Security the Network by Mikrotik MAC address selection

RouterOS Beginner Basics
1

Hello Guys!

I have been Mikrotik ill since few days :slight_smile: For the note - I have Apple Time Machine network AP before and after I change the ISP and start to study Network ability to security and configurations I have choose the Mikrotik family router - the AX2 model named MikroTik hAP ax2 (C52iG-5HaxD2HaxD-TC) ant this little box is an evil in the little hell-inside :smiley:

Basic I have watched few YouTube video about configuration and I have one conclusion - there are no professional material for this setup - I know, there is a problem to record that what the Customer have to search and what the presenter can record but still… there is a lot of bu***t material with no content. I even don’t touch the problem of version of OS… Few minutes and I know that basically most materials have older version on the presentation and Mikrotik Company do the changes so fast that options that they are showing doesn’t exist in path that they are talking about…

In short to the end… I want to secure my network with option to grand access to devices only via MAC address list. I have in network computers, TV and lot of stuff like a washing machine or refrigerator that have WiFi option and I need to give a option to communicate this devices to 2,4GHz WiFi network without blocking it by using access list focused on RADIUS or DO1X solutions.

I wonder where can I find an option to create a list of devices that using 2,4GHz channel and only they can connect to the network without more credentials options that they will be verificative using their own MAC addresses wireless cards. I know that MAC addresses is not the option to secure network, that this days its not the problem to clone the MAC address and be an device that the want to compromise but still this option is basically better then other on the start…

So I find this tutorial that I can create an access list to MAC devices (and also find an option to fast add devices to ACL) and try to change 2,4GHz ARP option to reply-only but that combination its not working. After reset the whole router I can connect to 2,4GHz wireless from device that is not in the list. I think there is a little thing I missed out in this configurations… Can You guys can help me with this to figure this out what is missing ?

In older version of RouterOS I find that this option was based on Access List and turned off no-authentication mode. In RouterOS 7.11 there is no that option and only clue is on change ARP mode. I wish that I can made an different devices access to 2,4GHz and 5GHz wireless ? I saw this option on Access List card where I have add a device - so I believe there is an option to combine this.

What about RADIUS and basic wireless devices that doesn’t support even more security encryption or security layers ? Is there an option to setup this ? So far I have no configured RADIUS Server before so I can’t say what is going on. But after saw the configuration card of that option I believe that this option is related for computer machines and not for simples devices like a hoover machine or refrigerator…

Could You help me with introduction to that topic? I read a few topics in this forum but still I have not found a working solution…

Let me know if You can :slight_smile:

2

Not exactly sure but yes radius servers is one approach, there is also hotspot functionality and kid functionality that may come into play.
Also one can set DHCP static and use ARP table to lock down what connections are permitted.

3

But what about the devices that have simple configuration mode that might doesn’t have an option to setup a static IP address ?

I have a TV that have a 5GHz wireless option and this stuff have most configurable menu that have an option to connect WiFi or LAN cable but there is no option to setup a static IP…

I don’t ever say about washing machine, refrigerator and other kitchen stuff I have with option to connect to WiFi wireless network to manage it by a designed APP that have give me access to remote control function of it.

So my question basically is how to configure a Mikrotik Router to secure connection from those devices to router according to access list of MAC addresses ?

4

MAC address filtering is amateur-hour security. It is like replacing corporate ID cards with those “My name is…” party stickers. Want to get into the C-suite bathroom for a look around? Visit the corporate leadership page on the web site and write down the CEO’s name. Walk right in, in full view of the security staff. You’ve declared yourself the CEO, so you must be the CEO, right?

To even call this mechanism “security” is to misunderstand what little it can achieve.

5

@tangent - I am agree with You about that what You are writing about. I am fully agree that the MAC address access list have end of it security after there was discovered how to clone a MAC address into the devices. But still that kind of security is better then not. Even if this is poor, the hacker need to infiltrate much more infrastructure before attack then without this security, right?

I am not focused only on secure my router by using MAC Access List to my all devices but still… I am repeated it again - no ones answer my question - how can I in other option secure access from devices called IoT (like a refrigerator) with have very poor and simple wireless network adapter ?

I have create a 2,4GHz band to only IoT devices. I am not connect to this channel any other devices what in my opinion is much more important and have much more data on it important for me. I have turned on option to isolate Client connected to this 2,4GHz channel and this is start for my how can I secure much more my network then it is default configured from box of Mikrotik router.

If You have any other suggestions - I am open to read about this and talk about this. But still… is there an option to secure IoT devices (with simples wireless network adapter) better then MAC Access List? Yes - I would like to turn RADIUS or DO1X but are these secures are compatible white these devices?

I know - there is a next question - if there are so simple are they are worth to connect into LAN and Internet? I really believe the aren’t. But this is a simple difference what should user or admin do in company environment and what he should do not do. And what it might be done in Home Use when the user know how much the data and information that he have is important and worth. In my case I know where I am and what should I do to secure my home network much more then it is configured from the box by Mikrotik product.

So if You can help me to direct to right way in this case I will be glad to hear about that. Every day I am trying setup this machine much more and still learning it since I am a owner of it from few days… Step by step I do my best and for example just finished setup the right setting to get max bandwidth on my setup of AX and AC wireless cards :slight_smile: By WiFi accessing to speed test by ~500mb/s with is for me much upgrade according to basic configuration that give me a speed rate at 150-200 mb/s :slight_smile:

So far…

6

Back in the days of wired-only Ethernet, before WiFi even existed, NICs moved over to “soft” reprogrammable MAC addresses. It’s a feature, not some secret known only to elite hackers. These days the built-in network control panel in Windows lets you change the MAC, right there from the GUI.

Then there’s the flip side of the question: how easy is it to discover allowed MAC addresses? Answer: In many cases, it’s printed right on the device, and when it isn’t, inducing the box to give up its preapproved MAC is trivial, since communication is the whole point of networking.


that kind of security is better then not

Are tissue paper welding gloves better than no gloves at all, too?

Security through obscurity isn’t useless, but it should always be coupled with actual security. Example: SSH with modern crypto is highly secure, but I move it to a nonstandard port to frustrate the script-kiddies. No serious attacker would be fooled by me moving the server off port 22, but I’ve still cut 95% of the attack traffic with a simple move, which if nothing else, keeps my logs cleaner, so I can more easily spot serious attacks.

In the same manner, I have no problem with MAC address filtering when coupled with something else that provides proper security, such as dot1x.


no ones answer my question

Why would we help you do something foolish? Doesn’t that make us partially complicit if you later get hacked, after coming to rely on your bogus security solution?


how can I in other option secure access from devices called IoT (like a refrigerator) with have very poor and simple wireless network adapter ?

See, now that’s where you’re getting smart. Instead of asking “I’ve come up with this solution, how do I make it work?” ask instead “I need to solve this problem, how should I accomplish it?” That phrasing allows people to come up with solutions you haven’t even considered.

The most common solution to the IoT isolation problem is VLANs. You can do it per-port, so that if you connect to port 3, you’re automatically put on isolated VLAN 20, and the only way to escape is to move the connection to another port, which isn’t under the IoT device’s control. This isn’t the thread to take up that topic, but you needn’t bother to start a new one. There’s a boat-load of info on VLANs already here in the archives, including this epic guide.

As for WiFi, while you can do VLANs there, too, a simpler and more effective equivalent is multiple SSIDs. It’s actually more secure than VLANs because you can use a strong PSK to prevent malefactors from hopping onto that network without permission. Even better, it’s nearly trivial to set up; if you can figure out how to fire up one SSID, you can figure out how to do two. The only tricky bit is setting up the routing to keep the subnets from commingling. But again, this isn’t the thread to take that separate topic up within.

7

Back in the days of wired-only Ethernet, before WiFi even existed, NICs moved over to “soft” reprogrammable MAC addresses. It’s a > feature> , not some secret known only to elite hackers. These days the built-in network control panel in Windows lets you change the MAC, right there from the GUI.

Yes but in the front of security - there are still companies who are using this setup to secure their connections to the network. You want to hear about it? For example most ISP operator still give You an option to connect to their router your own router but they need to add this devices MAC address into their own systems. Sic? If you want to change this device from your side, you need to clone original MAC to the old ones. Does this is have any reason to secure their from us? Next example? The big shop warehouse in his hall still using the MAC Access List to their devices to access the wireless. And this is the only two examples I have right now in my mind to show You up that this topic is isn’t insecure but that is the one of the way to have this option setup.

Then there’s the flip side of the question: how easy is it to discover allowed MAC addresses? Answer: In many cases, it’s printed right on the device, and when it isn’t, inducing the box to give up its preapproved MAC is trivial, since communication is the whole point of networking.

It the device is a device that don’t have a web panel to administrate their own setting this is the only way to give You this information before setup device in your network. Still it is better that print one own book with one MAC address into the whole of the World. I know this is not possible according to regulation of adapter card policy but still… there is more problem to get access to device from the Botton side then have access to instruction or box where this MAC is also printed. On the side of user is responsibility to secure that information. You can mark this MAC address from label on the device to secure it more…

that kind of security is better then not

Are tissue paper welding gloves better than no gloves at all, too?

Security through obscurity isn’t useless, but it should always be coupled with > actual > security. Example: SSH with modern crypto is highly secure, but I move it to a nonstandard port to frustrate the script-kiddies. No serious attacker would be fooled by me moving the server off port 22, but I’ve still cut 95% of the attack traffic with a simple move, which if nothing else, keeps my logs cleaner, so I can more easily spot serious attacks.

In the same manner, I have no problem with MAC address filtering when coupled with something else that provides proper security, such as dot1x.

I am truly agree so I even disabled port SSH for connection and even other ports I don’t need now to connect to router :slight_smile: So that is the basic configuration to secure access for me without any consultation in forum to driveby into the router from beginning…

no ones answer my question

Why would we help you do something foolish? Doesn’t that make us partially complicit if you later get hacked, after coming to rely on your bogus security solution?

how can I in other option secure access from devices called IoT (like a refrigerator) with have very poor and simple wireless network adapter ?

See, now that’s where you’re getting smart. Instead of asking “I’ve come up with this solution, how do I make it work?” ask instead “I need to solve this problem, how > should > I accomplish it?” That phrasing allows people to come up with solutions you haven’t even considered.

I am not looking for tutorial for setup my own router to my own network because that kind of tutorial doesn’t exist in any kind of topic. This is basic knowledge of own network and what user want to configure so no ones should send me a advice of what should I do step by step. I have add topic with specific question - how secure IoT devices and how to configure the router to do that. Mikrotik have no-intuitive setting in their menu for begginers and that what I can find on google doesn’t works and its unactual information.

The most common solution to the IoT isolation problem is VLANs. You can do it per-port, so that if you connect to port 3, you’re automatically put on isolated VLAN 20, and the only way to escape is to move the connection to another port, which isn’t under the IoT device’s control. This isn’t the thread to take up that topic, but you needn’t bother to start a new one. There’s a boat-load of info on VLANs already here in the archives, including > this epic guide> .

Thanks @tangent - I will check this subject. So the VLAN’s…

As for WiFi, while you can do VLANs there, too, a simpler and more effective equivalent is multiple SSIDs. It’s actually more secure than VLANs because you can use a strong PSK to prevent malefactors from hopping onto that network without permission. Even better, it’s nearly trivial to set up; if you can figure out how to fire up one SSID, you can figure out how to do two. The only tricky bit is setting up the routing to keep the subnets from commingling. But again, this isn’t the thread to take that separate topic up within.

Basic WPA2PSK is the only option into my IoT devices. I try to configured 2GHz wireless into a few methods of secure option and even when most devices was working, there was also a few ones that they stay offline and won’t connect online to router. So this is the worst problem of that subject. But You know what tangent ? You inspired me and push out-of-band on thinking what should I learn to secure my network much more individual that basic knowledge of Mikrotik secure setup :slight_smile: I try to learn about DOT1X and RADIUS in my own so maybe I find a way to change option to login those IoT devices into my network :slight_smile: Or I am thinking right now about split access from devices to the two routers - ones with will have only 2GHz access for IoT devices and second in management option with will care other devices I need to protect. I saw that option in RouterOS 7 so this is only the time I will bite it :slight_smile:
[/quote]

8

Is your point that it can’t be foolish if other companies are doing it? Companies do foolish things all the time.


most ISP operator

Not mine, and it’s the largest cable Internet operator in my country.

Regardless, MAC address filtering with cable modems isn’t for primary security but a second factor they can check in addition to your user name and password, which is the actual authentication layer. If they were depending on the MAC address to identify you for billing purposes, they wouldn’t need to give you a user name and password, now would they?


Basic WPA2PSK is the only option into my IoT devices.

Multiple SSIDs allow you to set different encryption options per SSID. This idea frees you to use better encryption on the networks that only full-featured network stacks can connect to.

If you want to couple that with MAC address whitelisting, it’s a top-level feature in the wifiwave2 driver. One might get the impression that you hadn’t even tried to read the docs before posting.

9

I’m not sure if anyone has considered Bridge > Filter. That should cover wired and wireless cases.

It’s a bit complex and I’m not the bridge filter expert either. But essentially should be three rules per device – “input”, “forward”, and “output” chains to “accept” the allowed devices. And final drop that matching the rest of traffic on that interface/VLAN ethertype. The filter rules are however unforgiving and complex logic that depends on other setting, most importantly if you’re using vlan-filtering=yes (then the matchers need to use VLAN ethertype), and more rules.

See, generally, https://help.mikrotik.com/docs/display/ROS/Bridging+and+Switching#BridgingandSwitching-BridgeFirewall

10

Another approach be /ip/hotspot and enabling it on the IOT/etc VLAN. It has MAC address controls and could whitelist there too.

And, If you have only Wi-Fi, the wifiwave2 is where to control the MACs. I’m not a fan of mucking with ARP unless strictly needed for some protocol.