bridge filter

spire2z · Thu May 10, 2007 5:00 am

Hi, if using bridge filter on a router with 4 interfaces, with the intention of blocking all traffic between 3 interfaces. Should I block forward and input traffic or just forward. to block all traffic?

Thu May 10, 2007 3:06 pm

Forward filters traffic for hosts connected to the router, input filter traffic that is destined directly to the router itself.

spire2z · Fri May 11, 2007 12:56 am

Thats strange as traffic still seems to pass when only forward is dropped. For example I can ping and use winbox through the filter which is on an AP with a 5ghz interface and a 2.4ghz interface with the filter blocking forward between the two. This filter is on the 5ghz card which links other AP's and also has a 2.4ghz AP too. It is connected by wire to core router. Could the core router forward packets so the AP would only see it go in and out to the core router and back out to another client?

sten · Fri May 11, 2007 4:25 pm

perhaps you used the bridge ip as default gateway for some of the users? if traffic is routed and gateway ip is a bridge member, then the traffic will show up in "input" bridge filter chain.

spire2z · Thu May 24, 2007 1:33 pm

No it's just a bridge. The IP used for testing is just one local IP not NATed. and certainly packets are not being dropped from one interface to another?

I have traffic dropped on Forward between:

wlan 1 - wlan 2 forward drop
wlan 2 - wlan 1 forward drop

traffic is dropped between 1 and 2 but not 2 and 1??

sten · Sat May 26, 2007 3:54 pm

export your bridge filter rules?
probably you can reduce the bridge member<->bridge member rules into a single rule.

spire2z · Tue May 29, 2007 9:15 pm

Here is a jpg of my rules in winbox:

Thanks for your time my friend..

sten · Wed May 30, 2007 9:42 am

aside from the rules i already know about, it says nothing.
you *are* aware of the "Print Screen" keys function in windows, right?
Try this in terminal:

/ interface bridge filter export

Which interface is your upstream?

spire2z · Wed May 30, 2007 12:52 pm

No i'm not aware of print screen! Try not to use windows too much!! Not quite sure what you mean as the terminal is the same information as the info in winbox, here it is anyway and thanks again for your help:

/ interface bridge filter
添加链=界面=wlan1 out-interface=wlan2 action=drop \
comment="" disabled=no
添加链=界面=wlan1 out-interface=wlan3 action=drop \
comment="" disabled=no
添加链=界面=wlan2 out-interface=wlan1 action=drop \
comment="" disabled=no
添加链=界面=wlan2 out-interface=wlan3 action=drop \
comment="" disabled=no
添加链=界面=wlan3 out-interface=wlan1 action=drop \
comment="" disabled=no
添加链=界面=wlan3 out-interface=wlan2 action=drop \
comment="" disabled=no

My WAN is ether1.

sten · Thu May 31, 2007 11:02 am

remove those rules and add this one and you'll have the desired effect;
(paste in terminal)

/ interface bridge filter add chain=forward in-interface=!ether1 out-interface=!ether1 action=drop

The logic of that rule is as follows:

If packet is neither entering ether1 (i.e wlan1) nor exiting ether1 (i.e wlan2) then drop.
It wont affect traffic that either enters ether1 (from the internet to one of the wlans) or exits ether1 (to the internet from one of the wlans).
Does this work for you?

spire2z · Tue Jun 19, 2007 3:30 am

No but this did in chain order:

/ interface bridge filter add chain=forward in-interface=!ether1 out-interface=ether1 action=accept

/ interface bridge filter add chain=forward in-interface=ether1 out-interface=!ether1 action=accept

/ interface bridge filter add chain=forward action=drop

The reason my original rules did not work as I found was because of WDS dynamic interfaces. I wrongly assumed that filtering the master interface would block it but no. Thanks for your assistance too my good fellow wisper.

bridge filter

bridge filter

Re: bridge filter

Re: bridge filter

Re: bridge filter

Re: bridge filter

Re: bridge filter

Re: bridge filter

Who is online