Very begin problem, separation, RB951

I need to create this network on RB951G-2HnD router (see attachment picture):

PC1-3 is not supposed to see each other, but each computer must see the printer separately.

How is easy way to do…?

[sorry, my English is parallel to Mikrotik administration skills :slight_smile: ]

best regards
Krzysiek
siec_separacja.png

ether2 192.168.2.1/24
ether3 192.168.3.1/24
ether4 192.168.4.1/24
ether5 192.168.4/24

So each gets ip address, ip pool, dhcp-server and dhcp-server-network

Inteface Members
ether2 list=LAN
ether3 list=LAN
ether4 list=LAN
ether5 list=Printer

Firewall Rules forward chain besides most of the forward chain default rules…
add chain=forward action=accept in-interface-list=LAN out-interface-list=WAN (to get internet access for users)
add chain=forward action=accept in-interface-list=LAN out-interface-list=Printer dst-address=IP of printer
add chain=forward action=drop comment=“drop all else” (this has to be your last rule in the forward chain)