How to isolate networks with a Mikrotik router?

7

1

I recently got a Mikrotik router for my network, and I want to create 3 networks that are isolated from each other but all having internet access:

  1. The "main" network for PCs, etc.
  2. A network for home automation devices/appliances. I do not want these hosts to be able to access the other networks, but I want some specific hosts on the main network to be able to access specific hosts on this network.
  3. A guest network for visitors. I want hosts on this network to only have internet access, and be completely isolated from the other networks.

I've been able to setup these three networks using bridges by following these instructions and also mimicking the default configuration that came with the router.

It sound like I now need to define firewall rules to block the traffic between the bridges, and it's here where I need a little help. My understanding is that the Mikrotik firewall software is based on Linux iptables.

  1. There seems like there's two places to do this: the main firewall configuration in /ip firewall filter, and a bridge-specific section in /interface bridge filter. Which one would be best to use? What are the pros and cons of each?

  2. I'm experimenting with the bridge filters, but all my rules have a little traffic bar icon next to them, which doesn't look good to me. I can't find any explanation of what the icon means.

  3. How should I setup the rules? Would it be more manageable create a bunch of separate chains for each bridge? If so, how should the chains be organized?

  4. It sounds like I need to define forward rules for this. Are there any input or output rules that I would need as well?

  5. I should have the rules match on the bridges/interfaces (i.e. in-bridge, out-bridge, WAN interface, etc.), correct? E.g. to block packets from the main network to the home automation network, I would need a rules that's something like in-bridge=main out-bridge=home_automation action=DROP, correct?

Kaypro II

Posted 2016-01-03T00:10:31.250

Reputation: 1 359

If you have an alternate approach, feel free to suggest it. These networks are all setup on a single router (they have different switchports/SSIDs assigned to them), but it appears the router will automatically route between all the networks it has routes to. – Kaypro II – 2016-01-03T02:17:26.413

The above comment was in response to a now-deleted comment. – Kaypro II – 2016-01-03T04:18:40.303

Answers

6

Indeed, Mikrotik devices does routing automatically between networks. Consider the two networks 10.0.0.1/16 and 192.168.1.0/24, for example. If you want to block traffic between those two, just add two firewall rules

ip firewall filter add chain=forward src-address=10.0.0.0/16 dst-address=192.168.1.0/24 action=drop
ip firewall filter add chain=forward src-address=192.168.1.0/24 dst-address=10.0.0.0/16 action=drop

so you drop packets in both directions.

Benoit PHILIPPON

Posted 2016-01-03T00:10:31.250

Reputation: 266

Asked: 2016-01-03T00:10:31.250

Viewed: 21 425 times

Active: 2018-12-14T21:54:29.433