Hello everyone, I recently bought a MikroTik HAP ac2 . My intention was to set up a separate network for my neighbo r. As someone working in the IT field with decent networking knowledge (but zero experience with MikroTik), I believe I’ve managed to achieve my goal. However, I have two problems that I can’t seem to figure out the origin of:
– The first issue is that even though I can’t ping any hosts on network B (192.168.40.0/24) from network A (10.10.40.0/24), I can still ping the gateway (192.168.40.1) of network B. This is strange, especially since when I run an nmap scan from network B to network A, it shows zero hosts as up.
– The second issue is regarding the firewall rule I set up to block traffic. It was intended to block traffic only in one direction , from A to B, and not the other way around. I haven’t been able to figure out how to achieve this.
Thank you in advance to anyone who is willing to help!
tangent
September 16, 2023, 4:36pm
2
Show your configuration per item B here .
Also, do you have an “ax2” or an “ac2”? It may matter.
It’s an HAP AC2
I removed the serial nr and wifi password, my wan ip is private.
# sep/17/2023 20:42:06 by RouterOS 6.49.10
# software id = ARZ4-ZY3F
#
# model = RBD52G-5HacD2HnD
# serial number =
/interface bridge
add name=Temp_bridge
add name=bridge_guest
add admin-mac=18:FD:74:8D:69:24 auto-mac=no name=bridge_private
/interface ethernet
set [ find default-name=ether1 ] comment="-- WAN --" name=ether1_WAN
set [ find default-name=ether2 ] name=ether2_LAN
/interface wireless
set [ find default-name=wlan1 ] band=2ghz-b/g/n channel-width=20/40mhz-XX \
comment="-- Wi-Fi --" country=italy disabled=no distance=indoors \
frequency=auto installation=indoor mode=ap-bridge ssid=MikroTik-2.4G \
wireless-protocol=802.11 wps-mode=disabled
set [ find default-name=wlan2 ] band=5ghz-a/n/ac channel-width=\
20/40/80mhz-XXXX country=italy disabled=no distance=indoors frequency=\
auto installation=indoor mode=ap-bridge ssid=MikroTik-5G \
wireless-protocol=802.11
add default-forwarding=no disabled=no keepalive-frames=disabled mac-address=\
1A:FD:74:8D:69:28 master-interface=wlan1 multicast-buffering=disabled \
name=wlan_guest ssid=Wi-Fi_Test wds-cost-range=0 wds-default-cost=0 \
wps-mode=disabled
/interface wireless manual-tx-power-table
set wlan1 comment="-- Wi-Fi --"
/interface wireless nstreme
set wlan1 comment="-- Wi-Fi --"
/interface list
add comment=defconf name=WAN
add comment=defconf name=LAN
add name=GUEST
/interface wireless security-profiles
set [ find default=yes ] authentication-types=wpa2-psk mode=dynamic-keys \
supplicant-identity=MikroTik wpa-pre-shared-key= \
wpa2-pre-shared-key=
/ip pool
add name=dhcp ranges=192.168.88.10-192.168.88.254
add name=dhcp_pool1 ranges=10.10.40.2-10.10.40.254
add name=dhcp_pool2 ranges=192.168.40.2-192.168.40.254
add name=dhcp_pool3 ranges=192.168.40.2-192.168.40.254
/ip dhcp-server
add address-pool=dhcp disabled=no interface=bridge_private name=defconf
add address-pool=dhcp_pool1 disabled=no interface=bridge_guest name=dhcp1
add address-pool=dhcp_pool3 disabled=no interface=Temp_bridge name=dhcp2
/interface bridge port
add bridge=Temp_bridge comment=defconf interface=ether2_LAN
add bridge=Temp_bridge comment=defconf interface=ether3
add bridge=Temp_bridge comment=defconf interface=ether4
add bridge=Temp_bridge comment=defconf interface=ether5
add bridge=Temp_bridge comment=defconf interface=wlan1
add bridge=Temp_bridge comment=defconf interface=wlan2
add bridge=bridge_guest interface=wlan_guest
/ip neighbor discovery-settings
set discover-interface-list=LAN
/ip settings
set rp-filter=strict tcp-syncookies=yes
/interface list member
add comment=defconf interface=bridge_private list=LAN
add comment=defconf interface=ether1_WAN list=WAN
add interface=bridge_guest list=GUEST
add interface=Temp_bridge list=LAN
/ip address
add address=192.168.88.1/24 disabled=yes interface=bridge_private network=\
192.168.88.0
add address=192.168.1.45 interface=ether1_WAN network=192.168.1.1
add address=10.10.40.1/24 interface=bridge_guest network=10.10.40.0
add address=192.168.40.1/24 interface=Temp_bridge network=192.168.40.0
/ip dhcp-client
add comment=defconf disabled=no interface=ether1_WAN
/ip dhcp-server network
add address=10.10.40.0/24 dns-server=1.1.1.1,1.0.0.1 gateway=10.10.40.1
add address=192.168.40.0/24 dns-server=1.1.1.1,8.8.8.8 gateway=192.168.40.1
add address=192.168.88.0/24 dns-server=1.1.1.1,1.0.0.1 gateway=192.168.88.1
/ip dns
set allow-remote-requests=yes servers=1.1.1.1,8.8.8.8
/ip dns static
add address=192.168.88.1 comment=defconf name=router.lan
/ip firewall filter
add action=accept chain=forward connection-limit=100,32 disabled=yes \
fragment=no hotspot="" in-interface=bridge_private log=yes out-interface=\
bridge_guest
add action=drop chain=forward disabled=yes dst-address=192.168.40.1 \
src-address=10.10.40.0/24
add action=drop chain=forward comment=\
"regola per bloccare traffico dalla guest" dst-address=192.168.40.0/24 \
in-interface=bridge_guest log=yes out-interface=Temp_bridge src-address=\
10.10.40.0/24
add action=accept chain=input comment=\
"defconf: accept established,related,untracked" connection-state=\
established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=\
invalid
add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp
add action=accept chain=input comment=\
"defconf: accept to local loopback (for CAPsMAN)" dst-address=127.0.0.1
add action=drop chain=input comment="defconf: drop all not coming from LAN" \
in-interface-list=!LAN
add action=accept chain=forward comment="defconf: accept in ipsec policy" \
ipsec-policy=in,ipsec
add action=accept chain=forward comment="defconf: accept out ipsec policy" \
ipsec-policy=out,ipsec
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" \
connection-state=established,related
add action=accept chain=forward comment=\
"defconf: accept established,related, untracked" connection-state=\
established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" \
connection-state=invalid
add action=drop chain=forward comment=\
"defconf: drop all from WAN not DSTNATed" connection-nat-state=!dstnat \
connection-state=new in-interface-list=WAN
/ip firewall nat
add action=masquerade chain=srcnat comment="defconf: masquerade" \
ipsec-policy=out,none out-interface-list=WAN
add action=masquerade chain=srcnat dst-address-list="" src-address=\
10.10.40.0/24
add action=masquerade chain=srcnat src-address=192.168.40.0/24
/ip route
add disabled=yes distance=1 gateway=192.168.1.1
/ip route rule
add action=drop dst-address=192.168.88.0/24 src-address=10.10.40.0/24
/ip service
set telnet disabled=yes
set www disabled=yes
set ssh disabled=yes
set api disabled=yes
set winbox address=192.168.88.0/24,192.168.40.0/24
set api-ssl disabled=yes
/system clock
set time-zone-name=Europe/Rome
/system identity
set name=RouterOS
/system package update
set channel=testing
/tool mac-server
set allowed-interface-list=LAN
/tool mac-server mac-winbox
set allowed-interface-list=LAN
bpwl
September 17, 2023, 7:11pm
4
Traffic to local addresses on the hAP are normally filtered by the “input” chain, not by the “forward” chain in the firewall.
(Test with Traceroute to the other-interface’s IP address of the hAP only shows one hop, it is not forwarded)
IPv4 Address. . . . . . . . . . . : 192.168.212.201
Subnet Mask . . . . . . . . . . . : 255.255.255.0
Default Gateway . . . . . . . . . : 192.168.212.3
C:\>tracert 192.168.2.2
Tracing route to 192.168.2.2 over a maximum of 30 hops
1 3 ms 3 ms 3 ms 192.168.212.4
2 4 ms 3 ms 3 ms 192.168.2.2
Trace complete.
C:\>tracert 192.168.2.3
Tracing route to 192.168.2.3 over a maximum of 30 hops
1 3 ms 3 ms 3 ms 192.168.2.3
Trace complete.
It was intended to block traffic only in one direction, from A to B, and not the other way
Traffic or session initiation ?
anav
September 17, 2023, 11:50pm
5
No need for two bridges................
Okay since the .88 subnet is DISABLED and no ports are assigned to private LAN, will assume the .88 network is extra/ignore.
Also, you should not be able to ping hosts on the neighbours router or are you intent on spying??
Code: Select all
/interface bridgeadd name=bridge1 vlan-filtering=yes { add =yes this as last step of config }{ ---> delete .88 pool <--- } comment=guest comment=private ---> deleted duplicate pool3 <----- }{ ---> delete .88 dhcp server <--- } l2 interface=vlan-private name=dhcp2MANAGE loose tcp-syncookies=no
keep firewall chains together, all input and all forward much easier to read. ONly need one masquerade rule.
/ip firewall address-list { from static dhcp leases }Authorized comment="admin desktop"add action=accept chain=input src-address-list=Authorized { add this line once authorized rule and address list are in place }add action=accept chain=forward comment="internet" in-interface-list=LAN out-interface-list=WAN NONE MANAGE