Community discussions

MikroTik App
 
cadei
newbie
Topic Author
Posts: 37
Joined: Mon Apr 30, 2018 12:02 pm

Block traffic same subnet VLAN

Mon Aug 20, 2018 6:28 pm

Hi everyone.
I have a strange problem.
I have configured a bridge 10.10.0.0/24 and various Vlan (10.10.10.0/24,10.20.10/24)
The bridge is connected via trunk to a CISCO switch.
Strangely enough, I don't see traffic from the 10.10.10.0/24 network passing through my router, so the IP Firewall Filter rules don't work for me.
If I want to block traffic between two hosts on this network
A 10.10.10.20
B 10.10.10.198
DROP IP FILTER Rules do not work.
From all the other networks I have no problem.(if connected to access point)
IP FIREWALL is already active in the bridge configuration.
Where can I check this? Using TORCH I don't see traffic passing through the router
Thanks
Last edited by cadei on Tue Aug 21, 2018 6:20 pm, edited 2 times in total.
 
User avatar
xvo
Forum Guru
Forum Guru
Posts: 1237
Joined: Sat Mar 03, 2018 1:12 am
Location: Moscow, Russia

Re: Traffic same subnet

Mon Aug 20, 2018 6:49 pm

If both the device A and device B are connected to vlan-aware switch no wonder that traffic between them never even hit the router - the switch passes it directly.
You need to configure port isolation on the switch then.
 
cadei
newbie
Topic Author
Posts: 37
Joined: Mon Apr 30, 2018 12:02 pm

Re: Traffic same subnet

Mon Aug 20, 2018 7:01 pm

I had imagined it.
The problem that the other vlan work without problems.
Should it depend on a configuration on the interface of the cisco switch then?
Many thanks
 
User avatar
xvo
Forum Guru
Forum Guru
Posts: 1237
Joined: Sat Mar 03, 2018 1:12 am
Location: Moscow, Russia

Re: Traffic same subnet

Mon Aug 20, 2018 7:39 pm

I had imagined it.
The problem that the other vlan work without problems.
Should it depend on a configuration on the interface of the cisco switch then?
Many thanks
Well, then it looks like all you need, is to find a place in cisco config where these two vlans are configured differently :)
 
cadei
newbie
Topic Author
Posts: 37
Joined: Mon Apr 30, 2018 12:02 pm

Re: Traffic same subnet

Mon Aug 20, 2018 9:30 pm

Unfortunately, everything is the same.
same configuration for vlan.
Only difference
vlan 10 ARP:enabled
vlan 20 ARP:reply on.

I tried to change but the problem remains.
On vlan 20 I can use Firewall Ip filter without problems
thanks
 
User avatar
ingdaka
Trainer
Trainer
Posts: 452
Joined: Thu Aug 30, 2012 3:06 pm
Location: Albania
Contact:

Re: Traffic same subnet

Mon Aug 20, 2018 9:44 pm

Guys for 2 hosts in the same subnet no router is needed to have a connection, you are in L2 connection and router operates in L3 networking. So you need to block this traffic on switch, not in Mikrotik. If rules works form one subnet to other one, Mikrotik has done his job!
 
cadei
newbie
Topic Author
Posts: 37
Joined: Mon Apr 30, 2018 12:02 pm

Re: Traffic same subnet

Mon Aug 20, 2018 11:31 pm

The traffic between 2 hosts in the same Vlan20 can be blocked via Mikrotik
The traffic between 2 hosts in the same Vlan 10 cannot be blocked via Mikrotik
thanks
 
User avatar
xvo
Forum Guru
Forum Guru
Posts: 1237
Joined: Sat Mar 03, 2018 1:12 am
Location: Moscow, Russia

Re: Traffic same subnet

Mon Aug 20, 2018 11:35 pm

Only difference
vlan 10 ARP:enabled
vlan 20 ARP:reply on.
Disabled ARP on switch could be the answer.
After disabling it for vlan 10 did you reboot the switch or forced it to flush already learned MACs?
 
cadei
newbie
Topic Author
Posts: 37
Joined: Mon Apr 30, 2018 12:02 pm

Re: Traffic same subnet

Tue Aug 21, 2018 1:15 am

hello.
ARP is configured on mikrotik interface.
cisco switch it used only at L2 (tagged port) using a trunk port.
 
User avatar
xvo
Forum Guru
Forum Guru
Posts: 1237
Joined: Sat Mar 03, 2018 1:12 am
Location: Moscow, Russia

Re: Traffic same subnet

Tue Aug 21, 2018 1:38 am

hello.
ARP is configured on mikrotik interface.
cisco switch it used only at L2 (tagged port) using a trunk port.
Well, there must be something in Cisco switch that is configured differently for this two vlans, that makes the switch send frames in vlan20 to mikrotik instead of to send them directly to the recipient.
And while you think things are "working" for vlan20 and not vlan10, actually it is the opposite - the correct default behaviour for the switch is the one seen in vlan10.
 
cadei
newbie
Topic Author
Posts: 37
Joined: Mon Apr 30, 2018 12:02 pm

Re: Traffic same subnet

Tue Aug 21, 2018 10:24 am

Simplistically I mentioned only 2 vlan.
Actually there are 8 vlan in the network and they all work like vlan20. :D
Thanks
 
User avatar
xvo
Forum Guru
Forum Guru
Posts: 1237
Joined: Sat Mar 03, 2018 1:12 am
Location: Moscow, Russia

Re: Traffic same subnet

Tue Aug 21, 2018 11:54 am

Simplistically I mentioned only 2 vlan.
Actually there are 8 vlan in the network and they all work like vlan20. :D
Thanks
Anyway, the answer has to be in cisco config.
 
cadei
newbie
Topic Author
Posts: 37
Joined: Mon Apr 30, 2018 12:02 pm

Re: Traffic same subnet

Tue Aug 21, 2018 1:02 pm

I checked everything on the cisco configuration. Everything seems to be the same
Do you have any suggestions?
 
User avatar
xvo
Forum Guru
Forum Guru
Posts: 1237
Joined: Sat Mar 03, 2018 1:12 am
Location: Moscow, Russia

Re: Traffic same subnet

Tue Aug 21, 2018 1:52 pm

I checked everything on the cisco configuration. Everything seems to be the same
Do you have any suggestions?
Any PVLANs, or protected/isolated ports configured on the switch?
But that would explain the situation when two hosts in one vlan CAN'T talk to each other, not the situation when they CAN but through mikrotik.
So there must be something else.
 
cadei
newbie
Topic Author
Posts: 37
Joined: Mon Apr 30, 2018 12:02 pm

Re: Traffic same subnet

Tue Aug 21, 2018 2:17 pm

Not, I didn't set any port to protected.
I remind you that normally in order not to communicate 2 hosts I have to set a "drop" in IP filter Firewall.
 
User avatar
xvo
Forum Guru
Forum Guru
Posts: 1237
Joined: Sat Mar 03, 2018 1:12 am
Location: Moscow, Russia

Re: Traffic same subnet

Tue Aug 21, 2018 2:49 pm

Not, I didn't set any port to protected.
I remind you that normally in order not to communicate 2 hosts I have to set a "drop" in IP filter Firewall.
I'm still talking about cisco switch.
There's nothing strange in mikrotik's bridge behaviour: if it gets frames from cisco - it forwards them, unless you intentionally forbid it by firewall, if it doesn't get frames from cisco, well, it does nothing.
 
cadei
newbie
Topic Author
Posts: 37
Joined: Mon Apr 30, 2018 12:02 pm

Re: Traffic same subnet

Tue Aug 21, 2018 3:05 pm

I cleared arp cache on vlan10 cisco switch.
Also, I disabled ip arp-proxy, with no success
 
User avatar
xvo
Forum Guru
Forum Guru
Posts: 1237
Joined: Sat Mar 03, 2018 1:12 am
Location: Moscow, Russia

Re: Traffic same subnet

Tue Aug 21, 2018 3:30 pm

I cleared arp cache on vlan10 cisco switch.
Also, I disabled ip arp-proxy, with no success
Could it possibly be that this was done for all vlans except vlan10?

https://community.cisco.com/t5/metro/di ... d-p/698258
https://www.cisco.com/c/en/us/td/docs/w ... ac_lrn.pdf
 
cadei
newbie
Topic Author
Posts: 37
Joined: Mon Apr 30, 2018 12:02 pm

Re: Traffic same subnet

Tue Aug 21, 2018 3:51 pm

unfortunately not so

Switch#show mac address-table learning

VLAN Learning Status
---- ---------------
1 yes
10 yes
20 yes
30 yes
40 yes
50 yes
60 yes
70 yes
80 yes
90 yes
 
User avatar
xvo
Forum Guru
Forum Guru
Posts: 1237
Joined: Sat Mar 03, 2018 1:12 am
Location: Moscow, Russia

Re: Traffic same subnet

Tue Aug 21, 2018 4:09 pm

I have no guesses left then... Sorry.
 
cadei
newbie
Topic Author
Posts: 37
Joined: Mon Apr 30, 2018 12:02 pm

Re: Block traffic same subnet VLAN

Tue Aug 21, 2018 5:41 pm

@xvo thanks
Maybe I understood what the problem is, but I don't know how to solve it! :(

All VLANs are part of a master bridge.
The bridge also includes access points
I have two ways to access a vlan.

1.wifi access point (physically connected to the mikrotik ethernet port)

2.Ethernet to the cisco switch

In case 1. "IPFILTER drop rule" works because probably the Mikrotik ARP table is interrogated.
In case 2."IPFILTER drop rule" is ignored because it probably uses the ARP table of the CISCO switch.

Is this correct?

Attached is the configuration of the interfaces
You do not have the required permissions to view the files attached to this post.
 
cadei
newbie
Topic Author
Posts: 37
Joined: Mon Apr 30, 2018 12:02 pm

Re: Block traffic same subnet VLAN

Wed Aug 22, 2018 1:54 pm

@xvo
Disabling mac learning is dangerous for safety.
Is there any other way?
 
User avatar
Jotne
Forum Guru
Forum Guru
Posts: 3291
Joined: Sat Dec 24, 2016 11:17 am
Location: Magrathean

Re: Block traffic same subnet VLAN

Wed Aug 22, 2018 2:07 pm

See this post: viewtopic.php?f=2&t=138232#p681222 for some example on how to setup vlan tag when running on 6.41 or later.
 
User avatar
artz
MikroTik Support
MikroTik Support
Posts: 88
Joined: Tue Oct 17, 2017 5:51 pm
Location: Riga
Contact:

Re: Block traffic same subnet VLAN

Wed Aug 22, 2018 2:17 pm

By disabling MAC learning you are disabling a feature that prevents unnecessary traffic flood to all ports. If MAC learning is disabled (or rendered invalid due to an attack, not relevant for RouterOS), then all ports will be able to see the traffic that is passing through each port (broadcast traffic behaviour). By disabling MAC learning you will achieve this situation where all traffic is being sent to all ports, but this does not prevent a switch to forward traffic directly bypassing all router's Firewall rules.

What you need is bridge filter rules (FORWARD) to block certain traffic, these rules will most probably match the rules on your router, use-ip-firewall=yes can also be used. Make sure you are not using hardware offloading since that will bypass all bridge/firewall filter rules. If you are using bridge hardware offloading, then it might be possible to use ACL rules to block such traffic, depends on your device though.

If your device has a built-in switch chip, then you might want to use the port isolation feature, this way all traffic will be forced to be forwarded to a certain port. Same behaviour can be achieved by using bridge split-horizon parameter. This will force all traffic to be forwarded to the router, but that can create a throughput drop between certain ports. Perhaps you can solve this issue by simply using bridge VLAN filtering, but that depends on your setup.
 
cadei
newbie
Topic Author
Posts: 37
Joined: Mon Apr 30, 2018 12:02 pm

Re: Block traffic same subnet VLAN

Wed Aug 22, 2018 2:34 pm

@artz
When I pass the traffic through the wifi access points I can block all the traffic I want (even that of the subnet itself)
In my configuration I have 7 bridge ports.
sfp1 port - trunk port to cisco switches
eth 2-6 - wifi access point

If instead I pass by the physical ports of the Cisco switches I can't block the traffic inside the same subnet(vlan) because the mikrotik firewall is ignored, while the traffic between different vlan can handle it normally.
I attach a schematic image
You do not have the required permissions to view the files attached to this post.
 
User avatar
xvo
Forum Guru
Forum Guru
Posts: 1237
Joined: Sat Mar 03, 2018 1:12 am
Location: Moscow, Russia

Re: Block traffic same subnet VLAN

Wed Aug 22, 2018 2:35 pm

I still don't understand completely what is it your are trying to achieve, but the solution lies in configuring port isolation on your switch.

If you want to see ALL traffic on mikrotik to make the decision whether to forward it or drop it, you have to make all ports on the switch isolated(protected) except the one facing mikrotik.
You need to configure your APs as well - for example mikrotik APs are by default configured to pass traffic between two hosts on one radio.
You need to disable such thing.
 
User avatar
cdiedrich
Forum Veteran
Forum Veteran
Posts: 997
Joined: Thu Feb 13, 2014 2:03 pm
Location: Basel, Switzerland // Bremen, Germany
Contact:

Re: Block traffic same subnet VLAN

Wed Aug 22, 2018 2:47 pm

That diagram makes it a bit clearer.
So you are able to block traffic in all vlans from your access points to wired devices on the switches and vice versa, correct?

All link-local (i.e. same subnet) traffic is handled by the switch itself. You just can't block traffic between two devices hooked up to your switches in your router because the traffic never hits the router.
The minor cases it seems to work in is just because relevant traffic has to cross your bridge - i.e. from wired to wireless or vice versa.

Inter-vlan traffic is L3 traffic and it's your router's job to handle it.

You'll need to create ACL and traffic matchers on your cisco gear to accomplish what you want to achieve.

-Chris
 
cadei
newbie
Topic Author
Posts: 37
Joined: Mon Apr 30, 2018 12:02 pm

Re: Block traffic same subnet VLAN

Wed Aug 22, 2018 3:19 pm

@xvo Sorry ,your solution seems too complex and not easy to manage.At the moment all works correctly

@cdiedrich you've figured out you're that problem!

Access points via bridges always enter the mikrotik "forward chain" and can safely manage traffic through the integrated firewall.

ACL ( in cisco switch) are probably a good solution but I would prefer to centralize the firewall rules within the mikrotik to avoid duplicating the rules or having strange behaviors.

If you have any doubts about the configuration ask as well.
 
User avatar
mkx
Forum Guru
Forum Guru
Posts: 11433
Joined: Thu Mar 03, 2016 10:23 pm

Re: Block traffic same subnet VLAN

Wed Aug 22, 2018 3:23 pm

Access points via bridges always enter the mikrotik "forward chain" and can safely manage traffic through the integrated firewall.
It only works like this because you're using CCR which doesn't have switch chip and all traffic between two ether ports has to pass internal bridge. If you were using some other RB router which has switch chip with hardware offload enabled, it wouldn't work as RBs CPU would not see those packets.
 
User avatar
cdiedrich
Forum Veteran
Forum Veteran
Posts: 997
Joined: Thu Feb 13, 2014 2:03 pm
Location: Basel, Switzerland // Bremen, Germany
Contact:

Re: Block traffic same subnet VLAN

Wed Aug 22, 2018 3:28 pm

@cdiedrich you've figured out you're that problem!
ACL ( in cisco switch) are probably a good solution but I would prefer to centralize the firewall rules within the mikrotik to avoid duplicating the rules or having strange behaviors.
Good to know that I am the problem ;-)
As said - ACL on the switches is your only way.
Or, what I would preferably suggest:
Put the devices that shouldn't be accessible by certain other devices into a seperate subnet and vlan. Then use simple address lists and L3 filter rules to manage access to them from your other networks.

-Chris
 
cadei
newbie
Topic Author
Posts: 37
Joined: Mon Apr 30, 2018 12:02 pm

Re: Block traffic same subnet VLAN

Wed Aug 22, 2018 3:36 pm

@cdiedrich sorry . I made a mistake :D
I had thought of the solution of using another new vlan but wanted to avoid it.
 
User avatar
xvo
Forum Guru
Forum Guru
Posts: 1237
Joined: Sat Mar 03, 2018 1:12 am
Location: Moscow, Russia

Re: Block traffic same subnet VLAN

Wed Aug 22, 2018 3:48 pm

@xvo Sorry ,your solution seems too complex and not easy to manage.At the moment all works correctly

@cdiedrich you've figured out you're that problem!

Access points via bridges always enter the mikrotik "forward chain" and can safely manage traffic through the integrated firewall.

ACL ( in cisco switch) are probably a good solution but I would prefer to centralize the firewall rules within the mikrotik to avoid duplicating the rules or having strange behaviors.

If you have any doubts about the configuration ask as well.
We suggested you two solutions: either filter on the switch or make the switch to redirect traffic to mikrotik and filter there.
Both of them are not complex at all.

And I must've missed the point when everything started to "work correctly".
You wrote that only the traffic between APs is filtered, not between hosts on the switch.
 
cadei
newbie
Topic Author
Posts: 37
Joined: Mon Apr 30, 2018 12:02 pm

Re: Block traffic same subnet VLAN

Wed Aug 22, 2018 4:13 pm

Thanks xvo.
( "All work correctly") :) I mean that I do not want to change all the configuration of the network because everything currently works correctly. I also set several firewall rules (via mikrotik)

I only have the problem that the devices connected to the cisco switch do not pass through the miktrotik firewall inside the same subnet.
I would also like to add that a port on the CISCO switch is connected to a Vsphere Esxi, so isolating the ports on the switch does not solve the problem.
Actually the problem started because I wanted to isolate a vmware host from the rest of the vlan for security reasons, through Mikrotik firewall
Regards
 
User avatar
xvo
Forum Guru
Forum Guru
Posts: 1237
Joined: Sat Mar 03, 2018 1:12 am
Location: Moscow, Russia

Re: Block traffic same subnet VLAN

Wed Aug 22, 2018 4:25 pm

Thanks xvo.
( "All work correctly") :) I mean that I do not want to change all the configuration of the network because everything currently works correctly. I also set several firewall rules (via mikrotik)

I only have the problem that the devices connected to the cisco switch do not pass through the miktrotik firewall inside the same subnet.
I would also like to add that a port on the CISCO switch is connected to a Vsphere Esxi, so isolating the ports on the switch does not solve the problem.
Actually the problem started because I wanted to isolate a vmware host from the rest of the vlan for security reasons, through Mikrotik firewall
Regards
I got it: it's "don't make it worse" thing. :)

Just create a separate VLAN for Vsphere then.
 
cadei
newbie
Topic Author
Posts: 37
Joined: Mon Apr 30, 2018 12:02 pm

Re: Block traffic same subnet VLAN

Wed Aug 22, 2018 4:56 pm

ok
However, there is still the problem of being able to filter hosts in the same subnet through the cisco switch 😉
 
User avatar
mkx
Forum Guru
Forum Guru
Posts: 11433
Joined: Thu Mar 03, 2016 10:23 pm

Re: Block traffic same subnet VLAN

Wed Aug 22, 2018 5:04 pm

ok
However, there is still the problem of being able to filter hosts in the same subnet through the cisco switch 😉
This is actually against the idea of L2 network with switching where hosts are supposed to communicate directly. Surely there are ways around it but then any active L2 equipment (switch, hub, bridge, ...) has to implement it.

Who is online

Users browsing this forum: 4l4R1, robertkjonesjr, RobertsN, Rox169 and 79 guests