How to isolate networks with a Mikrotik router?












5














I recently got a Mikrotik router for my network, and I want to create 3 networks that are isolated from each other but all having internet access:




  1. The "main" network for PCs, etc.

  2. A network for home automation devices/appliances. I do not want these hosts to be able to access the other networks, but I want some specific hosts on the main network to be able to access specific hosts on this network.

  3. A guest network for visitors. I want hosts on this network to only have internet access, and be completely isolated from the other networks.


I've been able to setup these three networks using bridges by following these instructions and also mimicking the default configuration that came with the router.



It sound like I now need to define firewall rules to block the traffic between the bridges, and it's here where I need a little help. My understanding is that the Mikrotik firewall software is based on Linux iptables.




  1. There seems like there's two places to do this: the main firewall configuration in /ip firewall filter, and a bridge-specific section in /interface bridge filter. Which one would be best to use? What are the pros and cons of each?


  2. I'm experimenting with the bridge filters, but all my rules have a little traffic bar icon next to them, which doesn't look good to me. I can't find any explanation of what the icon means.


  3. How should I setup the rules? Would it be more manageable create a bunch of separate chains for each bridge? If so, how should the chains be organized?


  4. It sounds like I need to define forward rules for this. Are there any input or output rules that I would need as well?


  5. I should have the rules match on the bridges/interfaces (i.e. in-bridge, out-bridge, WAN interface, etc.), correct? E.g. to block packets from the main network to the home automation network, I would need a rules that's something like in-bridge=main out-bridge=home_automation action=DROP, correct?







firewall iptables mikrotik-routeros







share|improve this question















migrated from serverfault.com Jan 3 '16 at 12:27


This question came from our site for system and network administrators.















  • If you have an alternate approach, feel free to suggest it. These networks are all setup on a single router (they have different switchports/SSIDs assigned to them), but it appears the router will automatically route between all the networks it has routes to.
    – Kaypro II
    Jan 3 '16 at 2:17










  • The above comment was in response to a now-deleted comment.
    – Kaypro II
    Jan 3 '16 at 4:18
















5














I recently got a Mikrotik router for my network, and I want to create 3 networks that are isolated from each other but all having internet access:




  1. The "main" network for PCs, etc.

  2. A network for home automation devices/appliances. I do not want these hosts to be able to access the other networks, but I want some specific hosts on the main network to be able to access specific hosts on this network.

  3. A guest network for visitors. I want hosts on this network to only have internet access, and be completely isolated from the other networks.


I've been able to setup these three networks using bridges by following these instructions and also mimicking the default configuration that came with the router.



It sound like I now need to define firewall rules to block the traffic between the bridges, and it's here where I need a little help. My understanding is that the Mikrotik firewall software is based on Linux iptables.




  1. There seems like there's two places to do this: the main firewall configuration in /ip firewall filter, and a bridge-specific section in /interface bridge filter. Which one would be best to use? What are the pros and cons of each?


  2. I'm experimenting with the bridge filters, but all my rules have a little traffic bar icon next to them, which doesn't look good to me. I can't find any explanation of what the icon means.


  3. How should I setup the rules? Would it be more manageable create a bunch of separate chains for each bridge? If so, how should the chains be organized?


  4. It sounds like I need to define forward rules for this. Are there any input or output rules that I would need as well?


  5. I should have the rules match on the bridges/interfaces (i.e. in-bridge, out-bridge, WAN interface, etc.), correct? E.g. to block packets from the main network to the home automation network, I would need a rules that's something like in-bridge=main out-bridge=home_automation action=DROP, correct?







firewall iptables mikrotik-routeros







share|improve this question















migrated from serverfault.com Jan 3 '16 at 12:27


This question came from our site for system and network administrators.















  • If you have an alternate approach, feel free to suggest it. These networks are all setup on a single router (they have different switchports/SSIDs assigned to them), but it appears the router will automatically route between all the networks it has routes to.
    – Kaypro II
    Jan 3 '16 at 2:17










  • The above comment was in response to a now-deleted comment.
    – Kaypro II
    Jan 3 '16 at 4:18














5












5








5


1





I recently got a Mikrotik router for my network, and I want to create 3 networks that are isolated from each other but all having internet access:




  1. The "main" network for PCs, etc.

  2. A network for home automation devices/appliances. I do not want these hosts to be able to access the other networks, but I want some specific hosts on the main network to be able to access specific hosts on this network.

  3. A guest network for visitors. I want hosts on this network to only have internet access, and be completely isolated from the other networks.


I've been able to setup these three networks using bridges by following these instructions and also mimicking the default configuration that came with the router.



It sound like I now need to define firewall rules to block the traffic between the bridges, and it's here where I need a little help. My understanding is that the Mikrotik firewall software is based on Linux iptables.




  1. There seems like there's two places to do this: the main firewall configuration in /ip firewall filter, and a bridge-specific section in /interface bridge filter. Which one would be best to use? What are the pros and cons of each?


  2. I'm experimenting with the bridge filters, but all my rules have a little traffic bar icon next to them, which doesn't look good to me. I can't find any explanation of what the icon means.


  3. How should I setup the rules? Would it be more manageable create a bunch of separate chains for each bridge? If so, how should the chains be organized?


  4. It sounds like I need to define forward rules for this. Are there any input or output rules that I would need as well?


  5. I should have the rules match on the bridges/interfaces (i.e. in-bridge, out-bridge, WAN interface, etc.), correct? E.g. to block packets from the main network to the home automation network, I would need a rules that's something like in-bridge=main out-bridge=home_automation action=DROP, correct?







firewall iptables mikrotik-routeros







share|improve this question















I recently got a Mikrotik router for my network, and I want to create 3 networks that are isolated from each other but all having internet access:




  1. The "main" network for PCs, etc.

  2. A network for home automation devices/appliances. I do not want these hosts to be able to access the other networks, but I want some specific hosts on the main network to be able to access specific hosts on this network.

  3. A guest network for visitors. I want hosts on this network to only have internet access, and be completely isolated from the other networks.


I've been able to setup these three networks using bridges by following these instructions and also mimicking the default configuration that came with the router.



It sound like I now need to define firewall rules to block the traffic between the bridges, and it's here where I need a little help. My understanding is that the Mikrotik firewall software is based on Linux iptables.




  1. There seems like there's two places to do this: the main firewall configuration in /ip firewall filter, and a bridge-specific section in /interface bridge filter. Which one would be best to use? What are the pros and cons of each?


  2. I'm experimenting with the bridge filters, but all my rules have a little traffic bar icon next to them, which doesn't look good to me. I can't find any explanation of what the icon means.


  3. How should I setup the rules? Would it be more manageable create a bunch of separate chains for each bridge? If so, how should the chains be organized?


  4. It sounds like I need to define forward rules for this. Are there any input or output rules that I would need as well?


  5. I should have the rules match on the bridges/interfaces (i.e. in-bridge, out-bridge, WAN interface, etc.), correct? E.g. to block packets from the main network to the home automation network, I would need a rules that's something like in-bridge=main out-bridge=home_automation action=DROP, correct?







firewall iptables mikrotik-routeros




firewall iptables mikrotik-routeros






share|improve this question















share|improve this question













share|improve this question




share|improve this question








edited Dec 14 at 21:54









Duncan X Simpson

1,093821




1,093821










asked Jan 3 '16 at 0:10









Kaypro II

76951227




76951227




migrated from serverfault.com Jan 3 '16 at 12:27


This question came from our site for system and network administrators.






migrated from serverfault.com Jan 3 '16 at 12:27


This question came from our site for system and network administrators.














  • If you have an alternate approach, feel free to suggest it. These networks are all setup on a single router (they have different switchports/SSIDs assigned to them), but it appears the router will automatically route between all the networks it has routes to.
    – Kaypro II
    Jan 3 '16 at 2:17










  • The above comment was in response to a now-deleted comment.
    – Kaypro II
    Jan 3 '16 at 4:18


















  • If you have an alternate approach, feel free to suggest it. These networks are all setup on a single router (they have different switchports/SSIDs assigned to them), but it appears the router will automatically route between all the networks it has routes to.
    – Kaypro II
    Jan 3 '16 at 2:17










  • The above comment was in response to a now-deleted comment.
    – Kaypro II
    Jan 3 '16 at 4:18
















If you have an alternate approach, feel free to suggest it. These networks are all setup on a single router (they have different switchports/SSIDs assigned to them), but it appears the router will automatically route between all the networks it has routes to.
– Kaypro II
Jan 3 '16 at 2:17




If you have an alternate approach, feel free to suggest it. These networks are all setup on a single router (they have different switchports/SSIDs assigned to them), but it appears the router will automatically route between all the networks it has routes to.
– Kaypro II
Jan 3 '16 at 2:17












The above comment was in response to a now-deleted comment.
– Kaypro II
Jan 3 '16 at 4:18




The above comment was in response to a now-deleted comment.
– Kaypro II
Jan 3 '16 at 4:18










1 Answer
1






active

oldest

votes


















3














Indeed, Mikrotik devices does routing automatically between networks. Consider the two networks 10.0.0.1/16 and 192.168.1.0/24, for example. If you want to block traffic between those two, just add two firewall rules



ip firewall filter add chain=forward src-address=10.0.0.0/16 dst-address=192.168.1.0/24 action=drop

ip firewall filter add chain=forward src-address=192.168.1.0/24 dst-address=10.0.0.0/16 action=drop


so you drop packets in both directions.






share|improve this answer




















    protected by Community♦ Jul 18 at 0:40



    Thank you for your interest in this question.
    Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site (the association bonus does not count).



    Would you like to answer one of these unanswered questions instead?














    1 Answer
    1






    active

    oldest

    votes








    1 Answer
    1






    active

    oldest

    votes









    active

    oldest

    votes






    active

    oldest

    votes









    3














    Indeed, Mikrotik devices does routing automatically between networks. Consider the two networks 10.0.0.1/16 and 192.168.1.0/24, for example. If you want to block traffic between those two, just add two firewall rules



    ip firewall filter add chain=forward src-address=10.0.0.0/16 dst-address=192.168.1.0/24 action=drop
    
ip firewall filter add chain=forward src-address=192.168.1.0/24 dst-address=10.0.0.0/16 action=drop


    so you drop packets in both directions.






    share|improve this answer


























      3














      Indeed, Mikrotik devices does routing automatically between networks. Consider the two networks 10.0.0.1/16 and 192.168.1.0/24, for example. If you want to block traffic between those two, just add two firewall rules



      ip firewall filter add chain=forward src-address=10.0.0.0/16 dst-address=192.168.1.0/24 action=drop
      
ip firewall filter add chain=forward src-address=192.168.1.0/24 dst-address=10.0.0.0/16 action=drop


      so you drop packets in both directions.






      share|improve this answer
























        3












        3








        3






        Indeed, Mikrotik devices does routing automatically between networks. Consider the two networks 10.0.0.1/16 and 192.168.1.0/24, for example. If you want to block traffic between those two, just add two firewall rules



        ip firewall filter add chain=forward src-address=10.0.0.0/16 dst-address=192.168.1.0/24 action=drop
        
ip firewall filter add chain=forward src-address=192.168.1.0/24 dst-address=10.0.0.0/16 action=drop


        so you drop packets in both directions.






        share|improve this answer












        Indeed, Mikrotik devices does routing automatically between networks. Consider the two networks 10.0.0.1/16 and 192.168.1.0/24, for example. If you want to block traffic between those two, just add two firewall rules



        ip firewall filter add chain=forward src-address=10.0.0.0/16 dst-address=192.168.1.0/24 action=drop
        
ip firewall filter add chain=forward src-address=192.168.1.0/24 dst-address=10.0.0.0/16 action=drop


        so you drop packets in both directions.







        share|improve this answer












        share|improve this answer



        share|improve this answer










        answered Jan 4 '16 at 12:18









        Benoit PHILIPPON

        23613




        23613

















            protected by Community♦ Jul 18 at 0:40



            Thank you for your interest in this question.
            Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site (the association bonus does not count).



            Would you like to answer one of these unanswered questions instead?



            -

            Popular posts from this blog

            Probability when a professor distributes a quiz and homework assignment to a class of n students.

            Image
            0 0 $begingroup$ Need help with this problem. Suppose our lazy professor collects a quiz and a homework assignment from a class of n students one day, then distributes both the quizzes and the homework assignments back to the class in a random fashion for grading. Each student receives one quiz and one homework assignment to grade. (a) What is the probability that every student receives someone else's quiz to grade, and someone else's homework to grade? (b) What is the probability that no student receives both their own quiz and their own homework assignment to grade? In this case, some students may receive their own quiz, and others may receive their own homework assignment. (c) Compute the limiting probability as n approaches infinity in each case. ...
            Read more

            Aardman Animations

            Image
            Aardman Animations, Ltd. Aardman Animations Tipo privada Atividade Animação em stop-motion , Animação em CGI Fundação 1972 Fundador(es) Peter Lord David Sproxton Sede Bristol, Inglaterra  Reino Unido Proprietário(s) Dreamworks Pessoas-chave Peter Lord David Sproxton Nick Park Divisões Aardman Features Aardman Digital Aardman Commercials Aardman Broadcast Aardman International Aardman Rights Aardman Effects Aardman 3-D Systems Aardman Nathan Love AardBoiled Website oficial aardman.com ...
            Read more

            Are they similar matrix

            Image
            0 $begingroup$ Do $begin{bmatrix} 0&i&0\0&0&1\0&0&0 end{bmatrix} $ and $begin{bmatrix} 0&0&0\-i&0&0\0&1&0 end{bmatrix} $ are similar.Is this True/false Clearly both are nilpotent and one is conjucate transpose of other but how to know if they are similar.i'm stuck. Please help me linear-algebra vector-spaces eigenvalues-eigenvectors generalizedeigenvector share | cite | improve this question edited Dec 10 '18 at 6:38 Vasanth Kris asked Dec 10 '18 at 6:19 ...
            Read more