Community discussions

 
pkisistemas2
just joined
Topic Author
Posts: 15
Joined: Wed May 04, 2011 10:25 pm

How to isolate two networks

Mon Jun 17, 2013 12:50 pm

Configuration...

Inet router (192.168.1.1) conected to...

mikrotik (192.168.1.2).... wifi hotspot
Local lan (192.168.1.10-155)

What we want... isolate wifi hotspot from local lan, that is, i want users of both wifi hotspot and lan can access internet but not see not access between them.

¿what is the best way? ... and the easiest way???, (perhaps one rule into firewall, ¿what rule?)
 
CelticComms
Forum Guru
Forum Guru
Posts: 1766
Joined: Wed May 02, 2012 5:48 am

Re: How to isolate two networks

Mon Jun 17, 2013 3:13 pm

You need to place filter rules in the forward chain of IP Firewall.

http://wiki.mikrotik.com/wiki/Manual:IP/Firewall/Filter
Interlynx | Networking and Information Security Consultants & Trainers | Email: routerlynx@gmail.com
BGP | EIGRP | OSPF | MPLS | Firewall | VPN | IPsec | Multicast | QOS | IPv4/6 | STP | VLAN | PON | AE | M2M | and more!

 
kgninfos
Member
Member
Posts: 387
Joined: Thu Jun 21, 2012 7:34 pm
Location: Earth
Contact:

Re: How to isolate two networks

Mon Jun 17, 2013 8:16 pm

Configuration...

Inet router (192.168.1.1) conected to...

mikrotik (192.168.1.2).... wifi hotspot
Local lan (192.168.1.10-155)

What we want... isolate wifi hotspot from local lan, that is, i want users of both wifi hotspot and lan can access internet but not see not access between them.

¿what is the best way? ... and the easiest way???, (perhaps one rule into firewall, ¿what rule?)
can you explain the configurations more clearly
how can you use 192.168.1.1 as gateway(assuming to to be another router)
and only 1 ip as hotspot 192.168.1.2
and remaining as lan??

if you have connected an accesspoint to router with ip 192.168.1.2
192.168.1.1 is the gateway for all ips
and using rest as lan user

then use this
/ip firewall filter add action=drop chain=forward disabled=no dst-address=!192.168.1.1 src-address=192.168.1.2
this will block accesspoint users form accessing lan
 
pkisistemas2
just joined
Topic Author
Posts: 15
Joined: Wed May 04, 2011 10:25 pm

Re: How to isolate two networks

Mon Jun 17, 2013 8:48 pm


can you explain the configurations more clearly
how can you use 192.168.1.1 as gateway(assuming to to be another router)
and only 1 ip as hotspot 192.168.1.2
and remaining as lan??

if you have connected an accesspoint to router with ip 192.168.1.2
192.168.1.1 is the gateway for all ips
and using rest as lan user

then use this
/ip firewall filter add action=drop chain=forward disabled=no dst-address=!192.168.1.1 src-address=192.168.1.2
this will block accesspoint users form accessing lan
Of course... this is for a ONG who wants to open freely their inet conection to their neigbourgs but they want to "secure" their lan...
So
ADSL router (192.168.1.1)... has 4 eth ports

Port 1... to lan swith, with ip port 192.168.1.10 to 155 (or so)
Port 2... to mikrotik RB951G port 1 (192.168.1.2) with default hotspot configuration (so wifi users has 192.168.88.x ip range)

What we want is to ensure that wifi users has no access to lan users but they can use internet (of course)
 
djmuk
newbie
Posts: 47
Joined: Mon Jan 18, 2010 8:48 pm

Re: How to isolate two networks

Mon Jun 17, 2013 8:53 pm

For traffic from 192.168.88.0/24 BLOCK access to 192.168.1.0/24 (firewall action drop).
Set MT default gateway to router (192.168.1.1).
 
kgninfos
Member
Member
Posts: 387
Joined: Thu Jun 21, 2012 7:34 pm
Location: Earth
Contact:

Re: How to isolate two networks

Mon Jun 17, 2013 9:03 pm

on ether1 port of mikrotik just drop all connection where dst-ip=!192.168.1.1
 
kgninfos
Member
Member
Posts: 387
Joined: Thu Jun 21, 2012 7:34 pm
Location: Earth
Contact:

Re: How to isolate two networks

Mon Jun 17, 2013 9:05 pm

/ip firewall filter add action=drop chain=forward out-interface=ether1 dst-address=!192.168.1.1
 
djmuk
newbie
Posts: 47
Joined: Mon Jan 18, 2010 8:48 pm

Re: How to isolate two networks

Mon Jun 17, 2013 10:00 pm

Those rules are the wrong way round they drop traffic that is NOT to 192.168.1.0/24 (!192.168.1.0/24).

You EITHER want to forward traffic not to 192.168.1.0/24 (which will be !192.168.1.0/24) or DROP traffic to that Range - in which case the address should be 192.168.1.0/24 (without the !)

so remove the ! from the address and they will be right....
 
kgninfos
Member
Member
Posts: 387
Joined: Thu Jun 21, 2012 7:34 pm
Location: Earth
Contact:

Re: How to isolate two networks

Tue Jun 18, 2013 8:06 am

Those rules are the wrong way round they drop traffic that is NOT to 192.168.1.0/24 (!192.168.1.0/24).

You EITHER want to forward traffic not to 192.168.1.0/24 (which will be !192.168.1.0/24) or DROP traffic to that Range - in which case the address should be 192.168.1.0/24 (without the !)

so remove the ! from the address and they will be right....
if you block all traffic in range 192.168.1.0/24 then you will not be able to reach gateway also

and have you tested the rule i have posted??
 
pkisistemas2
just joined
Topic Author
Posts: 15
Joined: Wed May 04, 2011 10:25 pm

Re: How to isolate two networks

Tue Jun 18, 2013 12:28 pm

I will try both of them...(i think /ip firewall filter add action=drop chain=forward out-interface=ether1 dst-address=!192.168.1.1 is ok... but i will try both and will inform)
 
djmuk
newbie
Posts: 47
Joined: Mon Jan 18, 2010 8:48 pm

Re: How to isolate two networks

Sun Jun 23, 2013 1:13 am

if you block all traffic in range 192.168.1.0/24 then you will not be able to reach gateway also

and have you tested the rule i have posted??
The only time that would be a problem is if you wanted the users to access the gateway web interface -

Only the MAC address is replaced in the packets when they are routed through a gateway, the source and destination IP addresses are not changed, This is basic IP routing stuff...

David

Who is online

Users browsing this forum: No registered users and 31 guests