Community discussions

MikroTik App
 
gdanov
Member Candidate
Member Candidate
Topic Author
Posts: 150
Joined: Thu Jan 17, 2019 1:10 pm

isolating a bridge from pinging IPs assigned to other bridges or interfaces on the same router

Wed Dec 08, 2021 12:32 am

I have a router with several bridges and IP tunnel. Let's say
  • bridge main with assigned ip 192.168.1.2/24
  • bridge bridge-580 with assigned ip 192.168.8.1/24, few (but not all) ports connected to it
  • ipip tunnel , ip irrelevant
I want bridge bridge-580 to be routed only via the ip tunnel and fully isolate it from the other interfaces.

This rule does 90% of the isolation job:
chain=forward action=reject reject-with=icmp-network-unreachable in-interface=bridge-580 out-interface=!ipip-tunnel1 log=no log-prefix=""
The 10% missing are that I can still ping IPs assigned to interfaces on that router, for example 192.168.1.2. Experimented a lot with the rules, read the packet flow diagram, and it seems like the major catch is that such traffic is not destined to bridge port or physical out interface, so I don't understand where it fits in the flow. I can capture such traffic in the input chain, but the forward chain ignores it regardless if I specify it with ips or interfaces. This rule does not capture ping to the neighbour bridge address, but captures traffic that exits the neighbour bridge:
chain=forward action=passthrough src-address=192.168.8.0/24 dst-address=192.168.1.0/24 log=no log-prefix=""
Also, if I ping 192.168.1.2 from 192.168.8.x, while torching bridge main, I don't see the packets.
 
tdw
Forum Guru
Forum Guru
Posts: 1843
Joined: Sat May 05, 2018 11:55 am

Re: isolating a bridge from pinging IPs assigned to other bridges or interfaces on the same router  [SOLVED]

Wed Dec 08, 2021 1:08 am

Standard linux behaviour - all traffic to local addresses on the Mikrotik are handled by the input chain not forward, see https://wiki.mikrotik.com/wiki/Manual:P ... ng_Diagram.

Note this applies even if the source and destination addresses are not in the same subnet.
 
gdanov
Member Candidate
Member Candidate
Topic Author
Posts: 150
Joined: Thu Jan 17, 2019 1:10 pm

Re: isolating a bridge from pinging IPs assigned to other bridges or interfaces on the same router

Wed Dec 08, 2021 1:16 am

Standard linux behaviour - all traffic to local addresses on the Mikrotik are handled by the input chain not forward, see https://wiki.mikrotik.com/wiki/Manual:P ... ng_Diagram.

Note this applies even if the source and destination addresses are not in the same subnet.
so they traverse I -> J instead of the usual I -> L ?

given the 90% rule will block all traffic going through another bridge or WAN interface, what else am I risking except for allowing access to the MT services exposed on "internal" IPs if I don't block this internal traffic?
 
Sob
Forum Guru
Forum Guru
Posts: 9119
Joined: Mon Apr 20, 2009 9:11 pm

Re: isolating a bridge from pinging IPs assigned to other bridges or interfaces on the same router

Wed Dec 08, 2021 1:39 am

Since RouterOS doesn't have different services listening on different addresses, it doesn't matter to which client connects to. But if you want to limit it for cosmetic purposes, you can:
/ip firewall filter
add chain=input in-interface=bridge-580 dst-address=!192.168.8.1 action=reject
 
User avatar
anav
Forum Guru
Forum Guru
Posts: 19125
Joined: Sun Feb 18, 2018 11:28 pm
Location: Nova Scotia, Canada
Contact:

Re: isolating a bridge from pinging IPs assigned to other bridges or interfaces on the same router

Wed Dec 08, 2021 2:26 am

In other words no actual data will flow but if you want to feel better enact extra rules.....
I prefer to use One bridge and do all my talking and blocking with vlans and interface lists......
 
Sob
Forum Guru
Forum Guru
Posts: 9119
Joined: Mon Apr 20, 2009 9:11 pm

Re: isolating a bridge from pinging IPs assigned to other bridges or interfaces on the same router

Wed Dec 08, 2021 3:35 am

How does bridge, vlans and interface lists help with this? Unless you have them just for L2, i.e. router functioning only as switch, you have the same "problem".

If you have vlan1 with 192.168.1.1/24 and vlan2 with 192.168.2.1/24, and want them completely isolated, then blocking in forward chain blocks e.g. 192.168.1.100<->192.168.2.100. But 192.168.1.100 is able to access 192.168.2.1 (address on router), so it seems that it can access the other subnet. It's misleading, because it really can't. If it's allowed to access something on router on 192.168.1.1, then accessing it on 192.168.2.1 makes no difference, because it's exactly the same service. If would be different if RouterOS allowed e.g. several independent dns resolvers, where one listening on 192.168.1.1 would have some filtering, and another on 192.168.2.1 wouldn't. Then client connecting to the other one could be problem. Currently it's not possible, so it's ok, but you may still want to "fix" it, to make it look better.
 
tdw
Forum Guru
Forum Guru
Posts: 1843
Joined: Sat May 05, 2018 11:55 am

Re: isolating a bridge from pinging IPs assigned to other bridges or interfaces on the same router

Wed Dec 08, 2021 4:01 am

so they traverse I -> J instead of the usual I -> L ?
Yes

given the 90% rule will block all traffic going through another bridge or WAN interface, what else am I risking except for allowing access to the MT services exposed on "internal" IPs if I don't block this internal traffic?
Nothing really, other than the internal addresses being visible as explained by @Sob
 
gdanov
Member Candidate
Member Candidate
Topic Author
Posts: 150
Joined: Thu Jan 17, 2019 1:10 pm

Re: isolating a bridge from pinging IPs assigned to other bridges or interfaces on the same router

Wed Dec 08, 2021 1:58 pm

Thanks for the help, it's clear now. The only risk I see (in my set-up) is leaving DNS accessible, but that's OK for me and I know how to plug it if I wanted to.

I wish the CPU+internal IPs was treated as separate port, that would make it easier to manage and reason about.
 
User avatar
anav
Forum Guru
Forum Guru
Posts: 19125
Joined: Sun Feb 18, 2018 11:28 pm
Location: Nova Scotia, Canada
Contact:

Re: isolating a bridge from pinging IPs assigned to other bridges or interfaces on the same router

Wed Dec 08, 2021 2:49 pm

How does bridge, vlans and interface lists help with this? Unless you have them just for L2, i.e. router functioning only as switch, you have the same "problem".
Nothing that was already established, just saying no need for multiple bridges.......

Who is online

Users browsing this forum: Bing [Bot] and 36 guests