Community discussions

MikroTik App
 
CmL
just joined
Topic Author
Posts: 2
Joined: Tue Jan 02, 2018 4:51 pm

Service port filtering for just one interface

Tue Jan 02, 2018 5:09 pm

So im fairly new to the mikrotik systems and i own a CRS switch and i need your help.

I need to drop all of the traffic that goes to port 67-68 but for just one interface. So I drop only the DHCP request coming from etherX. For the other interfaces (etherY) i want to keep DHCP running .

Is this possible or not?
 
User avatar
sebastia
Forum Guru
Forum Guru
Posts: 1782
Joined: Tue Oct 12, 2010 3:23 am
Location: Antwerp, BE

Re: Service port filtering for just one interface

Wed Jan 03, 2018 12:11 am

Sure

/ip firewall filter add chain=input protocol=udp port=67,68 in-interface=ether5 action=drop

drop protocol udp, ports 67,68, coming into router on interface ether5.
 
CmL
just joined
Topic Author
Posts: 2
Joined: Tue Jan 02, 2018 4:51 pm

Re: Service port filtering for just one interface

Wed Jan 03, 2018 3:59 pm

Thank you for the quick response, but I guess i mislead you with the lack of information that i gave.
I want to use this for a slave port since i want that ether-port as a switch port. I dont want to go in routing on that switch.
I followed your advice yet this is the response that im getting.

-----------------------------------------------------------------------------------------------------------------------------
add action=drop chain=input in-interface=ether19 port=67-68 protocol=udp
#in/out-interface matcher not possible when interface (ether19) is slave -use master instead (ether1-master)
-----------------------------------------------------------------------------------------------------------------------------
 
User avatar
sebastia
Forum Guru
Forum Guru
Posts: 1782
Joined: Tue Oct 12, 2010 3:23 am
Location: Antwerp, BE

Re: Service port filtering for just one interface

Wed Jan 03, 2018 4:21 pm

A slave port is switched in hardware, and sees any and all traffic (filtered by mac) the master port sees. It (usually) can not be filtered. (some switch chips allow for advanced rules definition)

If you want to filter, bridge it and then apply your filter on that bridge.
 
User avatar
ZeroByte
Forum Guru
Forum Guru
Posts: 4047
Joined: Wed May 11, 2011 6:08 pm

Re: Service port filtering for just one interface

Wed Jan 03, 2018 4:42 pm

Disable HW forwarding on the interface in question and then you can use the bridge filter rules to block the traffic.
Chain = input
Ethernet protocol = ip
ip protocol = udp
ports=67,68

To disable HW forwarding in versions 6.40.5 and below, you set master-port=none / in v6.41 and after, you un-check the HW forwarding checkbox in the bridge ports menu.

Who is online

Users browsing this forum: jaclaz, Scoox and 18 guests