(solved) block traffic between subnets

RouterOS General
1

Hello,

Is there better way to block traffic between 20 subnets on CCR other then creating (20+19+18+..+1) firewall filter rules like this one:
add action=drop chain=forward dst-address=192.168.21.0/24 src-address=192.168.22.0/24

(subnets are not in sequence, but all listed in IP/Adressess )

2

Yes, use the src and dst address lists

3

Thank you. That was easy…

4

No, problem, glad I could help :slight_smile:

5

You could also use the ‘not’ parameter.

6

Not sure I understand. I know what “not” or “!” is, but where and how I can use it?

7

Create a rule where you block traffic if dst-address is not sex-address. Then you only need 20 rules.
But I do not know your full config, so maybe I’m missing something.

8

Here is the answer from here:
http://forum.mikrotik.com/t/new-firewall-matcher-connection-rate/31487/1

First, make accept rules for each subnet (src to dst) like:
/ip firewall filter add chain=forward action=accept src-address=192.168.0.0/24 dst-addresss=192.168.0.0/24

Then, make one list of all subnets (ALL_subnets) and make rule:
/ip firewall filter add chain=forward action=drop src-address-list=ALL_subnets dst-address-list=All-subnets