Isolation port configuration on MikroTik devices
Isolation port configuration on MikroTik devices
Hello, I have a query about isolating Mikrotik RB750Gr3 ports. The configuration I have is: port1=WAN, port2=LAN, 192.168.100.0/24, port3=disabled, port4=Servers, 192.168.10.0/24, port5=Management, 10.1.0.0/24. I've applied these firewall rules with chain=forward action=drop on interfaces eth2 and eth4. However, traffic between devices is being dropped—like pings from 192.168.100.156 to 192.168.10.11 are not reaching the gateway. Similarly, 192.168.10.11 to 192.168.100.1 isn't dropping either. Any advice?
The packets reaching the router are handled through the Input chain, not Forwarding, even if the router's IP is on a different subnet. NOTE: I didn’t examine your rules closely. Dropping should be based on incoming and outgoing interfaces. For better results, consider filtering by source and destination IPs. You can add a subnet (e.g., 192.168.100.0/24) in the firewall fields. Otherwise, set drop rules directly on the input for those IP addresses.
Okey, so which chain is this ? Also I had the rule ( chain=forward action=drop src.address=192.168.100.0/24 dst.address=192.168.10.0/24 ) but this was working same. If create Vlan for ports, then I am loosing internet connection. Also 1 more thing. I want to set gateway for Mikrotik management port5 (130.1.0.10 interface IP) can you guide me ?
If blocking form interfaces and network address failed, it's likely a master/slave configuration or a bridged setup. Verify if your interfaces include any master or bridge connections. Regarding the gateway, ensure Ether 5 uses Ether 1 as the gateway—this can be achieved through bridging or static routing depending on your needs.
These guidelines would indeed prevent regular device traffic on ether2 from reaching the router. They aim to preserve the ability to communicate with the default gateway.
Yes it's going to drop everything destined for the router. Depending what's connected can still reach everything else in the subnet but he will be island out. His original rules separate the networks already. If he is concerned that because he can ping the gateway of either subnet then that is another point. Original rules will separate the networks. Each gateway is the mikrotik. Just because you have a rule to prevent the networks from talking, it doesn't matter when pinging any interface on a device. If you want to prevent that you will need to stop all traffic hitting the gateway. Otherwise it's not a concern to worry about
Set gateway to 10.1.0.1 on interface port5, link it to 10.1.0.2. Use default gateway for port2.