Router + dedicated AP = no VLAN isolation

t430 · July 3, 2022, 6:10pm

I took that idea from here http://forum.mikrotik.com/t/using-routeros-to-vlan-your-network/126489/1 where the attached .rsc file’s firewall rules are pretty elegantly minimalist:

##################
# FORWARD CHAIN
##################
add chain=forward action=accept connection-state=established,related comment="Allow Estab & Related"

# Allow all VLANs to access the Internet only, NOT each other
add chain=forward action=accept connection-state=new in-interface-list=VLAN out-interface-list=WAN comment="VLAN Internet Access only"

add chain=forward action=drop comment="Drop"

… and I just realized that in my “drop invalid” rule I forgot to remove the connection-state=“invalid”, which is why it’s not working as a catch-all drop… . Though removing the connection-state makes me lose connection altogether, but I’ll investigate that.

Something like

add action=drop chain=forward comment="vlan kill" in-interface-list=VLANS out-interface-list=VLANS

right before

add action=accept chain=forward comment=\
    "defconf: accept established,related, untracked" connection-state=\
    established,related,untracked

That should kill ALL inter-VLAN traffic, I think.

Hey, this works. thanks. I’m surprised that pinging 192.168.30.2 from 192.168.30.3 works with this rule though. .3’s interface is eg. home-vlan, which is in the VLANS list and .2’s is in the VLANS list as well (even though that’s the same VLAN), so I expected the rule you posted to drop the connection even between two devices in the same VLAN. Hmm…