rb532 Firewall

RouterOS General
1

Hello MT wiz..

I would like to firewall 3 segments of a network. my question will be what is the best way to do it and how?

the network is a fully public ip network (not 10. not 192.168)

usable IP range 2 - 126 but we are on /24 subnet (if I catch who the heck design this network I will … him :slight_smile:

ether1 123.123.123.2/24 internet gateway(123.123.123.1)
ether2 123.123.123.5/24 management
ether3 123.123.123.25/24 agent network
ether4 123.123.123.100/24 servers

I would like to point out the 123.123.123.0/24 all 3 segments of the network are on the same subnet the reason is we actually have half class C IP block and it is a bridged connection to us from the isp.


OK here is what I need
to protect local side we need to firewall internet side
there are mail servers and web servers as public

no one from internet can access any thing inside except some port 80 25, 110 on server segment

agent network can access servers and internet and not to management side

management can access anything

using smaller subnets is not an option (we do not have enough ips)
how do I firewall bridges

Sorry no nat option either the applications require real public ip

currently all the firewalling is managed by software firewalls and this is causing problems.

2

you have ip addresses from same subnet on ALL of your interfaces?

3

You can’t do that…

If they are bridged, then you need to assign all those IP Addresses on the Bridge Interface, not the Ethernets…

If you dont have enough IPs, put all your real IP addresses on the MT, run private IP addresses on your internal networks (different network per interface), and use NAT, like the rest of us :slight_smile:

4

cant do private ip the software on computers require public ip

I will contact ISP and try to get more ip’s to re subnet the network.

How about the firewalling
can I firewall a bridge i.e. for servers 123.123.123.101 - 120 on ether1 and 123.123.123.1 is the isp’s router plugged in to ether2 if I bridge ether1 and 2 with 123.123.123.100 ip assigned to the bridge

I don’t even need an ip on the bridge do I?

or do I need routed interfaces for firewalling period?