Its important you think about what you do and what to achieve and how to do itĪnd by doing so you learn more about it.ī. I don't want to give a simple command line to copy. This for each BRIDGE 1 (you can refine with connection state etc.)ĭo this for every bridge, then do a drop all on forward chain and you see you wont be able to ping from one bridge to another anymore. Chain forward: accept source interface list WAN, destination interface BRIDGE 1 Chain forward: accept source interface: BRIDGE1, destination interface list: WAN In your case you could allow by adress space, by bridge, interface or interface list.Įxample (this is not real code but should tell you how to do): Now ROS is really incredible as it has firewall that does not only allow IP address, but also interfaces, interface list and many more things to base your filterĭecision (accept/drop) on it. You can do much more but I keep it simple.At the end of the firewall, any packet not dropped or accepted will then be routed (=accepted).The router also routes (connects) data from your bridge into the internet if he thinks the IP is located there.īefore the router does the 'routing', you have the option to tell him via the firewall: So your IP on bridge 1 can talk to another IP on bridge 2 etc as router by default is supposed to make the talk! The router 'routes' all these IP packets. (outside world does know what IP is used behind NAT). 元: IP level: This level of connection does not care if its in the cloud, your home network, within a router or over 2 or more routers etc.ĭevices have IP addresses and can try to connect to any other IP address in the world. > make sure you keep trusted devices (= important) only in the same L2 network with other trusted devices.Īnd ensure those devices on that network don't 'share' disks or folders without passwords at least!

Nowadays they all are full network devices, which means you do not know what they do and they communicate to remote servers without To be installed on your PC or mobile to make them work. This was not that much of an issue before (many devices had not a real IP stack and needed dedicated 'applications' to (this is for instance all the clients and computers/devices you see on the same Wifi network).Īll these can do pretty much what they want and each of them are also aware what device there are within the bridge.

L2 / 'within the bridge' level : Devices within L2 communicate and see everybody on that network.

Maybe some more fundamental aspects before designing your security:

Mikrotik bridge firewall