Use ip firewall in bridge - 6.1 bug ?

RouterOS General
1

I have two similar configurations on Mikrotik’s, one of them have OS v 5, and second 6.1. When on second(6.1) I enable use-ip-firewall in bridge, i can’t connect from interface ether2 to Internet. On ether2 i have untagged device(laptop). When firewall is off, everything work ok. Why it’s happend ?

Settings in switch: VLANMode = ‘disable’, VLAN header = ‘leave as is’

Other settings:

feb/20/2014 19:03:23 by RouterOS 6.1

software id = A17C-D923

/interface bridge
add l2mtu=1598 name=Bridge_Manage
add name=Bridge_Tranzyt
add l2mtu=1594 name=Bridge_vlan_799
/interface ethernet
set 0 auto-negotiation=no name=ether1
set 1 auto-negotiation=no name=ether2
set 9 name=ether10
set 10 name=sfp1 sfp-rate-select=low
/interface vlan
add interface=Bridge_Manage l2mtu=1594 name=vlan_724 vlan-id=724
add interface=Bridge_Manage l2mtu=1594 name=vlan_726 vlan-id=726
add interface=Bridge_Manage l2mtu=1594 name=vlan_798 vlan-id=798
add interface=Bridge_Manage l2mtu=1594 name=vlan_799 vlan-id=799
/interface bridge filter
add action=mark-packet chain=input in-bridge=Bridge_Tranzyt new-packet-mark=
ogranicz
/interface bridge port
add bridge=Bridge_Manage interface=sfp1
add bridge=Bridge_vlan_799 interface=ether2
add bridge=Bridge_Manage interface=ether1
add bridge=Bridge_Manage interface=ether10
add bridge=Bridge_vlan_799 interface=vlan_799
/interface bridge settings
set allow-fast-path=no use-ip-firewall-for-vlan=yes

\

feb/20/2014 19:04:52 by RouterOS 6.1

software id = A17C-D923

/ip firewall connection tracking
set enabled=yes
/ip firewall mangle
add action=mark-packet chain=forward disabled=yes in-interface=
vlan_726 new-packet-mark=ogranicz

2

Im very interested in how this can be solved…might be at the root of my own issue!

3

It probably is. This is also described in http://forum.mikrotik.com/t/vlan-with-ip-firewall/70581/1

Inexplicably, it has gotten absolutely no attention despite the fact it should be a core router function.

At this point I would be happy for a workaround that is not going to break in the next version …

4

Reported in ticket # 2014090366000794

MikroTik Support replies:

Hello,

We have managed to reproduce your issue and it has been reported to our programmers. Hopefully they will be able to fix it as soon as possible.

Please follow to our download page where latest versions and release candidate versions of RouterOS are being uploaded. We hope that we will manage to fix it until next full release.

Regards,
Martins S.