Community discussions

 
krakenant
Member Candidate
Member Candidate
Topic Author
Posts: 136
Joined: Sat Feb 06, 2010 6:32 am

Stopping Broadcast Packets

Thu Apr 15, 2010 9:28 pm

Specifically DHCP, but windows broadcasts, etc.

Belair has a feature that stops all broadcasts from going out the wireless interface, unless from a specified list of MAC addresses. I am looking to duplicate that feature. Any idea what to select in the firewall to target broadcast packets? I can figure out the rest I am fairly certain.
 
User avatar
martini
Member Candidate
Member Candidate
Posts: 296
Joined: Tue Dec 21, 2004 12:13 am

Re: Stopping Broadcast Packets

Thu Apr 15, 2010 9:47 pm

router setup ?? WDS with bridge or routing ?
 
krakenant
Member Candidate
Member Candidate
Topic Author
Posts: 136
Joined: Sat Feb 06, 2010 6:32 am

Re: Stopping Broadcast Packets

Thu Apr 15, 2010 10:27 pm

These would be on Mikrotiks converted to APs, either wired or bridged. They wouldn't do any routing.
 
User avatar
martini
Member Candidate
Member Candidate
Posts: 296
Joined: Tue Dec 21, 2004 12:13 am

Re: Stopping Broadcast Packets

Thu Apr 15, 2010 11:22 pm

in bridge firewall drop dst-mac ff:ff:ff:ff:ff:ff, but add static arp for hosts
 
krakenant
Member Candidate
Member Candidate
Topic Author
Posts: 136
Joined: Sat Feb 06, 2010 6:32 am

Re: Stopping Broadcast Packets

Fri Apr 16, 2010 12:40 am

Not exactly what I am looking for.
Here is the description from the Belair Manual
"When configured in secure port mode, the AP forwards to the associated wireless clients only those Layer 2 (Ethernet) frames for which the source MAC address and VLAN matches an entry its white list. The white list can contain up to 32 entries. If a VLAN is not specified, it is assumed to have a value of zero. In effect, while in this mode the AP acts as a firewall for all Layer 2 frames arriving from inside the network for the wireless clients. The secure MAC white list should only contain the MAC addresses of the gateway interfaces. Thus, wireless clients associated to other APs in the network are prevented from communicating with locally associated clients.
Note 1: The secure MAC white list is different from the list described in “Wireless Client Access Control List” on page 90. In a client ACL, only the listed MAC addresses are allowed to associate with an AP. The secure MAC white list controls data forwarding to the wireless clients from remote entities in the network. The content of the secure MAC white list takes effect only when the AP secure port mode is enabled."
 
User avatar
Chupaka
Forum Guru
Forum Guru
Posts: 8318
Joined: Mon Jun 19, 2006 11:15 pm
Location: Minsk, Belarus
Contact:

Re: Stopping Broadcast Packets

Thu Apr 22, 2010 3:20 am

the AP forwards to the associated wireless clients only those Layer 2 (Ethernet) frames for which the source MAC address and VLAN matches an entry its white list.
maybe something like
/interface bridge filter add vlan-id=? src-mac-address=?
?

accept whitelisted entries, then drop all the rest...
Russian-speaking forum: https://forum.mikrotik.by/. Welcome!

For every complex problem, there is a solution that is simple, neat, and wrong.

MikroTik. Your life. Your routing.

Who is online

Users browsing this forum: No registered users and 104 guests