First sorry my English, but I will try to be as simple as possible.
I have a RB750G with two interfaces internal LANs,
network 10.x
network 20.x
And each internal network, has its respective DHCP server, DNS, QoS,
I created two internal interfaces, just to split the traffic between the two networks. Each Mikrotik interface is attached to a respective VLAN (layer 2) with my Switch HP.
The problem I am facing is that being in the 10.x network, I can communicate with other computers on the network 20.x. With the use of Vlans this could not be happening.
It seems that the internal interfaces of Mikrotic, are allowing routing between themselves. Does anyone know how ressolver this?
I thank you for this space and excuse the spelling errors.
k19ylx.png
No, it would only not happen if you had the VLANs configured on a switch with no router in the picture. The 750G is a router, it knows about both networks and is probably even set up to act as the default gateway for machines on both networks, so it will happily route traffic between the two networks, just as it is designed to do.
If you don’t want the two networks to be able to have traffic routed between each other, you need to create firewall rules in the router to prevent it.
I created this rule between interfaces (LAN) Mikrotik. The communication between the computers of the two networks were rejected, and this is very good that happened. But now, I have another problem. Because a computer in the 20.x network could perform a successful ping to the gateway network 10.x?
One comment - when you want to completely stop LAN1 from talking to LAN2, I would not put IP addresses in the rules - the interfaces are enough to block the traffic. The IP addresses “open a hole” in your security - suppose a host on LAN1 sends a spoofed-source packet to LAN2. Spoofed replies would forward as well.
Besides the router can process the rule faster with less fields to compare.
As for "no pings to 192.168.10.1 from 192.168.20.x - those blocks go in the INPUT chain because such packets are talking to the Mikrotik itself. (INPUT = to the mikrotik regardless of interface, FORWARD means through the Mikrotik like a router)
Add these two rules to the input chain:
drop dst-address = 192.168.10.1 in-interface ! ether1-LAN (the ! means ‘not’ and is a checkbox next to the interface name field in winbox)
drop dst-address = 192.168.20.1 in-interface ! ether2-LAN
Good night,
I think I’m in trouble again between routing subnets
I did this the way down, I do not know if it’s right.
Lately I’ve noticed that I can access my services on the network 10 even when connected to the network 20. I find it strange that the IPScan in the network 20, finds no network address 10, and also the ping between the two networks (10 and 20) do not communicate. So how I can access a Web server that is on the network 10? This could not happen. Anyone have any tips?
I would suggest that you remove the src/dst IP addresses from your rules - just use the interface names.
Probably what’s happening to you is that you have some other rule earlier in the filter chain which allows forwarding traffic between these two networks.
I did what you said to me, removed the address of the network of rules and yet still have access to network 10.x.
What I find strange is that I can access my server on the network 10, but the ICMP protocol does not work. I do not understand, I could not access this server (192.168.10.250). I do not have another rule that allows routing between networks.
192.168.10.250 is probably blocking pings. You probably can’t ping it from other 10.x hosts either.
(there are other possibilities)
Open a terminal and issue this command:
/ip firewall export compact
Post the results here.
(feel free to hide public IPs by changing them to x.x.x.101 - and if you have multiple public IPs from different providers, be sure it’s still obvious which is which, so make the second y.y.y.94, etc…)
No problem dude!
below is the output of the export command. Unfortunately, the comments of the rules are in Portuguese, but I think you can understand the logic of the rules.
add action=redirect chain=dstnat comment="logs MK Web Proxy" dst-port=80 protocol=tcp to-ports=8080
This rule means that web traffic is going to be redirected to the local proxy.
This is why your forward rule isn’t blocking web traffic, because technically, the traffic isn’t forwarding through the router.
The router is intercepting www traffic, and then generating a new request to the .20 network using its own IP address.
You would need to block such requests in the proxy configuration.
You’re right, my friend, I disabled this rule and communication between subnets does not happen, but I need this active rule because this rule is used to generate access logs of my web proxy. I use this application to export the websites accessed for other management software. Follow this tutorial below:
The ! means NOT, so the proxy will be avoided for anything whose IP address is in the 20 network, and then it will just get blocked by the filter table.
Unfortunately this exception that you gave me does not work. With this rule above, the connectivity between the two networks turn to speak. The connectivity between the two networks does not work if I disable this rule, this is very good, It was what I really wanted to thank , but the problem is that if I disable this rule below my web proxy filter no longer captures the pages browsed.
add action=redirect chain=dstnat comment=“logs MK Web Proxy” dst-port=80 protocol=tcp to-ports=8080
Does anyone have any light to this problem above? I am with this rule below disabled, thanks to the help of my friend ZeroByte
add action=redirect chain=dstnat comment=“logs MK Web Proxy” dst-port=80 protocol=tcp to-ports=8080
The traffic between the two subnets are not talking, that’s great, but I’m not capturing traffic on browsed pages on my Web Proxy because without this rule disabled, I can not check the pages accessed by my customers.
I think I’ll have to replace the door of my apache server to another port other than 80.
Maybe this way, I will not be able to access more of my servers on the network 10, standing on 20 network.
Just changed the default ports of my apache servers in 8012 and 8013. Before the default port was 80 and I believe that was giving conflicting with web proxy. Now I can use the transparent proxy web, filtering all traffic entering the two subnetworks (10.x and 20.x), without the risk of talking to the network servers 10.x
friend
