Hi!

I have a little question. I have one RB751 and configured with two AP, one is my private and other one is public.

Privat network is: 10.0.0.1 for lan ports and for wifi clients
Publick network is: 192.168.17.1 for wifi clients only

Because i have a nas and i don't want to be accessible from public network i need help how to do this.

Soo i need to isolate this two networks from each other, but not only clients (default forward i think is not an option)

Thanks for help. Bye Tomaz

Tomaz,

You would need to put in place a firewall rule to not let the two IP ranges talk to each other.

Yes, of course. I know that this must be done in firewall, but don't know how.

Can you give me a sample for my case?

Thanks

Tomaz,

Sorry it took so long!

I'm assuming you are using a /24 mask for those networks

/ip firewall filter
add action=drop chain=forward disabled=no dst-address=192.168.17.0/24 \
src-address=10.0.0.0/24
add action=drop chain=forward disabled=no dst-address=10.0.0.0/24 \
src-address=192.168.17.0/24

And its probably a good idea to put this in to stop people from logging into your mt from the public

/ip firewall filter
add action=drop chain=input disabled=no src-address=192.168.17.0/24

Josh

You can use the following method to control with PVLAN to terminal site visit: n configuration connected to the terminal site interface for isolation port, in order to prevent any second communication. For example, if the terminal site is the server, the server configuration stop between the second communication.