Separate IP ranges with CRS125 not really separated

RouterOS Beginner Basics
1

Hi,

I recently bought a MikroTik CRS125-24G-1S-RM.
What I want to achieve is 4 separated LANS with some connection between the LANs.
172.12.1.0/24 internal LAN (work)
172.12.65.0/24 guest LAN
172.12.129/24 VOIP LAN
172.12.254/24 “outer” LAN with my provider’s internet router

I set up 4 port groups using the master port feature, assigned an Interface address to each port group a default route to the “outer” router.

My problem: pings (and off course more) are possible between all “separate” LANs - I didn’t expect this. Even with an explicit drop rule in the firewall pings between the LANs are possible.

Any help appreciated.

TIA
Michael

2

Hello,

It’s because you do not have a forward chain in DROP.

3

This firewall setup will give you the effect you want.
(I assume ether1 is your wan interface, but use whatever interface name is your WAN - if you’re using PPPoE, then specify that interface and not the physical ethernet interface)

/ip firewall filter
add action=fasttrack-connection chain=forward connection-state=established,related
add action=accept chain=forward connection-state=established,related
add action=accept chain=forward out-interface=ether1
add action=drop chain=forward

add action=accept chain=input connection-state=established,related
add action=accept chain=input protocol=icmp
add action=accept chain=input in-interface=!ether1
add action=drop chain=input