus comment=“Drop Blaster Worm” disabled=no dst-port=135-139 protocol=tcp
add action=drop chain=virus comment=“Drop Messenger Worm” disabled=no dst-port=135-139 protocol=udp
add action=drop chain=virus comment=“Drop Blaster Worm” disabled=no dst-port=445 protocol=tcp
add action=drop chain=virus comment=“Drop Blaster Worm” disabled=no dst-port=445 protocol=udp
add action=drop chain=virus comment=________ disabled=no dst-port=593 protocol=tcp
add action=drop chain=virus disabled=no dst-port=1024-1030 protocol=tcp
add action=drop chain=virus comment=“Drop MyDoom” disabled=no dst-port=1080 protocol=tcp
add action=drop chain=virus disabled=no dst-port=1214 protocol=tcp
add action=drop chain=virus comment=“ndm requester” disabled=no dst-port=1363 protocol=tcp
add action=drop chain=virus comment=“ndm server” disabled=no dst-port=1364 protocol=tcp
add action=drop chain=virus comment=“screen cast” disabled=no dst-port=1368 protocol=tcp
add action=drop chain=virus comment=hromgrafx disabled=no dst-port=1373 protocol=tcp
add action=drop chain=virus comment=cichlid disabled=no dst-port=1377 protocol=tcp
add action=drop chain=virus comment=Worm disabled=no dst-port=1433-1434 protocol=tcp
add action=drop chain=virus comment=“Bagle Virus” disabled=no dst-port=2745 protocol=tcp
add action=drop chain=virus comment=“Drop Dumaru.Y” disabled=no dst-port=2283 protocol=tcp
add action=drop chain=virus comment=“Drop Beagle” disabled=no dst-port=2535 protocol=tcp
add action=drop chain=virus comment=“Drop Beagle.C-K” disabled=no dst-port=2745 protocol=tcp
add action=drop chain=virus comment=“Drop MyDoom” disabled=no dst-port=3127-3128 protocol=tcp
add action=drop chain=virus comment=“Drop Backdoor OptixPro” disabled=no dst-port=3410 protocol=tcp
add action=drop chain=virus comment=Worm disabled=no dst-port=4444 protocol=tcp
add action=drop chain=virus comment=Worm disabled=no dst-port=4444 protocol=udp
add action=drop chain=virus comment=“Drop Sasser” disabled=no dst-port=5554 protocol=tcp
add action=drop chain=virus comment=“Drop Sasser” disabled=no dst-port=8866 protocol=tcp
add action=drop chain=virus comment=“Drop Dabber.A-B” disabled=no dst-port=9898 protocol=tcp
add action=drop chain=virus comment=“Drop Dumaru.Y” disabled=no dst-port=10000 protocol=tcp
add action=drop chain=virus comment=“Drop MyDoom.B” disabled=no dst-port=10080 protocol=tcp
add action=drop chain=virus comment=“Drop NetBus” disabled=no dst-port=12345 protocol=tcp
add action=drop chain=virus comment=“Drop Kuang2” disabled=no dst-port=17300 protocol=tcp
add action=drop chain=forward comment=“Drop SubSeven” disabled=no dst-port=27374 protocol=tcp
add action=drop chain=virus comment=“Drop PhatBot, Agobot, Gaobot” disabled=no dst-port=65506
protocol=tcp
add action=jump chain=forward comment=“jump to the virus chain” disabled=no jump-target=virus
add action=accept chain=forward comment=“Allow HTTP” disabled=no dst-port=80 protocol=tcp
add action=accept chain=forward comment=“Allow SMTP” disabled=no dst-port=25 protocol=tcp
add action=accept chain=forward comment=“allow TCP” disabled=no protocol=tcp
add action=accept chain=forward comment=“allow udp” disabled=no protocol=udp
add action=accept chain=forward comment=“allow ping” disabled=no protocol=icmp
add action=drop chain=forward comment=“drop everything else” disabled=no
add action=drop chain=input comment=“drop ftp brute forcers” disabled=no dst-port=21 protocol=tcp
src-address-list=ftp_blacklist
add action=accept chain=output content=“530 Login incorrect” disabled=no dst-limit=
1/1m,9,dst-address/1m protocol=tcp
add action=add-dst-to-address-list address-list=ftp_blacklist address-list-timeout=3h chain=output
content=“530 Login incorrect” disabled=no protocol=tcp
add action=drop chain=input comment=“drop ssh brute forcers” disabled=no dst-port=22 protocol=tcp
src-address-list=ssh_blacklist
add action=add-dst-to-address-list address-list=ssh_blacklist address-list-timeout=1w3d chain=input
connection-state=new disabled=no dst-port=22 protocol=tcp src-address-list=ssh_stage3
add action=add-dst-to-address-list address-list=ssh_stage3 address-list-timeout=1m chain=input
connection-state=new disabled=no dst-port=22 protocol=tcp src-address-list=ssh_stage2
add action=add-dst-to-address-list address-list=ssh_stage2 address-list-timeout=1m chain=input
connection-state=new disabled=no dst-port=22 protocol=tcp src-address-list=ssh_stage1
add action=add-dst-to-address-list address-list=ssh_stage1 address-list-timeout=1m chain=input
connection-state=new disabled=no dst-port=22 protocol=tcp
add action=drop chain=forward comment=“drop ssh brute downstream” disabled=no dst-port=22 protocol=
tcp src-address-list=ssh_blacklist
add action=drop chain=forward disabled=no dst-port=9996 protocol=tcp
add action=drop chain=forward disabled=no dst-port=995-999 protocol=udp
add action=drop chain=forward disabled=no dst-port=53 protocol=tcp
add action=drop chain=forward disabled=no dst-port=55 protocol=tcp
ONLY computers plugged DIRECTLY into the router are affected. If you have “40 computers” then you are obviously using an external switch between the computers and the router. (The RB 750 does not have 40 ports). The traffic goes from computer to computer THROUGH THE SWITCH and it NEVER reaches the router at all.
Plug 2 computers directly into the RB750, put those ports in a bridge, and then see if those 2 computers can see each other. They shouldn’t be able to.
If you just want to prevent all client ports from talking to each other and only allow the uplink port just put all ports into a bridge and set the SAME value for bridge-horizon for all client ports.
This assumes all computers are plugged into the router. If you are using an external switch between the clients and router, then nothing on the router will affect this.