Community discussions

MikroTik App
 
BrainTrance
just joined
Topic Author
Posts: 21
Joined: Sat Jan 15, 2022 12:09 am

Filter rule blocks traffic on bridge but not on destination

Fri Aug 19, 2022 12:45 am

I have a MikroTik hAP ac3 (Home AP dual mode) which has the default bridge interface.
DHCP server and NAT are disabled.
My computer is wirelessly connected to this router and the router is wirelessly bridged with a hAP lite which operates as bridge (CPE mode) and it has a laptop connected on it via ethernet cable.
Topology is like this: COMPUTER<----WIFI----->MikroTik router hAP ac3<---WIRELESS BRIDGE---->hAP lite<-----ETHERNET----->laptop.
I want to block all traffic coming from the laptop.
I added a Filter rule in the Bridge menu (I checked "use IP firewall"):
chain=input
In. bridge=bridge
Out. bridge=bridge
MAC protocol=800 ip
Src. Address=192.168.88.3/32 (laptop's NIC address)
Action=drop

The problem is that if -from my laptop- I ping my computer (192.168.88.2), the packets travel through the Mikrotik Router and reach it normally (which I don't want), but if I ping my router (192.168.88.1) the packets are successfully blocked (which I want).
What should I change in order to block all traffic from laptop no matter where it's destined?
 
User avatar
mkx
Forum Guru
Forum Guru
Posts: 11433
Joined: Thu Mar 03, 2016 10:23 pm

Re: Filter rule blocks traffic on bridge but not on destination

Fri Aug 19, 2022 1:46 pm

On which device did you create bridge filtering, on hAP ac3? Which, according to your simplified diagram, only uses wireless to communicate (both towards PC and towards laptop)?

Wireless interfaces have property default-forwarding with default setting yes. Which means that if both communication partners (PC and laptop) are accessible via same wireless interface, packets won't ever enter bridge, they will be handled by wireless interface autonomously. This is not the case when laptop communicates with hAP ac3 itself as CPU of hAP ac3 communicates only through bridge (because that's the interface with IP address configured).
The other possible setting is not fine either: if set to no, wireless will not pass frames directly, they will be forced out to bridge instead. However, bridge will not forward frame through ingress interface (basic operation of ethernet switches and bridges) meaning no communication between COMPUTER and any other device connected via wireless will be possible.

You could block such communication by setting same setup (set bridge to use IP firewall, setup IP firewall) if configured on hAP lite (traffic is forced to pass bridge there, no other way of connecting ethernet and wireless).

BTW, if filter rules are simple enough, you could do the same using bridge filter while consuming much less CPU resources.
 
BrainTrance
just joined
Topic Author
Posts: 21
Joined: Sat Jan 15, 2022 12:09 am

Re: Filter rule blocks traffic on bridge but not on destination

Fri Aug 19, 2022 2:20 pm

On which device did you create bridge filtering, on hAP ac3? Which, according to your simplified diagram, only uses wireless to communicate (both towards PC and towards laptop)?
Yes on hAP ac3. Bridge interface is the default one, it includes all ethernets and wlans except from ether1.

My computer indeed communicates wirelessly (wlan1) with hap ac3, hap ac3 communicates with a wireless bridge with hap lite (this bridge connects also to wlan1), and in the hap lite I have my laptop connected with cable in one of its ports. So yes they use the same interface.

So you say that I should change the way my computer communicates with hap ac3 (from wireless, to wired) in order to not having two partners communicate through the same interface?
You could block such communication by setting same setup (set bridge to use IP firewall, setup IP firewall) if configured on hAP lite (traffic is forced to pass bridge there, no other way of connecting ethernet and wireless).
Unfortunately we are forced to do this filtering in the hAP ac3.
 
User avatar
mkx
Forum Guru
Forum Guru
Posts: 11433
Joined: Thu Mar 03, 2016 10:23 pm

Re: Filter rule blocks traffic on bridge but not on destination

Fri Aug 19, 2022 2:21 pm

So you say that I should change the way my computer communicates with hap ac3 (from wireless, to wired) in order to not having two partners communicate through the same interface?
Yes, as explained that's one possibility.
 
BrainTrance
just joined
Topic Author
Posts: 21
Joined: Sat Jan 15, 2022 12:09 am

Re: Filter rule blocks traffic on bridge but not on destination

Fri Aug 19, 2022 3:19 pm

One of the main reasons I use Mikrotik is this forum. Thank you.
 
User avatar
anav
Forum Guru
Forum Guru
Posts: 19100
Joined: Sun Feb 18, 2018 11:28 pm
Location: Nova Scotia, Canada
Contact:

Re: Filter rule blocks traffic on bridge but not on destination

Fri Aug 19, 2022 3:53 pm

One of the main reasons I use Mikrotik is this forum. Thank you.
Amen to that brother!
The only reason I can use my Mikrotik is this forum. :-)
If it were not for the help of many folks here, many might be using linksheite, crisco, dstink, fornicate, and netfear......... or worse pfnonsensical or ubiquickpee

Who is online

Users browsing this forum: No registered users and 50 guests