How to isolate networks with a Mikrotik router?
I recently got a Mikrotik router for my network, and I want to create 3 networks that are isolated from each other but all having internet access:
- The "main" network for PCs, etc.
- A network for home automation devices/appliances. I do not want these hosts to be able to access the other networks, but I want some specific hosts on the main network to be able to access specific hosts on this network.
- A guest network for visitors. I want hosts on this network to only have internet access, and be completely isolated from the other networks.
I've been able to setup these three networks using bridges by following these instructions and also mimicking the default configuration that came with the router.
It sound like I now need to define firewall rules to block the traffic between the bridges, and it's here where I need a little help. My understanding is that the Mikrotik firewall software is based on Linux iptables.
There seems like there's two places to do this: the main firewall configuration in
/ip firewall filter, and a bridge-specific section in/interface bridge filter. Which one would be best to use? What are the pros and cons of each?I'm experimenting with the bridge filters, but all my rules have a little traffic bar icon next to them, which doesn't look good to me. I can't find any explanation of what the icon means.
How should I setup the rules? Would it be more manageable create a bunch of separate chains for each bridge? If so, how should the chains be organized?
It sounds like I need to define
forwardrules for this. Are there anyinputoroutputrules that I would need as well?I should have the rules match on the bridges/interfaces (i.e. in-bridge, out-bridge, WAN interface, etc.), correct? E.g. to block packets from the main network to the home automation network, I would need a rules that's something like in-bridge=main out-bridge=home_automation action=DROP, correct?
firewall iptables mikrotik-routeros
edited Dec 14 at 21:54
Duncan X Simpson
1,093821
asked Jan 3 '16 at 0:10
Kaypro II
76951227
migrated from serverfault.com Jan 3 '16 at 12:27
This question came from our site for system and network administrators.
add a comment |
I recently got a Mikrotik router for my network, and I want to create 3 networks that are isolated from each other but all having internet access:
- The "main" network for PCs, etc.
- A network for home automation devices/appliances. I do not want these hosts to be able to access the other networks, but I want some specific hosts on the main network to be able to access specific hosts on this network.
- A guest network for visitors. I want hosts on this network to only have internet access, and be completely isolated from the other networks.
I've been able to setup these three networks using bridges by following these instructions and also mimicking the default configuration that came with the router.
It sound like I now need to define firewall rules to block the traffic between the bridges, and it's here where I need a little help. My understanding is that the Mikrotik firewall software is based on Linux iptables.
There seems like there's two places to do this: the main firewall configuration in
/ip firewall filter, and a bridge-specific section in/interface bridge filter. Which one would be best to use? What are the pros and cons of each?I'm experimenting with the bridge filters, but all my rules have a little traffic bar icon next to them, which doesn't look good to me. I can't find any explanation of what the icon means.
How should I setup the rules? Would it be more manageable create a bunch of separate chains for each bridge? If so, how should the chains be organized?
It sounds like I need to define
forwardrules for this. Are there anyinputoroutputrules that I would need as well?I should have the rules match on the bridges/interfaces (i.e. in-bridge, out-bridge, WAN interface, etc.), correct? E.g. to block packets from the main network to the home automation network, I would need a rules that's something like in-bridge=main out-bridge=home_automation action=DROP, correct?
firewall iptables mikrotik-routeros
edited Dec 14 at 21:54
Duncan X Simpson
1,093821
asked Jan 3 '16 at 0:10
Kaypro II
76951227
migrated from serverfault.com Jan 3 '16 at 12:27
This question came from our site for system and network administrators.
If you have an alternate approach, feel free to suggest it. These networks are all setup on a single router (they have different switchports/SSIDs assigned to them), but it appears the router will automatically route between all the networks it has routes to.
– Kaypro II
Jan 3 '16 at 2:17
The above comment was in response to a now-deleted comment.
– Kaypro II
Jan 3 '16 at 4:18
add a comment |
I recently got a Mikrotik router for my network, and I want to create 3 networks that are isolated from each other but all having internet access:
- The "main" network for PCs, etc.
- A network for home automation devices/appliances. I do not want these hosts to be able to access the other networks, but I want some specific hosts on the main network to be able to access specific hosts on this network.
- A guest network for visitors. I want hosts on this network to only have internet access, and be completely isolated from the other networks.
I've been able to setup these three networks using bridges by following these instructions and also mimicking the default configuration that came with the router.
It sound like I now need to define firewall rules to block the traffic between the bridges, and it's here where I need a little help. My understanding is that the Mikrotik firewall software is based on Linux iptables.
There seems like there's two places to do this: the main firewall configuration in
/ip firewall filter, and a bridge-specific section in/interface bridge filter. Which one would be best to use? What are the pros and cons of each?I'm experimenting with the bridge filters, but all my rules have a little traffic bar icon next to them, which doesn't look good to me. I can't find any explanation of what the icon means.
How should I setup the rules? Would it be more manageable create a bunch of separate chains for each bridge? If so, how should the chains be organized?
It sounds like I need to define
forwardrules for this. Are there anyinputoroutputrules that I would need as well?I should have the rules match on the bridges/interfaces (i.e. in-bridge, out-bridge, WAN interface, etc.), correct? E.g. to block packets from the main network to the home automation network, I would need a rules that's something like in-bridge=main out-bridge=home_automation action=DROP, correct?
firewall iptables mikrotik-routeros
edited Dec 14 at 21:54
Duncan X Simpson
1,093821
asked Jan 3 '16 at 0:10
Kaypro II
76951227
I recently got a Mikrotik router for my network, and I want to create 3 networks that are isolated from each other but all having internet access:
- The "main" network for PCs, etc.
- A network for home automation devices/appliances. I do not want these hosts to be able to access the other networks, but I want some specific hosts on the main network to be able to access specific hosts on this network.
- A guest network for visitors. I want hosts on this network to only have internet access, and be completely isolated from the other networks.
I've been able to setup these three networks using bridges by following these instructions and also mimicking the default configuration that came with the router.
It sound like I now need to define firewall rules to block the traffic between the bridges, and it's here where I need a little help. My understanding is that the Mikrotik firewall software is based on Linux iptables.
There seems like there's two places to do this: the main firewall configuration in
/ip firewall filter, and a bridge-specific section in/interface bridge filter. Which one would be best to use? What are the pros and cons of each?I'm experimenting with the bridge filters, but all my rules have a little traffic bar icon next to them, which doesn't look good to me. I can't find any explanation of what the icon means.
How should I setup the rules? Would it be more manageable create a bunch of separate chains for each bridge? If so, how should the chains be organized?
It sounds like I need to define
forwardrules for this. Are there anyinputoroutputrules that I would need as well?I should have the rules match on the bridges/interfaces (i.e. in-bridge, out-bridge, WAN interface, etc.), correct? E.g. to block packets from the main network to the home automation network, I would need a rules that's something like in-bridge=main out-bridge=home_automation action=DROP, correct?
firewall iptables mikrotik-routeros
firewall iptables mikrotik-routeros
edited Dec 14 at 21:54
Duncan X Simpson
1,093821
asked Jan 3 '16 at 0:10
Kaypro II
76951227
edited Dec 14 at 21:54
Duncan X Simpson
1,093821
asked Jan 3 '16 at 0:10
Kaypro II
76951227
edited Dec 14 at 21:54
Duncan X Simpson
1,093821
edited Dec 14 at 21:54
Duncan X Simpson
1,093821
edited Dec 14 at 21:54
Duncan X Simpson
1,093821
1,093821
asked Jan 3 '16 at 0:10
Kaypro II
76951227
asked Jan 3 '16 at 0:10
Kaypro II
76951227
asked Jan 3 '16 at 0:10
Kaypro II
76951227
76951227
migrated from serverfault.com Jan 3 '16 at 12:27
This question came from our site for system and network administrators.
migrated from serverfault.com Jan 3 '16 at 12:27
This question came from our site for system and network administrators.
If you have an alternate approach, feel free to suggest it. These networks are all setup on a single router (they have different switchports/SSIDs assigned to them), but it appears the router will automatically route between all the networks it has routes to.
– Kaypro II
Jan 3 '16 at 2:17
The above comment was in response to a now-deleted comment.
– Kaypro II
Jan 3 '16 at 4:18
add a comment |
If you have an alternate approach, feel free to suggest it. These networks are all setup on a single router (they have different switchports/SSIDs assigned to them), but it appears the router will automatically route between all the networks it has routes to.
– Kaypro II
Jan 3 '16 at 2:17
The above comment was in response to a now-deleted comment.
– Kaypro II
Jan 3 '16 at 4:18
If you have an alternate approach, feel free to suggest it. These networks are all setup on a single router (they have different switchports/SSIDs assigned to them), but it appears the router will automatically route between all the networks it has routes to.
– Kaypro II
Jan 3 '16 at 2:17
If you have an alternate approach, feel free to suggest it. These networks are all setup on a single router (they have different switchports/SSIDs assigned to them), but it appears the router will automatically route between all the networks it has routes to.
– Kaypro II
Jan 3 '16 at 2:17
The above comment was in response to a now-deleted comment.
– Kaypro II
Jan 3 '16 at 4:18
The above comment was in response to a now-deleted comment.
– Kaypro II
Jan 3 '16 at 4:18
add a comment |
1 Answer
1
active
oldest
votes
Indeed, Mikrotik devices does routing automatically between networks. Consider the two networks 10.0.0.1/16 and 192.168.1.0/24, for example. If you want to block traffic between those two, just add two firewall rules
ip firewall filter add chain=forward src-address=10.0.0.0/16 dst-address=192.168.1.0/24 action=drop
ip firewall filter add chain=forward src-address=192.168.1.0/24 dst-address=10.0.0.0/16 action=drop
so you drop packets in both directions.
answered Jan 4 '16 at 12:18
Benoit PHILIPPON
23613
add a comment |
protected by Community♦ Jul 18 at 0:40
Thank you for your interest in this question.
Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site (the association bonus does not count).
Would you like to answer one of these unanswered questions instead?
1 Answer
1
active
oldest
votes
1 Answer
1
active
oldest
votes
active
oldest
votes
active
oldest
votes
Indeed, Mikrotik devices does routing automatically between networks. Consider the two networks 10.0.0.1/16 and 192.168.1.0/24, for example. If you want to block traffic between those two, just add two firewall rules
ip firewall filter add chain=forward src-address=10.0.0.0/16 dst-address=192.168.1.0/24 action=drop
ip firewall filter add chain=forward src-address=192.168.1.0/24 dst-address=10.0.0.0/16 action=drop
so you drop packets in both directions.
answered Jan 4 '16 at 12:18
Benoit PHILIPPON
23613
add a comment |
Indeed, Mikrotik devices does routing automatically between networks. Consider the two networks 10.0.0.1/16 and 192.168.1.0/24, for example. If you want to block traffic between those two, just add two firewall rules
ip firewall filter add chain=forward src-address=10.0.0.0/16 dst-address=192.168.1.0/24 action=drop
ip firewall filter add chain=forward src-address=192.168.1.0/24 dst-address=10.0.0.0/16 action=drop
so you drop packets in both directions.
answered Jan 4 '16 at 12:18
Benoit PHILIPPON
23613
add a comment |
Indeed, Mikrotik devices does routing automatically between networks. Consider the two networks 10.0.0.1/16 and 192.168.1.0/24, for example. If you want to block traffic between those two, just add two firewall rules
ip firewall filter add chain=forward src-address=10.0.0.0/16 dst-address=192.168.1.0/24 action=drop
ip firewall filter add chain=forward src-address=192.168.1.0/24 dst-address=10.0.0.0/16 action=drop
so you drop packets in both directions.
answered Jan 4 '16 at 12:18
Benoit PHILIPPON
23613
Indeed, Mikrotik devices does routing automatically between networks. Consider the two networks 10.0.0.1/16 and 192.168.1.0/24, for example. If you want to block traffic between those two, just add two firewall rules
ip firewall filter add chain=forward src-address=10.0.0.0/16 dst-address=192.168.1.0/24 action=drop
ip firewall filter add chain=forward src-address=192.168.1.0/24 dst-address=10.0.0.0/16 action=drop
so you drop packets in both directions.
answered Jan 4 '16 at 12:18
Benoit PHILIPPON
23613
answered Jan 4 '16 at 12:18
Benoit PHILIPPON
23613
answered Jan 4 '16 at 12:18
Benoit PHILIPPON
23613
answered Jan 4 '16 at 12:18
Benoit PHILIPPON
23613
23613
add a comment |
add a comment |
protected by Community♦ Jul 18 at 0:40
Thank you for your interest in this question.
Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site (the association bonus does not count).
Would you like to answer one of these unanswered questions instead?
If you have an alternate approach, feel free to suggest it. These networks are all setup on a single router (they have different switchports/SSIDs assigned to them), but it appears the router will automatically route between all the networks it has routes to.
– Kaypro II
Jan 3 '16 at 2:17
The above comment was in response to a now-deleted comment.
– Kaypro II
Jan 3 '16 at 4:18